Jabber/XMPP, Matrix are the obvious answers.

I add IRC to the Mix

IRC is not end‐to‐end encrypted.

You could use a secure encrypted IRC-like protocol like Pest[0], though.

[0]: https://pestnet.io

Comes up with a privacy error atm. Guess their server got bit hard by HN?

Cached copy here: https://web.archive.org/web/20220915015328/https://pestnet.i...

Reminds me a bit of SILC: http://www.silcnet.org/

Still going to struggle with UX on a phone though...

In theory you can use OTR[1] but I've yet to see an easy way to use this from a phone.

I remember IRC very fondly, but I feel it has a lot of baggage that makes it difficult to bring into the modern era.

This blog post (not mine) explains it quite well: https://jlu5.com/blog/im-tired-of-irc-heres-why

[1] https://otr.cypherpunks.ca/

OTR doesn't do groups. So it isn't really applicable to IRC. At this point, I am not really sure that end to end encryption is generally applicable to groups. The identity management problem quickly spirals out of control. I note that Telegram doesn't even try. I think the best that can be done is a scheme that makes everyone entirely trust the moderator of the group.

>At this point, I am not really sure that end to end encryption is generally applicable to groups.

You encrypt the message with all the public key's from persons in the group, what's the problem? You do it the same way with Mail...aka pgp.

You don't need OTR just plain old gnupg:

https://www.gnupg.org/gph/en/manual/x110.html

Each participant needs to verify each and every other participant. So for 2 participants that's 2 verifications. For 3 participants that is 9 verifications. For 4 it's 16. The square of the number of participants. With just 30 participants that works out to 900 verifications ... and who actually knows 30 people on the internet? Even if you could do the verification in a technical sense it wouldn't mean anything.

If you get a whole bunch of people together in real life for a meeting then chances are one or more of them is going to leak what happened. The problem is to a great extent inherent.

Man you never hear of a trust-chain? How do you think end to end encryption works otherwise?

And no you don't need to verify each other keys, since every one has his public key you obliviously trust, you just try to make an excuse for not knowing how e2e works.

neither is XMPP by default

I'll get my mum right onto it

In all fairness, I got my entire non-technical family onto xmpp/jabber with Snikket (which is a highly opinionated packaging of existing xmpp server and clients with minor tweaks). They scan a QR code to download the app and join the server. It is e2ee out of the box and the experience is quite comfortable and seamless, even for a non-technical person.

There are varying degrees of “non-technical”, and you lost most of my family at “scan a QR code”

I thought this was a skill that most people had now that most restaurants only give QR codes for menus?

I've only seen QR code menus in big cities and the southwest U.S.

Probably depends on where you are, I’ve only seen that option once or twice, and that was in addition to a proper menu.

My dad finally retired his 2008 flip phone last year, but before that a QR code would have been no help to him. I visited them recently, and not a single restaurant (business at all) had QR codes in their town.

I don't know how it would have gone remotely, but no issue in-person. I opened an invite QR on my device, asked parent to open camera, and point it at code. They get the gist that the app name is Snikket, they get notifications of messages and calls, and the layout and icons are pretty similar to every other messaging app. I am going to attempt it with an in-law who only just stepped into the smartphone era this month, has no familiarity with a smartphone interface, and is the least technical person I know.

I know it's an anecdote, and I'm the founder of the Snikket project, but I rolled out an early version to 10+ family members during lockdown. The majority of them were remote and ages from <5 to >80. I emailed them the invitation link, and that was about it. They all managed to sign up with no issues.

Scanning a QR isn't actually necessary. That flow exists for when you open the invitation on e.g. a desktop or laptop, and you actually want to set up Snikket on your phone/tablet. The invitation page guides you through you what to do in that case, you don't need to know what a "QR code" is. But most people just open the invitation directly on their phone, and it has a magic link to install the app.

In some ways it's easier, because you don't need to go through the SMS verification and stuff that the phone-number-based platforms require. I know various APIs and hacks have made that flow easier over the years, but it's still an extra step for non-technical people to get lost in. It's also an obstacle for people who want to use a tablet, such as my children who are too young for phones.

In any case, I'd encourage people to be less defeatist about the adoption of more open alternatives (intended or not, that's how I read your comment). It is possible... my own family average no more or less technical than any other. They manage to use WhatsApp without help, and they manage to use Snikket without help. And of course I'm not the only person using it successfully.

My mother has no idea how to check her email and doesn't use it. She also doesn't know how to text. Or check voicemail. It's just another point of anecdata, but this is my bar for "non-technical."

I too have struggled to establish private communications with nontechnical folks.

I think the best bet would be to create a device with the sole functionality of establishing an encrypted voice line to you. Essentially, a plastic brick with an on button, speaker and microphone. No screen, no UI, just on/off. Like a walkie-talkie, but for infinite distances.

Can they use it to chat with classmates from high school? Given my parents generation (Boomer, born 1948), they're mostly all on Facebook, so they either use Facebook groups+Messenger, SMS, or email (yikes!). Family chat is just on a giant SMS chain, which admittedly is awkward as there are several "sub-chains" with some people removed.

Or is my family just weird in their chat preferences?

My folks are in the same age group and don't care for FB. Not sure that is representative of boomers as a whole, but the family generally likes the idea of communicating on a private, secure chat system.

In my experience, elder folks prefer familiarity and convenience above all else. My parents were born in the '50s and hate to relearn their phones.

There is no technical barriers that can not be overcome to allow the use of XMPP by normal non-technical users. GChat for years was XMPP until google got a market share they desired and choose to take their users off an open protocol in favor of their own one (which they then killed a few years later )

Technical barriers are not usually how non-technical people choose technology - it's usually based on things like UX and how many of their friends already using the service.

I got my entire immediate family on Matrix without too much difficulty. The only big issue happened when my mom got a new iPhone and it cloned the old Element install from her old iPhone, causing two devices to have the same set of identity keys and we had to reset them.

Your ISP and mobile provider still know :) your gadgets have registered IDs in the hardware.

Every mechanical thing we come up has a decode-able sequence.

DIY filter bubbles each of a unique configuration, decoupled from someone else’s monolith is the only way to be sure.

It’s reverse Highlander; there cannot be only one. It’s fine, we were never all going to get along anyway.

> DIY filter bubbles each of a unique configuration

Wdym, can you please explain? Decoupling is the only way to be sure of what?

This one looks interesting: https://simplex.chat/

Threema

"Session": it's a Signal fork which uses Tor

It's a Signal fork that uses Oxen, a Tor fork. It also changes a lot under the hood with regards to encryption, and I'm not smart enough to know if the changes are good or bad.

There's not a truly solid secure anonymous implementation that I've found.

Threema doesn't require a phone number.

Yes, but afaik Threema also doesn't have publicly discoverable channels, which is the feature that was used here.

Sooo, not really an alternative (at least for the user whose data got subpoena'd).

Matrix (with the Element client), Wire and Threema are a few options that don't require phone numbers, offer end-to-end encryption and have mobile clients. IIRC, the chats also sync across devices (with some duration limits measured in weeks) on all these platforms.