this post was submitted on 27 Nov 2025
51 points (98.1% liked)

Privacy

3016 readers
297 users here now

Icon base by Lorc under CC BY 3.0 with modifications to add a gradient

founded 2 years ago
MODERATORS
Ategon@programming.dev
danielintempesta@programming.dev
51
Following the "voluntary" scanning added in the latest EU Council Chat Control vote, what is a realistic option for a family/friends chat? Is self hosting your own Matrix/DeltaChat server the only opt (piefed.zip)
submitted 1 week ago by Blaze@piefed.zip to c/privacy@programming.dev
30 comments fedilink hide all child comments
 

https://www.patrick-breyer.de/en/reality-check-eu-council-chat-control-vote-is-not-a-retreat-but-a-green-light-for-indiscriminate-mass-surveillance-and-the-end-of-right-to-communicate-anonymously/

By "shared" servers I mean hosters like https://tchncs.de/en/ who offer a bunch of services (they do a great job at it by the way) including Matrix and Lemmy.

I'm thinking of moving my close family to a Matrix chat over there, but I guess long term they might have to implement the ChatControl scanning.

This whole thing is just stupid.

top 30 comments
sorted by: hot top controversial new old
[–] Sophocles@infosec.pub 12 points 1 week ago (1 children)

XMPP/Jabber comes to mind. You can self host or pay for hosting on a service like Snikket. The protocol supports OMEMO encryption and you can use whatever client you want (Cheogram, Dino, Gajim, etc) on any platform like android or linux. Cheogram is even coming out with a web interface for it, and it supports calling and video calling.

Threat model wise, whatever server you pick would have to be targeted directly, and would therefore be immune to sweeping regulation that directly targets big hitters like Signal. And if you pay for servers outside the EU, even more so

[–] Blaze@piefed.zip 5 points 1 week ago (1 children)

Thank you. I had a look at XMPP a while ago, but now DeltaChat seems a bit modern and with built-in encryption compared to OMEMO.

I just set up an account for a friend on their phone, the thing took 5 minutes, definitely nice than the Matrix experience.

[–] bluemoon@piefed.social 2 points 1 week ago (1 children)

i adore deltachat and arcane chat

[–] Blaze@piefed.zip 1 points 1 week ago

Yes, they are really growing on me

[–] Mikina@programming.dev 10 points 1 week ago* (last edited 1 week ago) (3 children)

By the way, if you are using Gmail for Email, have files stored on GDrive, OneDrive (Documents are by default in OneDrive on Windows) or iCloud, use Messenger, Whatsapp, Skype, Snapchat, Xbox or Instagram to communicate, your files and messages are already being scanned for the last 5 years, since 2021.

ChatControl was already voluntary, and the products I mentioned villingly joined and are already doing it. For most of the people suddenly complaining, not much actually changes. They could do something about it for the past 5 years - not use the apps that do it, but "I don't want to install another chat apps, I have everyone on messenger" have been forcing people like me to choose between privacy and having a way how to contact friends and familly. And I'm 90% sure that most of them vouldn't switch even if this new law did not pass.

Anyway, if you haven't already, look up "Matrix ansible project", it's an extremely easy way how to set up a server, with awesome guides and actually a very robust implementation. It will save you a lot of time. I"m just paying 6$ a month for Hetzner cloud, and setting it up took like an hour tops.

Self-hosted open source solutions will always be an alternative, the major problem is that they will soon ban side-loading of apps to phones, so you won't be able to install a FOSS messenger that connects to your solution, or a browser that doesn't scan you, unless you have something like GrapheneOS.

[–] Blaze@piefed.zip 5 points 1 week ago (1 children)

Hopefully this announcement will still push people to FOSS messengers.

I personally moved most of my data from Google and Microsoft around 2 years ago. Sure, they still have the data until 2021, but there's no time machine, we can only act on the present.

“Matrix ansible project”,

My main issue with Matrix is the onboarding process. I just tried myself with two accounts, one on Fluffychat, the other on ElementX, the verification process is buggy (didn't work the first time, I had to restart the apps for it to work), and even after you verify, ElementX will still show FluffyChat messages with a red warning because "this message has been sent from a device not verified by the sender", while there is no way to verify the device on FluffyChat.

And I had to use FluffyChat as multi-account is still not available in Element X.

Anyway, I just set up DeltaChat on my girlfriend's phone, we'll try in out in the coming days. I keep an eye on second-hand Pixels with GrapheneOS, but one step at a time.

[–] Mikina@programming.dev 2 points 1 week ago (1 children)

To be honest, I'm only using Matrix for the bridges into every other service, so I can talk to people on messenger, signal, telegram, discord and whatsapp through a single app, the Matrix client, so I at least don't have spyware on my phone, even though they'll get my messages. And E2E encryption doesn't apply in that case, so I never had to deal with it.

With self-hosted solution, your main advantage is that you can simply create the accounts on the server side, and don't need any verification. After the first login, it usually asks for every new device, that you have to confirm the session on a device that's already confirmed, but I never had issues with that.

But I don't have experience with actuall Matrix to Matrix communication, I just used the bridges. Haven't tried DeltaChat yet, but tbh I've just given up convincing people to switch and am glad I can at least have the bridges working, so I never have to login or use any apps or websites of FB/Discord/whatever.

[–] ReversalHatchery@beehaw.org 1 points 6 days ago

and don't need any verification.

It's still a good idea because the clients will show a scary warning for everyone else

[–] bluemoon@piefed.social 2 points 1 week ago (1 children)

just install LineageOS or but a fairphone or vollaphone or shiftphone or furyphone with it preinstalled. or get a linux handheld device like the comet or pinephone or precursor et al

there is no using exploitative tech without financially running off a cliff. sooner you change the better

[–] Blaze@piefed.zip 2 points 1 week ago (1 children)

Good point about LineageOS. I'm just afraid of bricking the devices.

[–] bluemoon@piefed.social 2 points 1 week ago* (last edited 1 week ago) (1 children)

i find i overcame the fear after rewriting the how-to on lineage os's site. it is shite, seriously fifty "steps" to do something that takes 3

edit: i am recalling downloading the OS and the "bootstrap OS" (think of mobile-computers as having two OS:s. in the case of every thing good ever i use TWRP as the bootstrap OS as it is the facto and free libre open-source. each OS on a mobile-computer is coded to fit that mobile-computer, so in a sense it is stepping back to the time before the PC and undoing the case for portability. like undoing GNU/Linux. which runs on any PC. the bootstrap OS TWRP is uniquely programmed for each mobile-computer. as is the OS LineageOS. think of it like an ignition motor and a car engine. you need both to be fitted to the (mobile computer.) that all typed out: so i download both for that specific brand/series/model/variation and that's done. seems overly complicated because it is unusual for us who otherwise just install the same Linux on any computer we have.

no worry about bricking if you flash wrong OS version. you reflash and don't read what the fearmongerers type online. the mobile distro community ar worse than the bad parts of Windows & Arch followers combined: lots of l33t h4ck3r5 without substantial claims to what they're frightening you about or suggesting you do ("it just works trust me bro") and elitism about which opinion is the best opinion to hold. like "oh, you use That? idk anything about that but use this one it never failed me =)" links to a google drive with a proprietary file they just asked you to install based on Trust Me Bro.

so anyways TWRP and LineageOS stands out as the most organizational or institutional in that uh digital landscape oe whatchamacallit.

second is to enter the phone's BIOS into a "flashing mode" to install the bootstrap OS TWRP. next you restart and directly boot into the bootstrap OS TWRP - shittified as mobile-computers are the BIOS will delete TWRP and reinstall the factory default bootstrap OS if we start the main stock Android OS... inside TWRP the OS LineageOS is installed. once this is done the main OS will keep the bootstrap OS.

that was all the steps. done.

  1. download TWRP & LineageOS to your Linux distro. turn off your phone, connect it to your computer.

  2. turn to your phone and boot it into flash mode, turn to your computer to have it send TWRP across the wire: this is installing TWRP.

  3. turn to your phone and boot it into TWRP, inside you have an install mode that mimics the BIOS' flash mode. turn to your computer to have it send LineageOS across the wire: this is installing LineageOS.

programs required on your Linux distro: ADB (Android Debug Bridge). period. you use ADB to verify if your connected phone is picked up by ADB by using a command to list all devices found by adb. i take this as a given troubleshooting step after rebooting my phone for the first time. into flash mode. it is assumed to be all good while rebooting the second time. (into TWRP.) by te third reboot the phone it's already done so no need to verify ADB picks up the phone.

depending on brand you can require a program for flashing the bootstrap OS & main OS. Samsung brand phones require a program called heimdall to send TWRP & LineageOS since doing it by ADB is - thanks enshittification - made tedius to do by hand. think of heimdall as an automation script for using ADB on specifically Samsung phones.

ask for more experience. remember this is daunting because people are scaremongers and you are missing out on something child's play simple.

[–] Blaze@piefed.zip 2 points 1 week ago (1 children)

Thank you for the edit!

[–] bluemoon@piefed.social 2 points 1 week ago

you and all lurkers are welcome =)

wouldn't be motivated to divulge anything without ya asking or bringing it up

[–] Sunshine@piefed.ca 2 points 1 week ago

unless you have something like GrapheneOS.

I'm glad I just got it installed!

[–] IceFoxX@lemmy.world 3 points 1 week ago

Tox protocol ( its build on tor) Any p2p messenger using this protocol.

[–] bluemoon@piefed.social 3 points 1 week ago

p2p im:s like cwtch and jami come to mind

[–] iloveDigit@piefed.social 2 points 1 week ago* (last edited 1 week ago) (2 children)

I don't quite get what you're asking. You can use any chat app that works, just don't expect privacy with current tech unless you're a pair of trustworthy cryptography experts using secure devices at both ends. Near future tech should make it more possible for regular everyday tech users to achieve what an expert could do today

[–] ReversalHatchery@beehaw.org 2 points 6 days ago (1 children)

that's nonsense.

You can use any chat app that works, just don't expect privacy

that was the fucking point, that they are making it illegal to change this for the better

unless you're a pair of trustworthy cryptography experts using secure devices at both ends. Near future tech should make it more possible for regular everyday tech users to achieve what an expert could do today

you don't have to be an expert for it today, but in the near future easy private tech will be illegal so that you will have to be an expert on it.

[–] iloveDigit@piefed.social 1 points 6 days ago

You're overestimating how secure devices are today & I believe underestimating the work devs are doing to fix that regardless of what lawheckers say

[–] Blaze@piefed.zip 7 points 1 week ago (1 children)

I want to avoid messaging apps that will be scanned. Seems likely that Signal will be part of it.

In the risk analysis, providers must check whether their services can be misused for the dissemination of abuse material or for contacting children. There are to be three categories for this: high, medium, and low risk. Providers in the highest category could be obliged to participate in the development of risk mitigation technologies.

We can anticipate Signal and co. will be part of the high risk category and assume the risk mitigation tech will be aimed towards breaking encryption. Especially since this new agency will be interfacing with Europol. I don’t see this as a win or even a draw.

https://feddit.org/comment/10169945

you’re a pair of trustworthy cryptography experts using secure devices at both ends.

As a lot of people here, I'm usually the IT/tech reference person in my family, so if I suggest to move to DeltaChat or Matrix, I'll just take their devices, set it up and we'll use that from now.

I have been looking at a real WhatsApp alternative, this was the last push I needed.

[–] iloveDigit@piefed.social -2 points 1 week ago (2 children)

Moving away from WhatsApp might reduce how many people can access your messages, but you can still assume your messages will be scanned and indexed no matter what app you use

[–] Blaze@piefed.zip 5 points 1 week ago (3 children)

I'm actively looking at used Pixels with GrapheneOS installed, they aren't that pricy these days, but even without those already getting rid of the app-level scanning would be an improvement.

[–] noxypaws@pawb.social 4 points 1 week ago (1 children)

If you get a Pixel with GrapheneOS preinstalled, please please PLEASE do your own fresh installation of GrapheneOS anyways. You can't trust what some third party may have done with it before you get it.

[–] Blaze@piefed.zip 4 points 1 week ago

Of course, that's the plan. Having it preinstalled is just to make sure the device was able to run it before I reinstall myself.

[–] Sunshine@piefed.ca 2 points 1 week ago

I beat you to the punch there 😉

[–] iloveDigit@piefed.social 1 points 1 week ago* (last edited 1 week ago) (1 children)

GrapheneOS probably a big step for reducing the number of people with access, I think

[–] Blaze@piefed.zip 4 points 1 week ago

It's definitely going to be context-based:

  • I don't mind getting used Pixels for my parents and my sister
  • DeltaChat allows to create several profiles, so I can at least have one profile dedicated to chats with my family where everyone uses a secure device
  • for other stuff, I accept that it will be scanned, but it's less critical
[–] onlinepersona@programming.dev 1 points 1 week ago (1 children)

Wy do you assume opensource apps will scan your messages?

[–] iloveDigit@piefed.social 1 points 1 week ago

I don't, but I assume closed source components and/or human error will leak all my messages

[–] AntiBullyRanger@ani.social 2 points 1 week ago

RFC 1149, unironically.
My family is technologically illiterate, and there’s nothing I can do to impart them OPSEC with.