Messenger

There are countless instant messaging apps on the market. These range from platform-specific apps like Apple’s iMessage to those linked to other services like Facebook Messenger, apps from companies and organizations that offer only this product and the service behind it, all the way to completely open-source software where you have to set up the connection yourself, such as XMPP or Matrix. However, I’d like to focus here solely on popular messaging apps that can be installed from the platforms’ app stores (iOS, Android).

Signal

Signal is my personal favorite. As open-source, free software (GPLv3), Signal offers confidential communication—with end-to-end encryption. The Signal protocol (originally the Axolotl protocol), developed in-house, has undergone an external audit, is considered extremely secure, and is now also used by many other messaging apps. Even audio and video calls (including group calls) are encrypted. Only strictly necessary metadata is used.

Signal is an independent, nonprofit organization, so the messenger contains no ads, no affiliate marketing, and no tracking, and both the app and the service behind it are available free of charge.

Threema

Threema is quite comparable to Signal, but is distributed by a company based in Switzerland. Threema GmbH assures users that it operates only GDPR-compliant servers in Switzerland (in-house) and is therefore not subject to access by government authorities or intelligence agencies. An additional privacy feature compared to other messaging apps is that the ID is generated independently and is not tied to a phone number.

The app costs a one-time fee (currently €3.99 for Android), but the service itself is provided free of charge. The client software is available as open-source software under the GPLv3 license and, in theory, can even be built from scratch. However, the server remains proprietary software and thus relies on users’ trust. Threema also has its software subjected to external security audits and is considered extremely secure thanks to end-to-end encryption, even in group chats, audio calls, and video calls. To transfer the ID to a new device, the user must have created a backup themselves.

Telegram

Telegram always gives me the feeling that I’m dealing with a half-finished app. Conversations are unencrypted by default, but when starting a conversation, they can be set up as secret chats with end-to-end encryption using a proprietary protocol. However, these chats are stored unencrypted on the device, and group chats or channels cannot be encrypted; furthermore, the feature isn’t necessarily self-explanatory and is therefore rarely used. Telegram automatically uploads contacts to the server and handles its users’ data very loosely. All unencrypted input is sent to the server as soon as it’s entered and stored there permanently.

The client is partially free software under the GPL, but the server components are not. Due to the use of non-free components, the available versions—for example, on Android—vary depending on their source. The Play Store version uses Google Play Services for notifications, while the FOSS version from the F-Droid Store handles notifications itself.

Use of the app is generally free and is financed through advertising in channels; paid features are currently being considered. The company’s structure is not documented, as the two Russian founders have liquidated the original company, and it is reportedly based in Dubai. Telegram is by far the least secure messaging app on the market!

WhatsApp

WhatsApp is owned by Meta Platforms Inc. (formerly Facebook Inc.), a company that seeks to establish a monopoly on interpersonal communication on the internet. To this end, user data and usage information are stored and shared across its various platforms and with third-party providers. Although communication is end-to-end encrypted (using the Signal protocol), the contacts and metadata—when combined with those from other services—already create a fully transparent user profile.

In my view, even the widespread use of this acquired messaging app is no reason to use it. WhatsApp is nowhere near compliant with the GDPR!

xx Messenger

A brand-new messenger that aims to do everything better is xx Messenger, which is built on the xx Network. There are no servers in the traditional sense, but rather nodes that are modified Tor nodes, designed to prevent both the disclosure of locations and the identification of conversation partners. The metadata is further obfuscated by a proprietary mechanism (cMix). Of course, communication is end-to-end encrypted.

xx Messenger is built on the xx Network’s blockchain and is thus designed to be uncrackable even by future quantum computers. This design, of course, means that users cannot simply connect through their own contacts; instead, a direct exchange of keys is required.

Conclusion

WhatsApp and Telegram should not be used. They are insecure and/or data collectors that want to make money off our data. On these platforms, we go from being customers to being the product. Threema stands out by not requiring a phone number, but it doesn’t have open-source server software. However, those who trust the Swiss company will find a very secure messaging app. My top recommendation in this comparison is definitely Signal, whose entire software is available under a free license.