Git Product home page Git Product logo

simplex-chat / simplex-chat Goto Github PK

View Code? Open in Web Editor NEW
5.3K 65.0 258.0 205.75 MB

SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱!

Home Page: https://simplex.chat

License: GNU Affero General Public License v3.0

Haskell 35.27% Dockerfile 0.02% Shell 0.60% Kotlin 31.24% CMake 0.13% C 0.44% Swift 24.16% Objective-C 0.01% Nix 0.48% Awk 0.01% HTML 2.51% CSS 1.11% TypeScript 1.55% JavaScript 1.26% Nunjucks 0.09% C++ 1.11%
chat protocol e2ee privacy haskell security messaging encryption double-ratchet

simplex-chat's Introduction

build GitHub downloads GitHub release Join on Reddit Follow on Mastodon

| 30/03/2023 | EN, FR, CZ, PL |

SimpleX logo

SimpleX - the first messaging platform that has no user identifiers of any kind - 100% private by design!

       

Welcome to SimpleX Chat!

  1. 📲 Install the app.
  2. ↔️ Connect to the team, join user groups and follow our updates.
  3. 🤝 Make a private connection with a friend.
  4. 🔤 Help translating SimpleX Chat.
  5. ⚡️ Contribute and help us with donations.

Learn more about SimpleX Chat.

Install the app

iOS app   Android app   F-Droid   iOS TestFlight   APK

  • 🖲 Protects your messages and metadata - who you talk to and when.
  • 🔐 Double ratchet end-to-end encryption, with additional encryption layer.
  • 📱 Mobile apps for Android (Google Play, APK) and iOS.
  • 🚀 TestFlight preview for iOS with the new features 1-2 weeks earlier - limited to 10,000 users!
  • 🖥 Available as a terminal (console) app / CLI on Linux, MacOS, Windows.

Connect to the team

You can connect to the team via the app using "chat with the developers button" available when you have no conversations in the profile, "Send questions and ideas" in the app settings or via our SimpleX address. Please connect to:

  • to ask any questions
  • to suggest any improvements
  • to share anything relevant

We are replying the questions manually, so it is not instant – it can take up to 24 hours.

If you are interested in helping us to integrate open-source language models, and in joining our team, please get in touch.

Join user groups

You can join the groups created by other users via the new directory service. We are not responsible for the content shared in these groups.

Please note: The groups below are created for the users to be able to ask questions, make suggestions and ask questions about SimpleX Chat only.

You also can:

  • criticize the app, and make comparisons with other messengers.
  • share new messengers you think could be interesting for privacy, as long as you don't spam.
  • share some privacy related publications, infrequently.
  • having preliminary approved with the admin in direct message, share the link to a group you created, but only once. Once the group has more than 10 members it can be submitted to SimpleX Directory Service where the new users will be able to discover it.

You must:

  • be polite to other users
  • avoid spam (too frequent messages, even if they are relevant)
  • avoid any personal attacks or hostility.
  • avoid sharing any content that is not relevant to the above (that includes, but is not limited to, discussing politics or any aspects of society other than privacy, security, technology and communications, sharing any content that may be found offensive by other users, etc.).

Messages not following these rules will be deleted, the right to send messages may be revoked, and the access to the new members to the group may be temporarily restricted, to prevent re-joining under a different name - our imperfect group moderation does not have a better solution at the moment.

You can join an English-speaking users group if you want to ask any questions: #SimpleX users group

There is also a group #simplex-devs for developers who build on SimpleX platform:

  • chat bots and automations
  • integrations with other apps
  • social apps and services
  • etc.

There are groups in other languages, that we have the apps interface translated into. These groups are for testing, and asking questions to other SimpleX Chat users:

#SimpleX-DE (German-speaking), #SimpleX-ES (Spanish-speaking), #SimpleX-FR (French-speaking), #SimpleX-RU (Russian-speaking), #SimpleX-IT (Italian-speaking).

You can join either by opening these links in the app or by opening them in a desktop browser and scanning the QR code.

Follow our updates

We publish our updates and releases via:

Make a private connection

You need to share a link with your friend or scan a QR code from their phone, in person or during a video call, to make a connection and start messaging.

The channel through which you share the link does not have to be secure - it is enough that you can confirm who sent you the message and that your SimpleX connection is established.

Make a private connection Conversation Video call

After you connect, you can verify connection security code.

User guide (NEW)

Read about the app features and settings in the new User guide.

Help translating SimpleX Chat

Thanks to our users and Weblate, SimpleX Chat apps, website and documents are translated to many other languages.

Join our translators to help SimpleX grow!

locale language contributor Android and iOS website Github docs
🇬🇧 en English
ar العربية jermanuts android app
-
website
🇧🇬 bg Български android app
ios app
🇨🇿 cs Čeština zen0bit android app
ios app
website
🇩🇪 de Deutsch mlanp android app
ios app
website
🇪🇸 es Español Mateyhv android app
ios app
website
🇫🇮 fi Suomi android app
ios app
website
🇫🇷 fr Français ishi_sama android app
ios app
website
🇮🇱 he עִברִית android app
-
🇭🇺 hu Magyar android app
-
🇮🇹 it Italiano unbranched android app
ios app
website
🇯🇵 ja 日本語 android app
ios app
website
🇳🇱 nl Nederlands mika-nl android app
ios app
website
🇵🇱 pl Polski BxOxSxS android app
ios app
🇧🇷 pt-BR Português android app
-
website
🇷🇺 ru Русский android app
ios app
🇹🇭 th ภาษาไทย titapa-punpun android app
ios app
🇹🇷 tr Türkçe android app
ios app
🇺🇦 uk Українська android app
ios app
website
🇨🇳 zh-CHS 简体中文 sith-on-mars

Float-hu
android app
ios app
 


website

Languages in progress: Arabic, Japanese, Korean, Portuguese and others. We will be adding more languages as some of the already added are completed – please suggest new languages, review the translation guide and get in touch with us!

Contribute

We would love to have you join the development! You can help us with:

  • share the color theme you use in Android app!
  • writing a tutorial or recipes about hosting servers, chat bot automations, etc.
  • contributing to SimpleX Chat knowledge-base.
  • developing features - please connect to us via chat so we can help you get started.

Help us with donations

Huge thank you to everybody who donated to SimpleX Chat!

We are prioritizing users privacy and security - it would be impossible without your support.

Our pledge to our users is that SimpleX protocols are and will remain open, and in public domain, - so anybody can build the future implementations of the clients and the servers. We are building SimpleX platform based on the same principles as email and web, but much more private and secure.

Your donations help us raise more funds – any amount, even the price of the cup of coffee, would make a big difference for us.

It is possible to donate via:

  • GitHub - it is commission-free for us.
  • OpenCollective - it charges a commission, and also accepts donations in crypto-currencies.
  • Monero: 8568eeVjaJ1RQ65ZUn9PRQ8ENtqeX9VVhcCYYhnVLxhV4JtBqw42so2VEUDQZNkFfsH5sXCuV7FN8VhRQ21DkNibTZP57Qt
  • Bitcoin: 1bpefFkzuRoMY3ZuBbZNZxycbg7NYPYTG
  • BCH: 1bpefFkzuRoMY3ZuBbZNZxycbg7NYPYTG
  • USDT:
    • BNB Smart Chain: 0x83fd788f7241a2be61780ea9dc72d2151e6843e2
    • Tron: TNnTrKLBmdy2Wn3cAQR98dAVvWhLskQGfW
  • Ethereum: 0x83fd788f7241a2be61780ea9dc72d2151e6843e2
  • Solana: 43tWFWDczgAcn4Rzwkpqg2mqwnQETSiTwznmCgA2tf1L

Thank you,

Evgeny

SimpleX Chat founder

Contents

Why privacy matters

Everyone should care about privacy and security of their communications - innocuous conversations can put you in danger even if there is nothing to hide.

One of the most shocking stories is the experience of Mohamedou Ould Salahi that he wrote about in his memoir and that is shown in The Mauritanian movie. He was put into Guantanamo camp, without trial, and was tortured there for 15 years after a phone call to his relative in Afghanistan, under suspicion of being involved in 9/11 attacks, even though he lived in Germany for the 10 years prior to the attacks.

It is not enough to use an end-to-end encrypted messenger, we all should use the messengers that protect the privacy of our personal networks - who we are connected with.

SimpleX approach to privacy and security

Complete privacy of your identity, profile, contacts and metadata

Unlike any other existing messaging platform, SimpleX has no identifiers assigned to the users - not even random numbers. This protects the privacy of who are you communicating with, hiding it from SimpleX platform servers and from any observers. Read more.

The best protection against spam and abuse

As you have no identifier on SimpleX platform, you cannot be contacted unless you share a one-time invitation link or an optional temporary user address. Read more.

Complete ownership, control and security of your data

SimpleX stores all user data on client devices, the messages are only held temporarily on SimpleX relay servers until they are received. Read more.

Users own SimpleX network

You can use SimpleX with your own servers and still communicate with people using the servers that are pre-configured in the apps or any other SimpleX servers. Read more.

Frequently asked questions

  1. How SimpleX can deliver messages without any user identifiers? See v2 release announcement explaining how SimpleX works.

  2. Why should I not just use Signal? Signal is a centralized platform that uses phone numbers to identify its users and their contacts. It means that while the content of your messages on Signal is protected with robust end-to-end encryption, there is a large amount of meta-data visible to Signal - who you talk with and when.

  3. How is it different from Matrix, Session, Ricochet, Cwtch, etc., that also don't require user identities? Although these platforms do not require a real identity, they do rely on anonymous user identities to deliver messages – it can be, for example, an identity key or a random number. Using a persistent user identity, even anonymous, creates a risk that user's connection graph becomes known to the observers and/or service providers, and it can lead to de-anonymizing some users. If the same user profile is used to connect to two different people via any messenger other than SimpleX, these two people can confirm if they are connected to the same person - they would use the same user identifier in the messages. With SimpleX there is no meta-data in common between your conversations with different contacts - the quality that no other messaging platform has.

News and updates

Recent and important updates:

Mar 23, 2024. SimpleX network: real privacy and stable profits, non-profits for protocols, v5.6 released with quantum resistant e2e encryption and simple profile migration.

Mar 14, 2024. SimpleX Chat v5.6 beta: adding quantum resistance to Signal double ratchet algorithm.

Jan 24, 2024. SimpleX Chat: free infrastructure from Linode, v5.5 released with private notes, group history and a simpler UX to connect.

Nov 25, 2023. SimpleX Chat v5.4 released: link mobile and desktop apps via quantum resistant protocol, and much better groups.

Sep 25, 2023. SimpleX Chat v5.3 released: desktop app, local file encryption, improved groups and directory service.

Jul 22, 2023. SimpleX Chat: v5.2 released with message delivery receipts.

May 23, 2023. SimpleX Chat: v5.1 released with message reactions and self-destruct passcode.

Apr 22, 2023. SimpleX Chat: vision and funding, v5.0 released with videos and files up to 1gb.

Mar 1, 2023. SimpleX File Transfer Protocol – send large files efficiently, privately and securely, soon to be integrated into SimpleX Chat apps..

Nov 8, 2022. Security audit by Trail of Bits, the new website and v4.2 released.

Sep 28, 2022. v4.0: encrypted local chat database and many other changes.

All updates

⚡ Quick installation of a terminal app

curl -o- https://raw.githubusercontent.com/simplex-chat/simplex-chat/stable/install.sh | bash

Once the chat client is installed, simply run simplex-chat from your terminal.

simplex-chat

Read more about installing and using the terminal app.

SimpleX Platform design

SimpleX is a client-server network with a unique network topology that uses redundant, disposable message relay nodes to asynchronously pass messages via unidirectional (simplex) message queues, providing recipient and sender anonymity.

Unlike P2P networks, all messages are passed through one or several server nodes, that do not even need to have persistence. In fact, the current SMP server implementation uses in-memory message storage, persisting only the queue records. SimpleX provides better metadata protection than P2P designs, as no global participant identifiers are used to deliver messages, and avoids the problems of P2P networks.

Unlike federated networks, the server nodes do not have records of the users, do not communicate with each other and do not store messages after they are delivered to the recipients. There is no way to discover the full list of servers participating in SimpleX network. This design avoids the problem of metadata visibility that all federated networks have and better protects from the network-wide attacks.

Only the client devices have information about users, their contacts and groups.

See SimpleX whitepaper for more information on platform objectives and technical design.

See SimpleX Chat Protocol for the format of messages sent between chat clients over SimpleX Messaging Protocol.

Privacy and security: technical details and limitations

SimpleX Chat is a work in progress – we are releasing improvements as they are ready. You have to decide if the current state is good enough for your usage scenario.

We compiled a glossary of terms used to describe communication systems to help understand some terms below and to help compare advantages and disadvantages of various communication systems.

What is already implemented:

  1. Instead of user profile identifiers used by all other platforms, even the most private ones, SimpleX uses pairwise per-queue identifiers (2 addresses for each unidirectional message queue, with an optional 3rd address for push notifications on iOS, 2 queues in each connection between the users). It makes observing the network graph on the application level more difficult, as for n users there can be up to n * (n-1) message queues.
  2. End-to-end encryption in each message queue using NaCl cryptobox. This is added to allow redundancy in the future (passing each message via several servers), to avoid having the same ciphertext in different queues (that would only be visible to the attacker if TLS is compromised). The encryption keys used for this encryption are not rotated, instead we are planning to rotate the queues. Curve25519 keys are used for key negotiation.
  3. Double ratchet end-to-end encryption in each conversation between two users (or group members). This is the same algorithm that is used in Signal and many other messaging apps; it provides OTR messaging with forward secrecy (each message is encrypted by its own ephemeral key) and break-in recovery (the keys are frequently re-negotiated as part of the message exchange). Two pairs of Curve448 keys are used for the initial key agreement, initiating party passes these keys via the connection link, accepting side - in the header of the confirmation message.
  4. Additional layer of encryption using NaCL cryptobox for the messages delivered from the server to the recipient. This layer avoids having any ciphertext in common between sent and received traffic of the server inside TLS (and there are no identifiers in common as well).
  5. Several levels of content padding to frustrate message size attacks.
  6. All message metadata, including the time when the message was received by the server (rounded to a second) is sent to the recipients inside an encrypted envelope, so even if TLS is compromised it cannot be observed.
  7. Only TLS 1.2/1.3 are allowed for client-server connections, limited to cryptographic algorithms: CHACHA20POLY1305_SHA256, Ed25519/Ed448, Curve25519/Curve448.
  8. To protect against replay attacks SimpleX servers require tlsunique channel binding as session ID in each client command signed with per-queue ephemeral key.
  9. To protect your IP address all SimpleX Chat clients support accessing messaging servers via Tor - see v3.1 release announcement for more details.
  10. Local database encryption with passphrase - your contacts, groups and all sent and received messages are stored encrypted. If you used SimpleX Chat before v4.0 you need to enable the encryption via the app settings.
  11. Transport isolation - different TCP connections and Tor circuits are used for traffic of different user profiles, optionally - for different contacts and group member connections.
  12. Manual messaging queue rotations to move conversation to another SMP relay.
  13. Sending end-to-end encrypted files using XFTP protocol.
  14. Local files encryption.

We plan to add:

  1. Senders' SMP relays and recipients' XFTP relays to reduce traffic and conceal IP addresses from the relays chosen, and potentially controlled, by another party.
  2. Post-quantum resistant key exchange in double ratchet protocol.
  3. Automatic message queue rotation and redundancy. Currently the queues created between two users are used until the queue is manually changed by the user or contact is deleted. We are planning to add automatic queue rotation to make these identifiers temporary and rotate based on some schedule TBC (e.g., every X messages, or every X hours/days).
  4. Message "mixing" - adding latency to message delivery, to protect against traffic correlation by message time.
  5. Reproducible builds – this is the limitation of the development stack, but we will be investing into solving this problem. Users can still build all applications and services from the source code.

For developers

You can:

If you are considering developing with SimpleX platform please get in touch for any advice and support.

Please also join #simplex-devs group to ask any questions and share your success stories.

Roadmap

  • ✅ Easy to deploy SimpleX server with in-memory message storage, without any dependencies.
  • ✅ Terminal (console) client with groups and files support.
  • ✅ One-click SimpleX server deployment on Linode.
  • ✅ End-to-end encryption using double-ratchet protocol with additional encryption layer.
  • ✅ Mobile apps v1 for Android and iOS.
  • ✅ Private instant notifications for Android using background service.
  • ✅ Haskell chat bot templates.
  • ✅ v2.0 - supporting images and files in mobile apps.
  • ✅ Manual chat history deletion.
  • ✅ End-to-end encrypted WebRTC audio and video calls via the mobile apps.
  • ✅ Privacy preserving instant notifications for iOS using Apple Push Notification service.
  • ✅ Chat database export and import.
  • ✅ Chat groups in mobile apps.
  • ✅ Connecting to messaging servers via Tor.
  • ✅ Dual server addresses to access messaging servers as v3 hidden services.
  • ✅ Chat server and TypeScript client SDK to develop chat interfaces, integrations and chat bots (ready for announcement).
  • ✅ Incognito mode to share a new random name with each contact.
  • ✅ Chat database encryption.
  • ✅ Automatic chat history deletion.
  • ✅ Links to join groups and improve groups stability.
  • ✅ Voice messages (with recipient opt-out per contact).
  • ✅ Basic authentication for SMP servers (to authorize creating new queues).
  • ✅ View deleted messages, full message deletion by sender (with recipient opt-in per contact).
  • ✅ Block screenshots and view in recent apps.
  • ✅ Advanced server configuration.
  • ✅ Disappearing messages (with recipient opt-in per-contact).
  • ✅ "Live" messages.
  • ✅ Contact verification via a separate out-of-band channel.
  • ✅ Multiple user profiles in the same chat database.
  • ✅ Optionally avoid re-using the same TCP session for multiple connections.
  • ✅ Preserve message drafts.
  • ✅ File server to optimize for efficient and private sending of large files.
  • ✅ Improved audio & video calls.
  • ✅ Support older Android OS and 32-bit CPUs.
  • ✅ Hidden chat profiles.
  • ✅ Sending and receiving large files via XFTP protocol.
  • ✅ Video messages.
  • ✅ App access passcode.
  • ✅ Improved Android app UI design.
  • ✅ Optional alternative access password.
  • ✅ Message reactions
  • ✅ Message editing history
  • ✅ Reduced battery and traffic usage in large groups.
  • ✅ Message delivery confirmation (with sender opt-out per contact).
  • ✅ Desktop client.
  • ✅ Encryption of local files stored in the app.
  • ✅ Using mobile profiles from the desktop app.
  • ✅ Private notes.
  • ✅ Improve sending videos (including encryption of locally stored videos).
  • ✅ Post-quantum resistant key exchange in double ratchet protocol.
  • 🏗 Improve stability and reduce battery usage.
  • 🏗 Improve experience for the new users.
  • 🏗 Large groups, communities and public channels.
  • 🏗 Message delivery relay for senders (to conceal IP address from the recipients' servers and to reduce the traffic).
  • Privacy & security slider - a simple way to set all settings at once.
  • SMP queue redundancy and rotation (manual is supported).
  • Include optional message into connection request sent via contact address.
  • Improved navigation and search in the conversation (expand and scroll to quoted message, scroll to search results, etc.).
  • Feeds/broadcasts.
  • Ephemeral/disappearing/OTR conversations with the existing contacts.
  • Privately share your location.
  • Web widgets for custom interactivity in the chats.
  • Programmable chat automations / rules (automatic replies/forward/deletion/sending, reminders, etc.).
  • Privacy-preserving identity server for optional DNS-based contact/group addresses to simplify connection and discovery, but not used to deliver messages:
    • keep all your contacts and groups even if you lose the domain.
    • the server doesn't have information about your contacts and groups.
  • High capacity multi-node SMP relays.

Disclaimers

SimpleX protocols and security model was reviewed, and had many breaking changes and improvements in v1.0.0.

The security audit was performed in October 2022 by Trail of Bits, and most fixes were released in v4.2.0 – see the announcement.

SimpleX Chat is still a relatively early stage platform (the mobile apps were released in March 2022), so you may discover some bugs and missing features. We would really appreciate if you let us know anything that needs to be fixed or improved.

The default servers configured in the app are provided on the best effort basis. We are currently not guaranteeing any SLAs, although historically our servers had over 99.9% uptime each.

We have never provided or have been requested access to our servers or any information from our servers by any third parties. If we are ever requested to provide such access or information, we will be following due legal process.

We do not log IP addresses of the users and we do not perform any traffic correlation on our servers. If transport level security is critical you must use Tor or some other similar network to access messaging servers. We will be improving the client applications to reduce the opportunities for traffic correlation.

Please read more in Terms & privacy policy.

Security contact

To report a security vulnerability, please send us email to [email protected]. We will coordinate the fix and disclosure. Please do NOT report security vulnerabilities via GitHub issues.

Please treat any findings of possible traffic correlation attacks allowing to correlate two different conversations to the same user, other than covered in the threat model, as security vulnerabilities, and follow this disclosure process.

License

AGPL v3

iOS app   Android app   F-Droid   iOS TestFlight   APK

simplex-chat's People

Contributors

a1lu avatar andorsk avatar angerman avatar arturro43 avatar avently avatar byrd19 avatar dpwiz avatar epoberezkin avatar float-hu avatar gajus avatar grm34 avatar ianrdavies avatar ishi-sama avatar jessehorne avatar kimg45 avatar markaleksanderh avatar michaelbitard avatar miltronius avatar mlanp avatar msarmadqadeer avatar mxsjoberg avatar narasimha-sc avatar qvsojbjgienr avatar sethforprivacy avatar shumvgolove avatar solus-hq avatar space-d-n avatar spaced4ndy avatar vsevolod-mineev avatar zen0bit avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

simplex-chat's Issues

Improve simplex connection privacy and integrity

Several protocol improvements are possible to provide higher level of communication privacy and integrity (delivery guarantee of unmodified message):

  • fixed message size of 8kb (smaller messages are padded with random content, bigger messages are delivered as large messages - see implementation spec, higher level duplex protocol may split larger messages into multiple). 8kb is the standard chunk used in UNIX / http. It makes impossible traffic correlation by message size.
  • minimal required padding size - it may be redundant if required padding is built into encryption protocol - TBC. The goal is to avoid repeated messages.
  • additional server side encryption before saving to DB using additional key provided by recipient at the time connection is created. It makes impossible traffic correlation by message content. It is not necessary because of transport encryption
  • some RK/SK keys validation to reduce probability of MITM attack between participants and the server - maybe redundant, maybe on duplex connection level - TBC
  • additional unencrypted message timestamp SK-signed by the sender with the server rejecting the message if the difference with the server clock is over 1-2 min (TBC). Both server and client time stamps will be forwarded to the recipient (in addition to client side timestamp inside the message).
  • the signed hash of the previous message is included into the message body, so the recipient can validate that no message is lost or modified (separate blockchain in each simplex connection). It makes impossible deleting or replacing messages from the server without recipient noticing it - should be part of duplex communication protocol.

SimpleX chat - v0.4.1 release

  • chat protocol #66
  • user profiles #69, #93
  • chat groups #75, #76, #77, #78, #84, #85, #87
  • merge contact profiles when existing contact is invited to group by another member #86
  • asynchronous message delivery (messages can be sent when the client is offline) #92
  • #94
  • #97
  • #91
  • message delivery to pending group members
  • #98
  • docs
    • #99
    • chat protocol
  • group improvements:
    • show notification when member is connected to all members
    • message integrity based on Merkle DAG

Android 9 support

I wanted to try the app and realized that it is not available for my device (Motorola g7).
It is a very cheap and popular gadget.

Explain differences/advantages over p2p

  1. much simpler design than DHT
  2. higher delivery guarantee, as the recipient controls the server choice
  3. no global identity of any form, even temporary
  4. solves MITM attack problem, unlike p2p
  5. uses standard web protocols - much less likely to be blocked
  6. Can run on the same servers as public websites
  7. No server discoverability
  8. Impossible to attack/flood the whole system using Sybil attack - the system is fragmented, servers are not connected and not known, clients only communicate with known servers.

Wrong binary in v1.0.3 release?

When I re-installed for version 1.0.3 using the install script I noticed that the version printed on login is 1.0.0

I then copied the binary from the release and sure enough the version printed is still 1.0.0 so either the binary is wrong or the version coded into the binary is wrong.

Tweak invite button text on iOS

Current link when the invite web page shows on iOS browser is Open in mobile app. some users find this confusing.

Suggest new text Join Chat in Simplex or Accept Invitation in Simplex

Suggest new text above to replace Scan QR code.....the app. with To accept the invitation on this device, click on the Accept Invitation button below (please be sure you've installed and opened Simplex at least once). Otherwise, you can scan the barcode from the Simplex app.

The most likely path is invite from one iphone to another, so the QR code should be secondary.

push message to multiple sessions

I opened two simplex-chat in two terminal windows. Both can send message, but only 1 (later opened) can receive message. How can I have both sessions updated with received messages? Otherwise I will need to remember the last opened window to see the conversation.
Thanks

Simplify simplex messaging

Other questions to simplify

  • Maybe the keys should not be replaceable as well and the only needed endpoint is to secure connection which is only possible once? In this case duplex protocol would do full connection rotation (rather than key rotation).
  • Is ID really needed?
  • Remove "disable" option

simplex name is not catchy

Hi,

I am very glad that Haskell ecosystem can provide such cool tool for broad audience, but I am concerned with name.

  • word simple has negative associations
  • simplex makes me think about X window manager
  • simplex-chat is 2 words
  • simplex is not related to info propagation (compare with whatsapp, messenger, telegram)
  • Google Play has other apps with same name

Decide on encryption keys in the connection (same for all queues or one per queue)

Factor One key for all queues A key per queue
Connection request size (+) smaller (-) bigger
Management complexity (+) easier (-) harder - need to manage pairs of DH exchanged keys per pair of queues inside the connection
Correlation of messages (-) yes - same encrypted message can be correlated across queues and servers (+) no - encrypted messages will have different representation per queue

Use separate keys to encrypt and to sign messages

  • Not okay to use the same EK to both encrypt and sign
  • it's actually not possible to verify messages in edge-messaging protocol if only one connection available, unless sender provides verification key (so in addition to SK to sign requests, sender needs to provide VK to verify messages).
  • it requires the same number of simplex connections for both parties in duplex (limited to the smallest number of servers available to each party); without this constraint two parties can use different number of simplex connections (redundancy level) defined by the number of servers available to them.

Explain why asymmetric key (public) is passed off-band (and why not pass symmetric keys)

Draft:

It's more secure against an eavesdropping attacker. The keys that the receiver generates for the sender can be intercepted off-band via any channel except camera - email, video call, mutual trusted friend. Even if public key is intercepted off-band it only allows a passive attacker to encrypt a message, but not to decrypt it.

If an active attacker intercepts a public key and tries to act as a sender, the real sender won't be able to create a simplex channel (i.e. will be denied by the server) and he will then communicate this to the receiver off-band.

Correctly show contact state while connection is in progress

I'm using Android v0.4.2

I've shared my link with exactly 1 person who I've confirmed didn't re-share my connection link. But I have two contacts in "Your chats". One is my friend and the other is someone jb. I've tried chatting at jb and the messages disappear from the screen.

I did click "Get help & advice via chat" and was shown a "Connect via contact link?" dialog with a "Connect" button. I did not click the "Connect" button and instead clicked on the background to dismiss the dialog.

I think it's likely that jb was added when I clicked "Get help" but the contact is not fully established and in a broken state because I rejected "Connect via contact" thing.

Rename edge-messaging protocol

as discussed naming implies a graph on a higher level of abstraction which is not explicitly defined in the lower level protocol and not necessarily needed for some other possible domain reusing it.
possible name: simplex-messaging protocol

Please clarify the 'problems' listed in readme

Problems

Existing chat platforms and protocols have some or all of the following problems:

  • privacy of the conversation, partially caused by E2EE implementations.
  • privacy of the user profile and connections.

Why is privacy a problem?

Create files in XDG directories by default

I just found out about simplex-chat and I love it already. What sold me on it is the CLI. I know in advance it will be hard to convince people to leave their preferred chat platform, as usual, but it will definitely be worth trying.

One thing I dislike, however, is that simplex-chat creates a ~/.simplex/ folder for its sqlite files. I think it would be better and tidier to stick to XDG standards and store those files in ~/.local/simplex by default, and only use ~/.simplex/ if XDG directories do not exist.

For reference, here is a similar reflexion for newsboat: https://github.com/newsboat/newsboat/issues/1711 (I am backticking to avoid adding a reference in their issue).

in Transport.hs: T.getPeerFinished not found

I made a cabal build, and got the same as in the hackage CI:

``[tags/v1.0.0] % cabal build
Build profile: -w ghc-8.10.6 -O1
In order, the following will be built (use -v for more details):

  • simplexmq-1.0.0 (lib) (first run)
  • simplex-chat-1.0.0 (lib) (first run)
  • simplex-chat-1.0.0 (exe:simplex-chat) (first run)
    Preprocessing library for simplexmq-1.0.0..
    Building library for simplexmq-1.0.0..
    [11 of 28] Compiling Simplex.Messaging.Transport ( src/Simplex/Messaging/Transport.hs, /home/me/programming/haskell/simplex-chat/dist-newstyle/build/x86_64-linux/ghc-8.10.6/simplexmq-1.0.0/build/Simplex/Messaging/Transport.o, /home/me/programming/haskell/simplex-chat/dist-newstyle/build/x86_64-linux/ghc-8.10.6/simplexmq-1.0.0/build/Simplex/Messaging/Transport.dyn_o )

src/Simplex/Messaging/Transport.hs:284:27: error:
Not in scope: ‘T.getPeerFinished’
Module ‘Network.TLS’ does not export ‘getPeerFinished’.
|
284 | cxtFinished TServer = T.getPeerFinished
| ^^^^^^^^^^^^^^^^^

src/Simplex/Messaging/Transport.hs:285:27: error:
Not in scope: ‘T.getFinished’
Module ‘Network.TLS’ does not export ‘getFinished’.
|
285 | cxtFinished TClient = T.getFinished
| ^^^^^^^^^^^^^
cabal: Failed to build simplexmq-1.0.0 (which is required by exe:simplex-chat
from simplex-chat-1.0.0).

1 ~/programming/haskell/simplex-chat (git)-[tags/v1.0.0] % ghc --version
The Glorious Glasgow Haskell Compilation System, version 8.10.6
me@here ~/programming/haskell/simplex-chat (git)-[tags/v1.0.0] % cabal --version
cabal-install version 3.4.0.0
compiled using version 3.4.0.0 of the Cabal library ```

No obvious way to "Share Link" on android

Android app v0.4.2
It says that I can share either a QR code or a link, but there's nothing obvious to click on for the link. I did find if I tap a bunch of times between the QR code and the home button on my phone, it eventually pops open the Android share dialog and I can copy the link to my clipboard.

I think there's probably a button that's rendered off screen. I'm using a Galaxy S10e and haven't enabled any accessibility options (like increased font size)

Comment on pros and cons of WebSocket API

+ no need for polling, hence messages can be pushed from server to receiver
- possible to correlate connections that are in the same session
- use via Tor (?)

maybe also that "send" via WS for active conversations would be premature optimization, that's why there's only "receive" API

Describe how to check for MITM between the server and the receiver

Receiver can check for MITM between him and his server by asking the real sender to test a request signed by the receiver on the receiver's server via sender's URI (that is via a specific endpoint). This signed request can be passed to the sender:

  • either via initial QR
  • or via a duplicate simplex (this can be done on a regular basis as a preventive measure)

Or we can do both.

As a sidenote,
There can be no MITM between the sender and the receiver's server because sender's key (SK) is saved on the server by the receiver via signed request.

ARM compatibility

Unfortunately the install script does not support ARM and manually building with stack on ARM fails too:

$ stack install -j2                                                                                            
/home/user/Projects/simplex-chat/simplex-chat.cabal was generated with a newer version of hpack,
please upgrade and try again.
Not cryptographic hash found for Hackage package cryptostore-0.2.1.0, updating
Selected mirror https://s3.amazonaws.com/hackage.fpcomplete.com/
Downloading root
Waiting to acquire cache lock on /home/user/.stack/pantry/hackage/hackage-security-lock
Acquired cache lock on /home/user/.stack/pantry/hackage/hackage-security-lock
Released cache lock on /home/user/.stack/pantry/hackage/hackage-security-lock
Selected mirror https://s3.amazonaws.com/hackage.fpcomplete.com/
Downloading timestamp
Downloading snapshot
Downloading mirrors
Cannot update index (no local copy)
Downloading index
Waiting to acquire cache lock on /home/user/.stack/pantry/hackage/hackage-security-lock
Acquired cache lock on /home/user/.stack/pantry/hackage/hackage-security-lock
Released cache lock on /home/user/.stack/pantry/hackage/hackage-security-lock
Updated package index downloaded
Calculating hashes to check for hackage-security rebases or filesystem changes
No old cache found, populating cache from scratch
Populating cache from file size 785956352, hash 3cc150b78048459609062d508546617f41e248c8eb41f5b72f53be5198286aab
Populating package index cache ...
Package index cache populated
Unable to find installation URLs for OS key: linux-aarch64-tinfo6

With how widespread ARM CPUs now have become, I think it would be a huge milestone if simplex-chat could run on this architecture.

Desktop app (GUI)

Hi,

Thank you for this project. It's great to have a new secure messenger.

My suggestion is to make a GUI desktop app for Linux.

Thank you for your consideration.

bug with sending file

Hi
v0.4.0
simplex-chat-ubuntu-20_04-x86-64
on Manjaro

./simplex -d alice
./simplex -d tom
mkdir alice
nano ./alice/file (wrote some text)

# /f @tom ./alice/file
use /fc 11 to cancel sending


# ./simplex -d tom
14:29 alice> sends file file (10 bytes / 10 bytes)
use /fr 11 [<dir>/ | <path>] to receive it
# /fr 11 ./tom
saving file 11 from alice to ./tom/file
started receiving file 11 (file) from alice
error receiving file: incorrect chunk size

received file with 0 byte

SimpleX chat protocol and mobile app MVP

  • agent protocol extensions/improvement
    • message receipts (ACK/RCVD)
    • confirmation/approval steps (CONF/LET)
    • "small" client-based groups
    • agents cluster (device sync)
  • chat protocol:
    • profiles
    • message formats
    • how agent protocol is used for various chat scenarios
    • chat groups: protocol to identify and confirm user connections in groups
  • SMP server
    • Websockets support
    • server deployment: linode and digital ocean
  • SMP agent: manage JOIN when the initiating agent is not online
  • terminal UI
    • upgrade for chat protocol
    • system notifications
  • mobile app:
    • websockets vs TCP decision
    • app system design (cordova + react)
    • setup cordova + react app
    • UX - decide on the flow of profiles and adding contacts
    • fully private mode (no sharable user profile, as now in the terminal)
    • chat protocol
    • IndexDB store: current methods for the agent
    • IndexDB store: additional methods for chat UI
    • picture and file transmission: WebRTC or SMP streams?
  • simplexmq-js:
    • SMP protocol (types, parsing/serialization)
    • SMP agent protocol (types etc)
    • SMP client
    • SMP agent
    • Abstract transport, WebSockets (?) implementation
    • Abstract cryptography class, WebCrypt implementation
    • Client handshake

Markdown composition

How I can compose the markdown notations? for example, I like bold underline text in red? !1 +*bebop*+! is not working.

Thanks!!

Note on "disabling" connection before deleting

To avoid losing messages.

It can be done in one of two ways:

  • by changing the sender key, so that new messages from sender will be rejected - currently it is not allowed (line 178), but can be changed.
  • by introducing connection "active/disabled" flag and API to change it.

Secrets get shown in plaintext!!

Here is the bug:
(Android 12 | Pixel 5)
I sent myself a secret message from my PC via CLI and the secret displays in the notification on the lock screen in plain text.

General suggestions and questions

First of all: thanks for the great project! It's really cool to see a true successor for IRC. Although it's in early stages, but current chat prototype works flawlessly, looking forward for mobile app.

While using the simplex-chat, I collected a few thoughts/suggestions:

  • It would be great if TAB could autocomplete commands; subcommands; contacts; file and directory names when using /f; etc. and arrow keys to scroll past commands like in your favorite interactive shell.
  • While we here: when user "drag'n'drops" file from file manager to terminal, file path contains trailing whitespace, so executing /f <file_path> would fail. I guess it would make sense if simplex-chat just ignored this.
  • Currently, simplex-chat prints everything (DMs, group messages, command output) in one window. Change TUI layout to something modular: split up chat to multiple tabs for each opened contact/group and create separate main tab for general info/command output. Something like irssi + tiny irc clients do:

bitmap

So, above user input (which also shows current user in use) there's multiple opened tabs with different colors: #fbf1c7ff #fbf1c7ff means current tab, #fb4934ff #fb4934ff – you've been mentioned, #b16286ff #b16286ff – there's new messages and #504945ff #504945ff – no messages. It's just a concept and if you have something on your mind already – feel free to ignore this ;^)

  • Changing TUI layout as suggested in previous section would require making some kind of bindings/shortcuts (like left/right arrow keys to change tabs). So, implementing configuration file with user settings, so user can change bindings and other stuff (like default simplex server) would be also great.
  • Show past history and messages with date and time. It would be also ideal if chat history could be scrolled with Ctrl+UP/Ctrl+DOWN or similar.
  • Implement new command /contact which would list all available users/groups to message.
  • Currently, Linux releases contain dynamically linked executable, compiled in glibc environment, which makes it impossible to execute binary on systems with musl libc (like Alpine Linux). I was able to successfully compile fully statically-linked simplex-chat binary with Alpine Linux, so I think that shouldn't be too hard. Distributing such static binary will provide universal Linux coverage for both glibc and musl distributions.

And I've got a bunch of questions from user perspective:

  1. Is it possible to find out which available public groups simplex-chat/simplexmq#143 (in the future) can I connect to?
  2. What is the difference between the current E2EE algorithm and the well-known protocols like Signal Protocol, OMEMO and Matrix Olm/Megaolm?
  3. What happens in the following scenario: I've created my db with user named Alice and chose SMP server smp.example.com. Then, I've executed /c and server generated ID (as described in simplex queue if I was able to understand this correctly) for my connection. I've sent this invitation to Bob and we successfully established connection. But then, after closing my client, I chose another SMP server smp.example2.com. Do i need to generate another ID for smp.example2.com or SMP servers somehow exchange information between each other?

Well, that's all I've got.

WindowsCli

Can't mark the invitation link in the client it to send to another user.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.