#OrganicMaps is here. Use it while offline and feel good about a #privacy-respecting app that doesn't suck you dry of your personal information. Based on #OpenStreetMap this app is gonna blow #Google#Maps out of the water (hopefully ;)
@HistoPol@smallcircles the main problem with this approach is that WhatsApp is so baked within the population that it's hard to disentangle someone from those in a viable way.
These applications are executed by electronic components. Do electronic components from Intel, ARM and Nvidia provide complete telemetry of our activities?
Yes, these corporations are legally obliged to spy on us.
yeah, it's just about limiting data really - not true privacy. If you have a mobile data installed chip it's basically always pinging towers. A wifi only tablet with gps (again assuming it's not using towers for this) and pre-loaded data is about the only way to be 'untracked' while using a device out n about.
I'm definitely not an expert. But if you have a device that 'can' connect to the mobile network...and you don't have a physical off switch, can you really trust that it's off? depends on the jib of your tinfoil hat :) Next level, even with a physical switch, do you trust that switch? etc. it's a rabbit hole of 87 layers of tech between you and actual privacy.
The only 'sure' method is to not bring along any device with such capability...or any device to be truly sure.
@HistoPol@smallcircles I've heard, that Wire is supposed to be a better alternative, than Signal. Unfortunately, it seems not well known enough, to pop up in most comparisons...
I haven't heard of #wire.
Also, in Switzerland, there is a second app that seems to be good and en vogue there (if I remember the name, I'll try to repost it here).
Two key issues:
acceptance/network effect. If you cannot get your network to move, too. No use.
Counterparty risk: if it is a private corp, it will be snatched up...
... by #BigTech some time, if it's successful.
Also, if not everything is #FOSS, it cannot be further developed, if the devs cannot continue with the project for whatever reasons.
Then, there is #Viber, which is being used by many Eastern Europeans. No clue as 2 the security.
We don't need to talk about the global market leader #WeChat from #TenCent, I guess (pervasive spyware).
I'd be willing to copy and redraw the chart if privacy pros can provide the data r more apps.
@HistoPol@smallcircles
With Telegram you don't have to share your phone number or contacts. And you have no user name/ID unless you choose to create one. As that is useful to share 'instead' of your phone number.
@HistoPol@smallcircles
Right. What the privacy minded people do is enter a scrap number, just to get the code. Some install the app called Text Free and receive the code there. Once in, they create an optional user name to share just with those they want to.
Also, go to settings and switch off "Share Contacts" if you don't want that.
Now I remember. On that day, I wasted about 2 hours trying to find a page which would provide a scrap phone number. All where either already know and blocked or did not work out. So I stopped trying.
@distopico@HistoPol@smallcircles
Yeah, Threema's business model is to provide the network (and the server code) as a paid service. So given that, It is not clear under what kind of open source license they could publish the server code. Once their network was big enough, supposedly they could say, yeah.. here's the code, go ahead and try to compete with us. But some of their bigger business clients might choose to run their own server.
@distopico@HistoPol@smallcircles
At this point I'm not taking the open source == good (just coz) argument at face value anymore. The future of Matrix always seems somehow, em.. unconfirmed? An interesting project. I wonder where it will go. There's been a LOT of VC funding up to now, one might assume some return is expected at some point. Maybe not though. I've run jabber servers in the past, I still have one, but federated XMPP just somehow can't seem to take hold outside of its own niche.
@kino@HistoPol@smallcircles well close source/private != Privacy, you cannot own your data in your own server, you can't audity the code so you don't know what they do with your data
@distopico@HistoPol@smallcircles In general I find that false dichotomies don't help here. "Audited" code is overrated. (History has already absolved me) It may even lure into the false sense of security trap.
But yes, 95% or so of the time, if it is a question of data integrity/security, and you have the time and skill to do analysis, you're probably better of with FOSS. You might also choose to trust other people, which is what a code audit is, no?
@kino@HistoPol@smallcircles so instead trust many tech people that audity the code we should trust what one company behind those server said?, With XMPP you can choose several server some of those behind social activist such as disroot or use your own server
@distopico@HistoPol@smallcircles
Rather than trying to lock down options, everybody has to find what "works" for them. There are no absolute correct choices here. For some, a good option may be no tech IM style comms at all. For others, maybe getting a genuine personal recommendation of trustworthyness from someone you trust might be worth more than "some hacker bros said it was all good." Not saying this is or is not the case with Threema. :-)
Thank you for your well-thought comment based on your wast experience.
I tend to disagree with your overall conclusion, though:
"There are no absolute correct choices here." Maybe. But we presently have "one size fits all", at least in the West, and that is #WhatsApp.
In the face of the rise of fascism and the surveillance state a maximum number of people must move to...
...alternative messengers. The cannot indict everyone. This will protect the minorities (persecuted by the NS,) that direly need this protection.
I can see that many people might yet opt for even more security. But in this case, maybe even 3rd best would be way better than sticking with data kraken #Meta.
For instance, #Mastodon is definitely not the best solution for everyone. But yet, it has...
I think the challange is finding the smallest common denominator and then promoting that (except for specialits lice infosec, who can easily manage 2 or more messengers.)
This is not about convenience anymore. This is information warfare preparation. Looking at what happened in the countries of the former Arab Spring or Iran and in particular to Russia and...
...foremost China gives a pretty clear picture how this might turn really ugly.
The foremost global market square of ideas, #Twitter, is already lost. It had played a vital role in the Arab Spring.
For instance, #Telegram might be #freemium software, distributed and all, but its operational servers are in the #UAE, an autocratic state, where you'd better not...
@HistoPol@kino@smallcircles is not limited, is just the basic requirement, you don't have privacy if you don't have transparency and you can't have transparency with close/privative software
So for a WhatsApp replacement the base requirements should be
Free software client/server
Federated/decentralized
Allow self hosting, so if you don't like X location of the server you can use you own server in the location of your preference
Support e2e encryption, ideally by default and required
@HistoPol@kino@smallcircles that is one of my points, why if we have XMPP and Matrix we want to promote more options? That makes pretty hard to the end user choice one of those, XMPP, Matrix, SimpleXChat, Jam,DeltaXChat and Signal,Threema these last two with close/restrictive parts, I prefer promote the others that respect the user freedom and privacy and have similar features privacy/e2e encryption video/calls + federation/decentralized, transparency etc
Sweet! :-) For those who do not know, XMPP is a protocol (similar to the ActivityPub protocol being used by various fediverse services) that has many client applications. I can't think of any proprietary clients, though one or more may exist somewhere. XMPP actually spawned from Jabber (the protocol Google Talk originally used), and it is generally used for instant messaging style communications. It has the ability to include media, and can be end-to-end encrypted with [most commonly] OTR, OMEMO, or PGP.
Jitsy on the other hand is a little more complicated, and in fact includes some XMPP interoperability. It has video conferencing services similar to what you might find in Teams or Zoom. It is open source, and can support end-to-end encryption when using a Chromium based browser.
Both XMPP and Jitsy servers may or may not log IP addresses in the same way a web server like Apache or NGINX does. Though I imagine if that were added to the list for them, it would need to be added to the list for all of the others as well. Unique identifiers such as email address and phone number are simply not required for using either, and I am not aware of any XMPP or Jitsy services that have any advertising.
Thanks for making the chart and if you have any other questions, do please let me know. :-)
@HistoPol@smallcircles You can't use original Signal on the degoogled devices due to the "hardcoded" google-services dependencies in the app code.
Okay, there are some modded Signal versions with google crap removed, but still that's a "third-party" work - you can't be sure of what exactly is in the code inside. There's no warranty that someone doesn't compromised the app code. We have a few good example of troianised apps in the Samsung and Huawei store with over a million counted downloads.
Thanks for pointing this out.
An alternative app must run on Android and Apple to be acceptable, non-exclusive for the general public.
For me, not fond if the #RottenApple and its data practices and lock-in policies, #Signal will not be a solution in its current version, then.
I think I read that #Threema doesn't suffer from this issue?
@HistoPol@smallcircles To be honest I have no idea if Threema will work? I don't use android anyone since few years. Btw.. This app is open source or not?
I think better solution in such case can be Session, SimpleX, or something similar to them both. They can be normally used on for example SailfishOS with android api enabled. They also have a cli and desktop versions as well for many operating systems.
@HistoPol for communications apps that's easier said than done. If I use only good open source products to communicate, I can't communicate with pretty much anyone I know offline
@raphaelmorgan
(1/2)
No, I know. That is why I don't say this lightly.
The only really safe form of communication is to meet in person at a remote space (no wires;),) as an infosec contact pointed out some months ago.
It is always a trade off.
However, with the FBI getting relatively easy access (see my TL) to any US based server and with the increasing overreach of local law enforcement, the server location is as important as the organization behind it.
This pretty much eliminates most...
...US based services. Of course, China and Russia are even worse (see my TL.)
That said, I'd like to reach a consensus, which of the apps, and there is an interesting French librarian post here that has more alternatives, is the best option for most that are willing to invest the 5 bucks (if necessary)and a bit of time, but are no techies and want to include their non-tech savvy family and friends.
I guess hardly anybody will have a smartphone that is not connected to..
...a playstore. Yes, paying with a credit card or mobile payment like PayPal or ApplePay is a traceable action. Having the app might be an issue in some countries and might become one, if the French justice ministry gets its way (all e2ee is suspicious--see TL,) but what kind of world will we be living in, if owning an e2ee messenger app becomes illegal?
And then, the way I understand it, #Threema never gets your phone number. If you use TOR or VPN, I don't see much...
...potential for security breeches. Of course, if you have the tools of the intelligence services at hand, there is no really secure form for non-infosec people.
But this cannot be the yardstick.
Yes, the weak link might be the payment, but other than what I wrote, did I miss anything essential?
If not, this might be a solution for many people.
Most anything is better than WhatsApp in this regard. Meta cooperates best with US law enforcement and has the worst...
...type of leaks (#CambridgeAnalyticaSummit, ) probably apart from post-Dorsey #Twitter (#X,) soon to become the "everything app," like the state-surveillance tool #WeChat, if #Elmo continues to have his way and people are stupid enough to follow him down that rabbit hole (#TESCREAL.)
But this goes way beyond this convo.
@HistoPol@smallcircles
I’d like to use a messenger other than WhatsApp but it’s hard enough to persuade the people I interact with to open accounts with it - as for telegram and the others, forget it. Not a single person I have told about these is interested or can be bothered. They can be as private and secure as you like but if nobody is installing their apps what is the point.
LOL
I would not open a WhatsApp account, even if you tried to bribe me. 😉 --No-no-go.
Well, it depends a bit on the sway you have, e.g. if you manage the IT of a small business or a larger part of your damily/relatives. Those that don't like it have to use SMS or Mastodon or call me.
It is a hard start I agree.
The solution should
run on iOS/Android, PC/Mac if possible.
install easily or be gifted
have a look-and-feel like WhatsApp
Not use native services...
It is, as we all know, a network effect.
However, the more warrants and seizures or leak of Meta data (#CambridgeAnalyticaSummit) become public knowledge, the more I see the willingness to switch.
Also, many people in many countries are afraid of right-wing government takeovers. This, in combination with "#ChatControl discussions in the #EU, in particular #France, will provide possibilities.
@HistoPol@smallcircles
That might work in an organisation but I am in an organisation, I just exchange messages with friends and colleagues in a considerable number of countries. The universal response is “let’s just use email” - failing that then text if we really must - a few use What’sApp and the rest simply are not interested (“what’s wrong with email”). And what is wrong with email - it’s a good question.
@smallcircles Organic map goes very well with StreetComplete, an easy to use map editor. It asks simple questions about your neighbourhood, and your answer will help make the best map on earth. It's like contributing to Wikipedia.
@frozencat As Google has grown more entrenched and bureaucratic, its products are getting demonstrably worse. With Google being a powerhouse, there are entire industries built around gaming their systems, and those industries finally seem to be winning. The data in search and maps is growing less useful by the day.
And on top of that, Google isn't afraid to monetize every drop of data it can extract from you, and some people find that distasteful.
@smallcircles Yes, you CAN ditch Google Maps, but @organicmaps is not (yet) a full replacement. Mostly because of:
worse search
no public transport
slower routing for long trips
no online mode
4.1. no live traffic
It has advantages:
better map
privacy
better offline map management
But I have to use Google Maps from time to time, because of one of the disadvantages. However no Google Maps user ever has to switch to @organicmaps for any of its disadvantages.
Big fan anyway!
@sebsauvage@movodehe@smallcircles@organicmaps I once had it lead me to a McDonald's that had been torn down years before. I went home and fixed it. From my phone. Using open source software (Vespucci). I didn't check how long it took for Magic Earth to pull in the change from OSM, but it wasn't more than a week. That's pretty damn cool.
@smallcircles@jahed strong agree! If (non-geek) people can't get a result for a UK postcode search they'll just think the app doesn't work. And to be fair, it doesn't for them
@smallcircles@jahed I was maybe a little harsh - postcode search does work, but it's not very forgiving - you have to put a space in to get a full postcode to work, and it doesn't understand a search for the first part of a postcode
@smallcircles had a looksee. I like the low power usage, but will stick with Komoot for it's cycling navigation (the route navigation can be set to bike touring, mountain biking, road cycling, gravel riding or enduro)
@smallcircles I’ve been using maps.me for ages. On first glance this fork looks the same. Is the main difference the privacy thing or can I expect other benefits over maps.me?
@smallcircles@organicmaps
Neat. The map of my neighborhood is better than Google Maps, even after this week's GMaps update.
Three notes:
A persistent on screen icon just for the about menu item is disrespectful waste of screen space.
I'd like to export and import GPX on mobile, in order to both use routing in my Garmin, and to correct road marking. Current tools for that are not convenient enough for either to happen.
Alternative routes, when the first pick isn't satisfactory.
@osma@smallcircles 1. It’s critically important for new users, to collect their negative feedback, to share our philosophy and to get donations. 2. You can now import GPX tracks and export KML. 3. Alternate routes are planned. With your donations and support our small team of enthusiasts and contributors working in our free time can implement this and other features faster.
@organicmaps Totally agree with @osma@smallcircles and have been meaning to make the same points about the "About" icon. It's super prominent and entirely useless after tapping it once. If you're aiming to show it to new users, show it on first use and then offer an option to hide it forever? Or show your donation request once after every update? There are many better ways to achieve this goal.
@organicmaps@osma@smallcircles One feature that would improve the first user experience is to implement dynamic loading of online maps (asking the user if they are ok with it) when someone zooms in on an area for which the offline maps are missing.
@osma@organicmaps Nope, sometimes I want to look at a map of a city in a place far away I may never be going to. I just want to see the map once, downloading pre rendered tiles the way osmand does is enough. I do not need to download the whole region.
@smallcircles I’m admittedly less concerned about privacy, but for me knowing the current traffic situation is a big part of why I use Google maps so often. I just downloaded this app and it doesn’t seem to show this, my interpretation is it maybe can’t do this due to not tracking people? If I’m missing something, please LMK. Also, would be great to see alternate routes.
@smallcircles Wow, just installed, and on first impressions I love it!
I was put off at first by immediately searching my home address and nothing coming up, so it would be useful to tell people that they need to zoom into the region to download the relevant map first.
When I opened it for the first time (on an Android device) it presented me with two options: no GPS data, or use GPS via Google, with small print that says that it allows Google to harvest my location data and do what they like with it.
Is there a way to deal with this? It feels like the main purpose of a privacy-respecting app is lost if they can still mug me for that data via the GPS.
@passenger@smallcircles In the android app there's an option at the bottom of the settings screen that says:
"Tracking settings
Google Play Services
Use Google Play Services to determine your current location"
That setting is enabled by default. Maybe disabling it would keep Google from harvesting the location data(?)
I've got that turned off, thanks, but it means that I can't use the map app to find my location. Every time I press the button for that it just prompts me to reenable Google tracking.
@smallcircles@organicmaps How is it different from https://osmand.net/ I've been using osmand for offline maps for a while and I am quite happy so wondering what are the differences.
Google certainly does some amazing things with real-time traffic updates and public transportation information.
But I have been looking to get and contribute to better trail information, like where the drinking fountains, rest rooms, and bicycle repair stands are.
@smallcircles I'm really ready for dropping Google Maps. But unfortunately I use the "share trip" function a lot, and I haven't seen that in any of the alternatives 🤷♀️
@smallcircles
Non sei por qué usan a toponimia inventada en español (Ginzo, Carballino, Orense, La Coruña).
Eu utilizo #OsmAnd con mapas offline e a toponimia correcta.
Unha pena.
@aiquez@smallcircles#OrganicMaps is a #Cloudflare site, so avoid that for sure. I didn’t look into what that site tries to do, but you can certainly use #OSMand (a FOSS phone app) & download maps for offline use.
Add comment