There are several different options for end-to-end encrypted communication, each with different trade-offs. This article provides an overview and installation instructions for Tails, Qubes OS, and GrapheneOS.

Before proceeding, let’s go over a few concepts to help you distinguish between the different options.

• End-to-end encryption means (in theory) that only you and the person you are communicating with can read messages. However, not all encryption is created equal. The quality of the encryption is determined by the encryption protocol used and how it's implemented at the software level.
• Metadata protection means that the message metadata (the data about the data) is obscured. Even if the message itself is encrypted, metadata can reveal who is communicating with whom, when, how often, the sizes of any files that may have been transferred, and so on. Metadata exposure is a major concern.
• Peer-to-peer means that the messages do not pass through a centralized server.
• Tor is an anonymity network. Some applications route your messages through Tor by default.

For a more in-depth look at these various considerations, we recommend The Guide to Peer-to-Peer, Encryption, and Tor: New Communication Infrastructure for Anarchists. This text criticizes Signal for not being peer-to-peer and not using Tor by default, and goes on to compare Signal, Cwtch, and Briar.

Since anonymous public-facing projects such as counter-info websites interact with unknown (i.e. untrusted) contacts, they need more from encrypted communication than people using applications for private communication. These additional needs include:

• That anyone can contact the project
• Resiliency to correlation attacks
• Resiliency to exploits
• For multiple project members to be able to access the same messages

The following recommendations for encrypted messaging are listed in order of highest to lowest metadata protection.

TL;DR

• Cwtch for text communication
• SimpleX Chat or Signal for voice/video calls
• PGP Email for anonymously-run public projects

Cwtch

• Mediums: Text
• Metadata protection: Yes (strong)
• Encryption protocol: Tor Onion Services (v3) + Tapir
• Peer-to-peer: Yes
• Tor: Yes

Cwtch is our preference for text communication by a long shot. Cwtch is designed with metadata protection in mind; it's peer-to-peer, uses the Tor network, and stores all data locally on the device, encrypted.

Like all peer-to-peer communication, Cwtch requires synchronous communication, meaning that both people must be online at the same time. However, its server feature also allows asynchronous communication by providing offline delivery:

"Cwtch contact to contact chat is fully peer to peer, which means if one peer is offline, you cannot chat, and there is no mechanism for multiple people to chat. To support group chat (and offline delivery) we have created untrusted Cwtch servers which can host messages for a group. [...] the server has no way to know what messages for what groups it might be holding, or who is accessing it."

Cwtch servers enable group communication through untrusted infrastructure — these servers are "untrusted" because the protocol is designed to be secure against a malicious Cwtch server. Once the server exists, contacts can be invited to use it. For asynchronous direct messaging, create a group chat with only two people.

Any Cwtch user can turn the app on their phone or computer into a server to host a group chat, though this is best for temporary needs like an event or short-term coordination, as the device must remain powered on for it to work. Fortunately, Anarchy Planet runs a public server that is suitable for long-term groups.

Asynchronous conversations on Cwtch need to be started from a synchronous conversation — in other words, you need to be online at the same time as your contact to invite them to a group, and then you no longer need to be online at the same time. This "first contact" dynamic is not unique to Cwtch, but is present in all peer-to-peer applications. In the future, Cwtch plans to improve this with hybrid groups. Until hybrid groups are implemented, you will need to establish your asynchronous Cwtch conversations by using a second channel to set a time when you will both be online.

You can learn more about how to use Cwtch with the Cwtch Handbook.

Note

Briar is another application that works in a similar way (with peer-to-peer and Tor), using the Bramble Transport Protocol (BTP). Briar's main distinguishing feature is that it continues to work even when the underlying network infrastructure is down. It was audited in 2017. Unfortunately, Briar Desktop does not yet work with Tails or Qubes-Whonix because it cannot use the system Tor. Unlike Cwtch, to connect to a contact on Briar, you both have to add each other first. You can either exchange briar:// links or scan a contact’s QR code if they are nearby. Briar Mailbox allows asynchronous communication.

OnionShare has a chat feature that creates an ephemeral peer-to-peer chat room that is routed over the Tor network. The metadata protection works in the same way as Cwtch; it uses the Tor network as a shield and stores everything (ephemerally) locally on the device running OnionShare. OnionShare doesn’t implement any chat encryption on its own — it relies on the Tor onion service’s encryption. Cwtch and Briar both have more features (including the additional Tapir and BTP encryption protocols). The only advantage of OnionShare is that it is installed on Tails by default.

For Anonymous Public-facing Projects

Need #1: That anyone can contact the project

Anyone can connect to a public Cwtch account when it's online. If the account is offline, it's not currently possible to establish first contact, though this will be supported in the future.

Need #2: Resiliency to correlation attacks

Real-time messaging applications are particularly susceptible to end-to-end correlation attacks because of the ability of an adversary, once they know their target's ID on the messaging platform, to trigger incoming network traffic on the target's side by sending them messages on the platform (when the target is online). "Appear Offline Mode" in Cwtch allows a user to selectively connect to trusted contacts and groups, while appearing offline to everyone else. An issue is open to further address this.

Content padding exists to frustrate correlation attacks via message size.

Need #3: Resiliency to exploits

A vulnerability in any application can be targeted with exploits — a severe vulnerability can allow an adversary to hack your system, such as by permitting Remote Code Execution. Cwtch libraries are written in memory-safe languages (Go and Rust) and Cwtch does fuzz testing to find bugs. See the Security Handbook to learn more. For public-facing project accounts, we recommend against enabling the "file sharing experiment" or the "image previews and profile pictures experiment" in the settings.

Need #4: For multiple project members to be able to access the same messages

If a project has multiple members, all of them should be able to access the same messages independently. Currently, this is not possible with Cwtch.

Installation

SimpleX Chat

• Mediums: Video call, voice call, text
• Metadata protection: Yes (Moderate)
• Encryption protocol: SimpleX Messaging Protocol, audited (2022), and SimpleX File Transfer Protocol
• Peer-to-peer: No
• Tor: Not default

SimpleX Chat allows voice and video calls, but this inherently provides less metadata protection. As a design choice to facilitate asynchronous communication, SimpleX Chat is not peer-to-peer — it uses decentralized servers that anyone can host and does not rely on any centralized component. Servers do not store any user information (no user profiles or contacts, or messages once they are delivered), and primarily use in-memory persistence. To understand what a server can and cannot see, read the threat model.

Since SimpleX requires that users place some trust in the SimpleX servers, we recommend prioritizing Cwtch over SimpleX Chat for text communication with other anarchists, and using SimpleX Chat or Signal for voice and video calls. Unlike Signal, SimpleX Chat doesn't require a phone number or smartphone.

If SimpleX is served with a warrant, their privacy policy is quite specific. Servers have the records of the message queues and any undelivered encrypted messages — no data is stored that links the queues or messages to particular users, and the data which is stored is not very useful without access to the user's device.

SimpleX Chat will work with Tor if used on an operating system that forces it to, such as Whonix or Tails. However, voice and video calls generally don't work very well over Tor regardless of which application you use.

You can learn more about how to use SimpleX Chat with their guide. Make sure to set a database passphrase.

For Anonymous Public-facing Projects

Need #1: That anyone can contact the project

Unlike the one-time invitation links that are normally used by SimpleX Chat and shared through a separate channel, you also have a long term address that can be published online so that anyone can connect to you. We recommend against enabling "Auto-accept".

Need #2: Resiliency to correlation attacks

Real-time messaging applications are particularly susceptible to end-to-end correlation attacks because once an adversary knows their target's ID on the messaging platform, they can trigger incoming network traffic on the target's side by sending them messages on the platform (when the target is online). An issue is open to address this. Message "mixing" is also planned.

Content padding exists to frustrate correlation attacks via message size.

Need #3: Resiliency to exploits

A vulnerability in any application can be targeted with exploits — a severe vulnerability can allow an adversary to hack your system, such as by permitting Remote Code Execution. For public-facing project accounts, we recommend that you set SimpleX Chat preferences to only allow text (prohibiting voice messages and attachments).

Need #4: For multiple project members to be able to access the same messages

If a project has multiple members, all of them should be able to access the same messages independently. Currently, this is not possible with SimpleX Chat.

Installation

Signal

• Mediums: Video call, voice call, text
• Metadata protection: Yes (Moderate)
• Encryption protocol: Signal Protocol, audited (2017)
• Peer-to-peer: No
• Tor: Not default

The Signal Protocol has a moderate amount of metadata protection; sealed sender, private contact discovery, and the private group system. Message recipient identifiers are only stored on Signal's servers for as long as it takes to deliver each message. As a result, if Signal is served with a warrant, they will only be able to provide the time of account creation and the date of the account's last connection to the Signal servers. Still, Signal relies on the Google Services Framework (though it's possible to use Signal without it), and the sealed sender metadata protection applies only to contacts (by default).

Signal is not peer-to-peer; it uses centralized servers that we must trust. Signal will work with Tor if used on an operating system that forces it to, such as Whonix or Tails.

Signing up for a Signal account is difficult to do anonymously. The account is tied to a phone number that the user must retain control of — due to changes in "registration lock", it is no longer sufficient to register with a disposable phone number. An anonymous phone number can be obtained on a burner phone or online and must be maintained as long as you’re using it, which takes some technical know-how and money, limiting the amount of people who will do this.

Another barrier to anonymous registration is that Signal Desktop will only work if Signal is first registered from a smartphone. For users familiar with the command line, it is possible to register an account from a computer using Signal-cli. The VoIP account used for registration would have to be obtained anonymously.

These barriers to anonymous registration mean that Signal is rarely used anonymously. This has significant implications if the State gains physical or remote access to the device. One of the primary goals of State surveillance of anarchists is network mapping, and it's common for them to gain physical access to devices through house raids or arrests. For example, if police bypass your device's authentication, they can identify Signal contacts (as well as the members of any groups you are in) simply by their phone numbers, if those contacts haven't changed their settings to hide their phone number.

In a recent repressive operation in France against a riotous demonstration, the police did exactly that. Police got physical access to suspects' phones during arrests and house raids, remote access through spyware, and then identified Signal contacts and group members. These identities were added to the list of suspects who were subsequently investigated.

The risk of a compromised device aiding the police in network mapping is partly mitigated by the username feature — use it to prevent a Signal contact from being able to learn your phone number. In Settings → Privacy → Phone Number, set both Who can see my number and Who can find me by number to Nobody. We recommend that you select a profile name and photo that won't be useful for establishing your identity. For voice and video calls, Signal reveals the IP address of both parties by default, which could also be used to identify Signal contacts. If you aren't using Signal from behind a VPN or Tor, then in Settings → Privacy → Advanced, enable Always relay calls to prevent this.

A private company that sells spyware to governments has a product called JASMINE that is marketed to deanonymize Signal users, based on the analysis of metadata.

In its targeted interception mode — which starts from a single target — JASMINE has claimed it is able to identify communicating parties in encrypted but peer-to-peer applications [...] the JASMINE documentation explicitly claims support for identifying the IP addresses of participants in encrypted apps such as WhatsApp and Signal during voice and video calls where peer-to-peer connections are also used for calling by default.

The JASMINE documentation also explains that by analysing encrypted traffic “events” for a whole country — in mass interception mode — JASMINE has the ability to correlate and identify the participants in encrypted group chats on messaging apps.

A similar surveillance product would not work against Cwtch because it uses Tor by default. Without a Tor or VPN proxy, an adversary can see that you are connecting to Signal servers which is what enables this type of timing correlation attack. Although it is possible to configure Signal to use a VPN or Tor, it is opt-in so most people will not use it like this.

Signal was designed to bring encrypted communication to the masses, not for an anarchist threat model. Because it's very difficult to register for Signal anonymously, and because you must first install Signal on a phone to use it on a computer, we recommend prioritizing Cwtch over Signal for text communication with other anarchists, and using SimpleX Chat or Signal for voice and video calls. For the same reasons, Signal is not well-suited for anonymous public-facing projects.

Installation

use_proxy = on
http_proxy = 127.0.0.1:8082
https_proxy = 127.0.0.1:8082

PGP Email


• Mediums: Text
• Metadata protection: No
• Encryption protocol: RSA or ed25519, no forward secrecy
• Peer-to-peer: No
• Tor: Not default

PGP (Pretty Good Privacy) is not so much a messaging platform as it is a way to encrypt messages on top of existing messaging platforms (in this case, email). PGP email does not have the encryption property of forward secrecy. The goal of forward secrecy is to protect past sessions from future key or password compromises. It maintains the secrecy of past communications even if the current communication is compromised. This means that an adversary could decrypt all past PGP messages in one fell swoop. When you also consider the metadata exposure inherent in email, PGP simply doesn't meet the standards of modern cryptography. For a more technical critique, see The PGP Problem and Stop Using Encrypted Email. Privacy Guides agrees that "email is best used for receiving transactional emails [...], not for communicating with others." We recommend that anarchists still using PGP email use Cwtch groups instead.

There is an exception: for anonymous public-facing projects, we still recommend using PGP email because it is currently the best option that meets the additional needs required by a public account. Use a radical server that doesn't require an invite code. You can learn more about how to use PGP email with the Riseup Guide to Encrypted Email.

Note

PGP is used for another purpose outside of communication: verifying the integrity and authenticity of files. For this use case, see our explanation.

For Anonymous Public-facing Projects

Need #1: That anyone can contact the project

Anyone can send a message to a public email account regardless of whether the recipient is online or offline.

Need #2: Resiliency to correlation attacks

Email is not a real-time messaging application — this means that it is not particularly susceptible to end-to-end correlation attacks via time.

No content padding exists to frustrate correlation attacks via message size in email protocols, but if you access the mail servers through Tor then the traffic is padded.

Need #3: Resiliency to exploits

A vulnerability in any application can be targeted with exploits — a severe vulnerability can allow an adversary to hack your system, such as by permitting Remote Code Execution. Email can be accessed through webmail (via Tor Browser) or through a client like Thunderbird — these have different attack surfaces. For example, a Cwtch developer found an exploit to turn Thunderbird into a decryption oracle when it displays messages with HTML.

We recommend using Thunderbird (which is available in Tails and Qubes-Whonix by default) with the setting to display email as "Plain Text" rather than as HTML: View → Message Body As → Plain Text. Most webmail will not function with Tor Browser in "Safest" mode.

Need #4: For multiple project members to be able to access the same messages

If a project has multiple members, all of them should be able to access the same messages independently. This is straight forward with email, if all project members have the email password and the private PGP key.

Applications we do not recommend

We do not recommend:

• Telegram: Telegram has no end-to-end encryption for group chats, and it is opt-in for one-on-one chats. The encryption doesn't use established protocols, and has had cryptographers describe it as "the most backdoor-looking bug I’ve ever seen".
• Matrix/Element: Matrix has a problem that is inherent in federated networks — terrible metadata leakage and data ownership. It has no forward secrecy, the Element client has a large attack surface, and there is a long list of other issues. What's more, the developers are very friendly with various national police agencies.
• XMPP Clients: Regardless of the client, an XMPP server will always be able to see your contact list. Additionally, server-side parties (e.g., administrators, attackers, law enforcement) can inject arbitrary messages, modify address books, log passwords in cleartext and act as a man-in-the-middle.