Secure Communication

• Simultaneous, or not: Do both ends have to be active at same time ? Phone call, VOIP call, video call are simultaneous. Email, Facebook are not.
  
  
• Standard protocol, or proprietary: With standard protocols (e.g. plain email, IRC), the ends can use different clients. With proprietary protocols/systems (e.g. WhatsApp, Signal, Telegram), both ends have to use the specific client for that service.
  
  
• Centralized, or distributed/federated/peer-to-peer:
  
  
• One-to-one, or group:
  
  
• Encryption: On data in motion, on data at rest. Who generates the keys, who holds the keys, who applies the keys, who supplies the code ?
  
  
• Data types and formats: Short-text, long-text, HTML, audio, still image, motion video, screen-share, attachments/files. Emojis, Unicode, character sets.
  
  
• Speed: Bandwidth, latency.
  
  
• Quality: Resolution, video frames/second, audio sample size and samples/second, compression.
  
  
• Time limits: Delayed-send, one-time viewing, deleted after N days, unlimited.
  
  
• Distance/range.
  
  
• Real name, pseudonym, anonymous.
  
  
• Public or private conversations.
  
  
• Body of knowledge: Contains a Wiki, or sets of files or FAQs.
  
  
• Ability and legality of recording/saving/backingup communications.
  
  
• Cost: free, pay money at flat rate, pay money per usage, pay with attention (advertising), pay with data.
  
  

• In-person.
  
  
• Audio phone call: phone, VOIP, etc.
  
  
• Video call: Skype, Zoom, Google Meet, etc.
  
  
• SMS
  
  
• Plain email: GMail, Hotmail, Yahoo Mail, etc.
  
  
• Secure email: Proton Mail, Tutanota/Tuta, etc.
  
  
• Plain email with encrypted content/attachments.
  
  
• Centralized proprietary multi-mode: Facebook, reddit, Twitter, WhatsApp, Signal, Telegram, Slack, etc.
  
  
• Federated standardized multi-mode: Mastodon, Discord ?
  
  

1. Buy a domain name through a registrar such as Hover
   
   
2. Buy email service (I like Migadu, but they don't have a phone app, I think) that allows/requires use of a custom domain, and allows wildcarding or infinite email addresses. Decide if IMAP access is important to you (see next step), because some services don't have IMAP or make it hard.
   
   
3. Decide if you want to access the email through their custom phone-app, their webmail client, or through a generic desktop client (e.g. Thunderbird) and generic phone client (e.g. K-9 Mail) using IMAP. Advantage of the generic clients is that you can access email accounts from multiple services (plus calendar and address book and RSS and maybe some chat) in one app.
   
   
4. Start using a password manager (e.g. KeePass), if you aren't already, so you can track all your accounts and what email address you've used with each.
   
   
5. Slowly change all of your online accounts from old email address(s) to new email addresses. It will take a long time to get them all switched over. I feel you never can delete the old email account(s): stray messages will keep popping up there even years later, and you may have set them as recovery addresses on various accounts. In fact, keep accessing the old account every couple of weeks, to make sure it doesn't get closed because of inactivity.
   
   

• K-9 Mail (simple; PGP/MIME but not S/MIME; doesn't support OAUTH; 2.5 MB).
  Uses OpenKeychain to do PGP (5.5 MB).
  thundernest / k-9
  /r/k9mail
  
  
• FairEmail (development ended, app removed from store 5/2022).
  
  

• The data is on someone else's server (giving them some legal rights to access the data, and running the risk that they could turn off your account or go out of business or change the rules).
• Searching and organizing and accessing the data is kind of awkward.
• Critical data is mixed in with transient data and spam.
• Exporting the whole thing to somewhere else if you change email service or address is an enormous pain.
• Backup and restore is out of your control.
• You have to have internet access to read your documents.

mail USERNAME                 # to make sure it works
ls /var/mail/USERNAME         # to make sure it exists
# If not working, see "Getting Linux local CLI mail working"

# Quit out of Thunderbird.
cd $HOME/.thunderbird/SOMERANDOMTEXT.default-release/Mail/Local\ Folders
ln -s /var/mail/USERNAME .

mail -s "subject1" user1 </etc/group

# if mail command not found:
sudo apt install mailutils

• DKIM Verifier. Checks DKIM of email sent to you.
  
  In Preferences/General, enable "Verify DKIM signatures".
  
  In Preferences/Display, enable "Enable highlighting of From header", and change any background colors that are set to "transparent" to some other value.
  
  In Preferences/Advanced, disable "Reading the Authentication-Results header replaces the add-ons verification".
  
  It warns about 1024-bit keys as insecure, even though they've been standard for years (2048 is recommended as of 2018).
  
  LOTS of incoming mail will show warnings about incorrect certificates, weak keys, weak encryption algorithms, etc. Some has no DKIM at all.
  
  

# Quit out of Thunderbird app.
# Download new to /tmp, or to elsewhere and then move it.
mv thunderbird-*.tar.bz2 /tmp

# To check hash, run:
shasum -a 256 /tmp/thunderbird-*.tar.bz2
# then go to:
https://ftp.mozilla.org/pub/thunderbird/releases/VERSIONNUMBER/SHA256SUMS
# and search for the string of digits you got from "shasum".
# You should find the string, next to the correct filename.
# What is this verifying ?  That the file you received over the network
# matches what the owner of that HTTP/FTP site says it should match.

# To check signature (better):
sudo apt install gnupg dirmngr
# Get PGP public key; download:
https://ftp.mozilla.org/pub/thunderbird/releases/VERSIONNUMBER/SHA256SUMS.asc
# Display fingerprint of public key:
gpg --with-fingerprint SHA256SUMS.asc
# FAIL

sudo rm -fr /opt/thunderbird
sudo tar --directory=/opt -xvjf /tmp/thunderbird-*.tar.bz2
sudo rm -f /tmp/thunderbird-*.tar.bz2

[Desktop Entry]
Encoding=UTF-8
Version=1.0
Type=Application
Exec=/opt/thunderbird/thunderbird
Name=Thunderbird
Icon=/opt/thunderbird/chrome/icons/default/default256.png

Thunderbird beta Flatpak

There won't (ever) be one in the main Flathub, because they don't want developer releases of software. But there is a "flathub-beta".

I don't see how to package TB beta as a Flatpak, without recompiling it from source.

https://github.com/flathub/org.mozilla.Thunderbird/issues/23
https://docs.flatpak.org/en/latest/first-build.html
https://old.reddit.com/r/flatpak/comments/usjqk1/easiest_way_to_create_flatpak_application_from/

• In some feeds, you can delete messages as you read them (or want to ignore them), and they never will come back, only new messages will appear.
  
  
• In other feeds, if you delete messages, they ALL will come back again the next time the feed is updated. To avoid this, you have to "mark as read" instead of deleting messages.
  
  

• Themes.
  In app, go to Hamburger / Add-Ons and Themes.
  Thunderbird's "A Guide to Themes"
  
  
• In config editor, there are layout.* values.
  
  
• Shell environment variables; for example run "GDK_DPI_SCALE=2 thunderbird".
  
  
• In config editor, set toolkit.legacyUserProfileCustomizations.stylesheets to true, and then edit file userChrome.css
  munix.dk's "Thunderbird custom CSS via userContent.css"
  mozillaZine's "UserChrome.css"
  "Thunderbird: Hide Header Pane and Buttons in Message Pane"
  Catppuccin (for DEs, WMs, apps, web sites)
  
  

• Commercial "normal" service: GMail, Hotmail, Yahoo Mail, etc.
  
  Free, essentially unlimited capacity, lots of features such as sorting and mobile apps, added features such as Calendar, reliable, no-hassle.
  
  But if you move to another service, you have to change your email address everywhere. If you violate a rule, they could turn off your account, little chance of appeal. Usually they harvest your data and sell it, or sell use of it. If it's a minor/free service, they could go out of business and you'd have to change your address everywhere.
  
  
• Your own custom domain on top of a commercial service.
  
  Solves the "if you move to another service, you have to change your email address everywhere" problem.
  
  
• Commercial encrypted service that handles keys for you: Protonmail, Tutanota/Tuta, etc.
  
  Base level is free, essentially unlimited capacity, often fewer features than a "normal" service such as GMail, pretty reliable, maybe a few more hassles than with a "normal" service.
  
  Usually the security is not 100%; if the service wanted to (or was served with a warrant), they could poison your login page and grab your password.
  
  
• Commercial encrypted service where you hold the private key.
  
  mailbox.org (article)
  
  Keys are generated on your client device, then the service gets only the public key.
  
  You are responsible for backing up and protecting your keys.
  
  
• Client encryption on top of a service:
  
  For webmail: Mailvelope, FlowCrypt, Psono
  Desktop clients: Thunderbird with Enigmail, Evolution with Seahorse, KMail with Kleopatra.
  
  Keys are generated, held, and applied only on your client device. The service only sees encrypted messages, and never has the keys.
  
  You are responsible for backing up and protecting your keys.
  
  Pretty close to 100% security; to compromise you, the client software (e.g. Mailvelope) would have to conspire with the service (e.g. GMail), or both would have to be served with warrants.
  
  
• Run your own email server (self-hosting):
  
  See Email self-hosting section, below.
  
  

• End-to-end encryption: encrypt/decrypt done as close to the user as possible. Even so, it's still possible for a keylogger or something to grab the plaintext.
  
  
• Encryption code installed once on user's machine, not every time you access email, so it's less likely to be suborned.
  
  
• Encryption keys generated and held by the user: if code from the email provider is used to handle the keys, you can't be certain that the keys are safe.
  
  
• Easy interoperability with other secure-email providers. Today, this is non-existent, to my knowledge. The best that is offered is that a user could extract keys and do PGP themselves.
  
  
• Privacy statement that the email provider keeps no logs, doesn't read messages, etc. But usually they say they WILL cooperate (to the extent possible) with a valid court order.
  
  
• Open-source policy. But this is not an absolute guarantee; how do you know if the source being released is what is actually run by the service, and how well has that source been reviewed ?
  
  
• Located in a country with good privacy laws, and separate from your country. Having multiple jurisdictions makes it harder for someone to track you and serve legal papers to get your data.
  
  
• Zero-knowledge policy on accounts: the provider shouldn't require your real name, address, credit card. Should allow access through a VPN.
  
  

# Create keys associated with you:
gpg --expert --full-gen-key
# RSA is default, but ECC is stronger ?
# Select ECC-ECC and Curve 25519 and no expiration.
# You'll set your username and email address.
# You'll set a passphrase to access this key.

gpg --list-keys

gpg --delete-keys UUUUUU
# UUUUUU can be the personal name or the email address.

# Send your public key to recipients, somehow.
# Export public key (to mypub.asc file):
gpg --export --armor UUUUUU >mypub.asc
# Then send mypub.asc to them somehow.

# Send your public key to a key server somewhere:
gpg --fingerprint UUUUUU
gpg --send-keys --keyserver pgp.mit.edu FINGERPRINT

# Import a public key that someone has sent to you:
gpg --import theirpub.asc

# Send a message:
# If signed with your private key, they know it must have come from you.
# If encrypted with their public key, only they can read it.
# How to do both ?
gpg --encrypt --sign -r RECIPIENT PLAINFILE >ENCRYPTEDFILE
# Use --armor option for ASCII files, leave it off for binary files ?

# How they decrypt it:
# They already have your public key and their private key stored.
gpg --decrypt ENCRYPTEDFILE >PLAINFILE

• Person-to-person messaging/chat (only within system, or SMS to any phone).
• Group messaging/chat/feed.
• Forum/topic-based posts/comments.


• Text.
• Subject line plus text.
• Images.
• Audio clips.
• Video clips.
• Voice calls (only within system, or to any phone).
• Video calls.

Group Organization

• Topic-oriented versus feed.
• Single-level/sequential/chronological/flat versus multi-level/threaded/conversation/folders/tree.
• Voting affects order, or not.

For example, the top level of reddit (subs) or Matrix (rooms) is topic-oriented, while the top level of Facebook or Twitter or Discord or email is a feed. Regular chat/Matrix and regular email are single-level; Facebook and Twitter (I think) have one or two levels under each post; reddit has infinite levels under each post.

• Generally one-to-one services:
  
  
  • Threema:
    
    
    
    
  • WhatsApp:
    
    WhatsApp
    Biggest user base, but requires phone number, owned by Facebook.
    Dedoimedo's "How to fix and restore WhatsApp from a local backup"
    
    
    
  •   Signal:
    
    Signal
    Requires phone number.
    UI and features seem identical to those of WhatsApp.
    Easy for a new, non-techie user to get started.
    Has a good desktop app.
    Jan Harasym's "I don't trust Signal"
    
    
    
  • Session:
    
    Session
    Fork of Signal that does not use phone number.
    
    
    
  • Wire:
    
    Wire
    Doesn't use phone number.
    Allows multiple accounts on one device.
    A little harder for a new, non-techie user to get started.
    
    
    
  • Status:
    
    Status
    Doesn't use phone number.
    
    
    
  • SimpleX:
    
    SimpleX
    Doesn't use phone number.
    
    
    
  • Skype:
    
    Available through Mint's Software Manager; use the native version, not the Flatpak version.
    Useful for making cheap international voice-calls to phones in other countries, or making free voice/video/text/filesharing calls to other Skype computers anywhere.
    
    Or you could use a browser and go to web.skype.com, but apparently this only works in Chrome browser (or Firefox with user-agent changed to Chrome ?). Does not accept ungoogled-chromium.
    
    Or you could use a browser add-on for Firefox (but tried 3 or 4 of most-popular in 1/2020 with FF 71, and they all failed).
    
    
    
  • Rocket.Chat:
    
    
    
    
  • Delta Chat:
    
    Delta Chat
    Looks like chat but actually uses email underneath.
    Teknikal's_Domain's "Delta Chat: Instant Messaging Using ... Email?"
    
    
    
  • Mysudo:
    
    No desktop app.
    
    
    
• Generally many-to-many services:
  
  
  • Discord:
    
    Can have topic-based servers.
    No encryption ?
    Jeremy Laukkonen's "What Is Discord and How Does It Work?"
    
    
    
  • Slack:
    
    
    
    
  • Mattermost:
    
    
    
    
  • Twitter:
    
    
    
    
  • Mastodon:
    
    My understanding:
    
    To start using Mastodon, I have to find a server, and somehow evaluate the policies of the sysadmin ? Hope that that server doesn't have a bad reputation, and thus blocked by other servers ?
    
    Then find people I want to follow, on that server or other servers ?
    
    And hope that my home server doesn't quit or kick me out, because then I lose my whole ID and config, have to start over again ? [Not true, if you've kept backups: https://docs.joinmastodon.org/user/moving/ ]
    
    "As best I can tell, the operator of a server has complete control of my account, and could do things such as leak my password and email, falsify or modify posts from me, or just shut down and delete everything."
    
    "The whole server focus is not user friendly or intuitive. ... As an example I finally found someone to follow and decided to look at the people rhey were following, but it would only show me people from that server."
    
    Fedi.Tips
    Axel Rauschmayer's "Getting started with Mastodon"
    ResearchBuzz's "A Big List of Mastodon Resources"
    Wizard for picking an instance: Mastodon instances
    Linux client: Tokodon.
    
    Joshua Long's "Mastodon Safety"
    Brian C. Keegan's "What is Mastodon?"
    Design/scaling issues: Aral Balkan article
    
    
    
  • Jami:
    
    Jami
    
    
    
  • Zulip:
    
    Zulip
    
    
    

•   Element:
  
  Element
  Client for Matrix protocol; replacement for Riot.
  Eric the IT Guy's "Beginner's Guide: How To Get Started With Element & Matrix"
  article
  
  
  
• FluffyChat:
  
  Client for Matrix protocol.
  
  
  
• Fractal:
  
  Client for Matrix protocol.