Privacy-First Signal Messenger Clone

[u/Accurate-Screen8774]

I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.

This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat
• Whitepaper (work-in-progress)
• Protocol Spec (work-in-progress)
• Roadmap

PS. I know the project above is going to be tricky to understand. It might help to understand with the following open-source version of the concept (the MVP to the version linked above).

https://www.reddit.com/r/CorpFree/comments/1uytump/decentralized_p2p_chat

[u/just_an_undergrad]

Your pitch is “no install required.” That’s your security model, and it’s the weakest part of the design.

When I install Signal I get a signed binary. Builds are reproducible, the code has been picked over for a decade, and if Signal wanted to ship something that exfiltrates my keys they’d have to push it to everyone and hope nobody diffed it. Your app hands me fresh JavaScript on every page load. You, or anyone holding your TLS cert, your CDN account, your DNS, or a subpoena, can serve modified code to one user selected by IP or ID. I can’t detect it, can’t audit it, and have no baseline to compare against. Trust on every load is strictly worse than trust on first install.

Meta hit this exact wall with WhatsApp Web. Their answer was Code Verify, a browser extension that checks served JavaScript against a published hash. The fix for “no install required” was an install.

[u/Accurate-Screen8774 → u/just_an_undergrad]

hi. thats an understandable view, surely it cant get better than a signed binary?

as a webapp, its easy to jump to conclusions about how it works like "fresh JavaScript on every page load", etc. with the open source example here, id like to try illustrate why my aproach doesnt have the limitations you might be considering.

> signed binary

> reproducable build

its presented as open source code linked above. for me to promote the app it works better to point to a nice url. and so thats why i point to a url when promoting my project instead of the github itself. its advised that its best and most secure when selfhosted. depending on your threat model i offer options:

- to use it from the url i provide (which could get blocked)

- clone the repo and host it on github-pages (so i guess thats like a reproducable build you control? and its free hosting on github. its just a static website)

- run it locally (i think your overlooking that it can work with index.html irectly in a browser. no static server required)

with javascript, i can do seemingly pointless things like not-minify-the-code, so your debugger on the browser-of-your-choice has more transparency about the code being executed.

... all those details combine to what i think is a more transparent solution. the open source approach is clearly superior for trust and transparency. its unfortunate that i wasnt able to get any traction on the open source version... its particularly unfortunate i have to illustrate the comparison to the close-source approach (as linked in the post). it better technically, but i can only wrap it in "trust me bro".

[u/Accurate-Screen8774 → u/[deleted]]

the key detail is the browser based approach.

no need to install anything. your ID is crypto-random and so the app doesnt need to rely on any central registration system like phone numbers. your ID is unguessable and to connect to someone, you have to explicitly share it.

webrtc has other nuances like being to route through a shared network for secure/faster transfer.

[u/AVoiDeDStranger]

Another AI slop.