simplex
SimpleX Chat

SimpleX: the first network where you own your identity, contacts, and groups. Secure / decentralized / open-source. Get the app: https://simplex.chat/downloads

Public Key

npub1exv22uulqnmlluszc4yk92jhs2e5ajcs6mu3t00a6avzjcalj9csm7d828

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsvnx99ww0sfall7gpv2jtz4ftc9v6wevgdd7g4hh7awkpfvwlezugpgdmhxw309ahhsarjv3jhvctkxc685d35093rw7pkwf4xwdrww3a8z6ngv4jx6dtzx4ax5ut4d36kw6mwdpa8ydpkdeunyutzv9jzummwd9hku9wnlx5

Publishing to

oxtrdevav64z64yb7x6rjg4ntzqjhedm5b5zjqulugknhzr46ny2qbad.onion

Author Public Key

npub1exv22uulqnmlluszc4yk92jhs2e5ajcs6mu3t00a6avzjcalj9csm7d828

Show more details

Last Notes

2026-01-16 09:11:29 UTC

- reply

You can say there are like 3 actual lines of code, the rest is boilerplate :)

2026-01-16 09:10:04 UTC

- reply

Right :) But it requires marking the file as mjs or something.

2026-01-15 19:03:53 UTC

You can create a SimpleX Chat chat-bot with 17 lines of JS code using the new Node.js library
https://blossom.primal.net/b6c8f7f4c49248b09d2028ffe4ab57be8e7f56f74c57e6a45f62b7f3e28e97e8.jpg
Beta version: https://npmjs.com/package/simplex-chat/v/6.5.0-beta.4.4
Source code: https://github.com/simplex-chat/simplex-chat/tree/master/packages/simplex-chat-nodejs
To run this example with Node.js:
npm i [email protected]
node ./node_modules/simplex-chat/examples/squaring-bot-readme.js

2025-12-31 09:51:29 UTC

- reply

Our experimental directory of groups: https://simplex.chat/directory/
Unofficial registry of SimpleX servers: https://simplex-directory.asriyan.me
SimpleX bots API and libraries: https://github.com/simplex-chat/simplex-chat/tree/master/bots#useful-bots
Our plan for Community Vouchers: https://simplex.chat/vouchers/ - you can get an access pass to test them once launched before the end of today.

2025-12-31 09:51:08 UTC

Happy New Year!
Thank you all for your incredible support of SimpleX network in 2025:
- to users for over 2,000,000 app downloads since launch.
- to enthusiasts for hundreds of community hosted servers.
- to group owners for thousands of groups.
- to businesses and projects using SimpleX Chat for customer and user support.
- to developers who created integrations and libraries for SimpleX network.
- to all who donated, and especially to Vitalik Buterin
for his game-changing donation of 128ETH.
2026 will be great for privacy and for SimpleX network!

2025-12-25 18:07:35 UTC

https://blossom.primal.net/0b20c68d251c5bede96567e1052eda3d0044af32bd7ee8de8f3796d426ba9341.jpg

2025-12-24 23:20:23 UTC

- reply

is it yours?

2025-12-24 23:19:15 UTC

- reply

🤦‍♂️ we don't plan the shitcoin, and never did that :)
It's a payment system for servers, no "coins" there, shit- or not.
Read https://simplex.chat/vouchers - it's been updated.
The plan is evolving - whitepaper is half-way done, the assessment of blockchain to build on is ongoing.

2025-12-24 23:16:35 UTC

- reply

@nprofile…uvay is cool - they don't chase people to publish apps, they just do that. Thank you.

2025-12-24 23:11:39 UTC

- reply

Is it? it's nice 😉 We can do that.

2025-12-24 23:05:51 UTC

- reply

haven't seen it before :)

2025-12-24 22:56:55 UTC

A big news for SimpleX Chat privacy and security:
Android apps released via GitHub and F-Droid are now 100% reproducible!
It means that you can easily verify that the app is secure, even if the download site was hacked.
From v6.5 our release process is:
1) build Android apps on two independent machines and confirm they are 100% identical;
2) cryptographically "sign" them;
3) add signature files to the release page so you can verify.
v6.5 beta.3 release: https://github.com/simplex-chat/simplex-chat/releases/tag/v6.5.0-beta.3
Server and Linux desktop builds were already reproducible, and Android APKs are now as secure.
Anyone can check it themselves - no coding needed, just follow our simple guide to verify the app is genuine or run the build yourself: https://simplex.chat/reproduce/
https://blossom.primal.net/0c708ffe81366604ff103133b791f56a312e2ed42b41a5d5411f8188da00036d.jpg

2025-12-24 22:55:22 UTC

- reply

MLS uses ratcheting trees, it's different from Double Ratchet.

2025-11-18 17:28:48 UTC

- reply

We honestly see it as a very rare view, proportionally. We are using planning to use one of smartchains for their intended purpose - distributed computing with reliable network-wide consensus. While Community Vouchers is the primary driver to use a smartchain, it'll also solve other problems:
- namespaces for users and groups, that protect from MITM attacks - if operators host names, as in federated designs, it's impossible to protect from them.
- public server registry with operator trust and reliability metrics, without any central authority as with Tor, for example.
And there won't be any minting activity by the operators - they will run full non-validating nodes on blockchain, and will act as decentralized RPC layer to blockchain (which is a weak link for most chains), letting clients to have multiple independent views onto chain for important queries (such as name resolution).
This is a really big innovation, and most users don't see it - they think we're going to use what exist.

2025-11-18 17:23:35 UTC

- reply

Several reasons:
- payment either requires using private cryptocurrencies, that most people don't use, or exposes identity to operators - vouchers make purchase and payment unlinkable
- direct payments create risks of operator default - we want to build zero-trust model
- no effective way to codify revenue-sharing agreement - again, risk of defaults, not honouring agreement, etc.
All these problems are solved with smart contracts, and we don't see any simpler solution.
The question is similar to "why SimpleX network needs private message routing?" To protect users privacy and security from their contacts. As the number of operators grow, it's important to protect users from operators.

2025-11-18 17:19:57 UTC

- reply

> aren't useful as an investment
Correct. We do NOT plan to use vouchers as a fundraising mechanism, and they are not tradable, and even more - they expire. Otherwise it may cross the line with strict application of Howey test (any tradable utility token, especially if used by a single party as development funding, is likely to be considered a security), and we don't want these risks.
We are exploring other funding models, such as grants, private investments and community crowdfunding - it will all be announced next year once the plan crystallizes.
> I'm not sure this is the best solution.
That is correct, but what we like about it is that it fits a very widely used regulatory framework - prepaid telecom cards. So we are doing a technical innovation without regulatory risks, which is rarely possible.
We are always open to better ideas, as we don't see any simpler design that achieves all the stated objectives:
- zero trust
- revenue sharing between operators and "network"
- unlinkability of purchase and usage
- no (or limited) transferrability
- expiration
- ability to purchase via in-app and credit part payments without being a cryptocurrency exchange (as they are prepaid telecom cards).
- probably some others
> it's difficult for a lot of users to understand what it solves and why.
Agreed, but we aim to make it completely hidden from the users and make it possible to use Community Vouchers (aka Community Credits) without touching / knowing about blockchain.
So there won't be requirement to use a crypto wallet at some point of product development - at least that is the objective we are working to:
- user can buy Community Voucher via in-app payment (yes, with some draconian commission, but it's worth it anyway as it would increase donations to communities - about 50% of app users even today never used cryptocurrencies, and for all potential users it's even bigger share)
- user can then donate it to their community of choice
All that within the app, without any technical way to link voucher purchase to community donation, thus preserving participation privacy.

2025-11-18 17:03:08 UTC

- reply

Yes, we see it as an issue, as message delivery will be redundant, and it's a source of revenue to the operator - so operator "default" is not an issue for message delivery.
In case operator is also a mint, then operator "default" becomes an issue, so we are not considering the model when operators act as mints – it's a much higher level of trust than message delivery.

2025-11-18 17:01:01 UTC

- reply

Exactly right. Our goal is to build a trustless system here, and eventually make network governance trustless as well.
If you looked at the preliminary design doc you can see that e-cash emerges at a point of Community Credit to operator credit conversion (so only micropayments or "change" depend on e-cash), but we might be able to remove this extra-layer based on the current design process evolution.

2025-11-16 15:55:46 UTC

- reply

https://primal.net/e/nevent1qqsgrphj8s6y7zl9jvgdxrvwzzkj97jw8t8n9p4u3ru76nsx95cynygju63tp

2025-11-16 15:55:09 UTC

- reply

Community Vouchers are pure utility tokens:
- can only be used to pay for servers
- cannot be traded
- cannot be sold
- have fixed price
- expire in 6-12 month.
This is not something you can "trade" or "invest" in.

2025-11-16 15:53:12 UTC

- reply

No, and not going to.

2025-11-16 15:52:57 UTC

- reply

2025-11-16 10:43:17 UTC

Our users asked many questions about Chat Control, as discussions were restarted in the EU this week.
SimpleX Chat is an open-source app where users control the code and the servers they use.
Therefore it is impossible to implement any client-side scanning, and it will not happen.
If the law is passed, two options are possible:
- we might need to stop offering preset servers to the EU users.
- we will not need to change anything - this is the most likely outcome.
Our operations are always consistent with our Privacy Policy (https://simplex.chat/privacy), and we would rather shut down than do anything that contradicts this agreement with our users.

2025-11-12 15:50:00 UTC

- reply

"Community Vouchers are not tradable, and there will be no "pre-mine" or public sale."

2025-11-12 15:49:18 UTC

- reply

https://simplex.chat/vouchers/

2025-11-12 13:50:25 UTC

"Code alone doesn't cut it. Not code alone, not code widely distributed, not even code widely used. Some measure of toleration in society for activities conducted in private is necessary for long term success. Not convenient, not easier, but necessary."
Eric Hughes, "Kid Gloves or Megaphones" (email to Cypherpunk mailing list), 1996
https://diswww.mit.edu/MENELAUS.MIT.EDU/cpunks/52130

2025-11-03 19:32:07 UTC

- reply

I can send you SimpleX address for DM?

2025-11-03 19:31:19 UTC

- reply

More than happy to chat Calle - it's a priviledge. But we're not doing shitcoins.

2025-11-03 09:33:57 UTC

Huge thank you to all for feedback and suggestions on Community Vouchers plan!
FAQ:
1. Can we still use our servers?
Yes, and it will be improved (read full FAQ). Community Vouchers are completely opt-in, and intended only for server payments by the large groups.
2. How is it possible to provide privacy on public blockchain?
In the same way as we provide private communications on the public Internet - by using per-purchase addresses, not per user as in wallet apps, and by using zero-knowledge proofs to verify ownership.
3. How many Community vouchers will be pre-sold and available during public sale?
None! No Community Vouchers will be made available to any insiders or to the public sale – it would have made them investment contracts. Community Vouchers are restricted utility tokens.
4. What problems do vouchers solve?
- unlinkability of purchase to usage, thanks to zero-knowledge proofs.
- trust to server operators - funds will be only unlocked to them after infrastracture is provided.
- revenue sharing with network - it will be codified in blockchain contract.
5. Are you considering other blockchains?
Yes, as long as they are sufficiently mature, and natively support smart contracts and zero-knowledge proofs. Send your suggestions!
Read more details in the updated Community Voucher FAQ at http://simplex.chat/token
https://blossom.primal.net/ba7a2a7507d554ca6c71846f3cc264eff80bd32e73cf568256ce0d4289c7d120.png

2025-10-30 16:24:50 UTC

- reply

Problems = functions. They are important features of the network for many users.

2025-10-30 13:04:01 UTC

- reply

Start from reading the page and FAQ there, it clarifies many things.

2025-10-30 13:03:05 UTC

- reply

Always happy to chat. Ethereum support for smart contracts and native support for zero-knowledge proofs being rolled out this year makes it the best choice to develop solutions that require network-wide consensus - there is no alternative. It's not a cryptocurrency choice as some people think.
This choice is purely technical, and not political or ideological - it's simply tech that at the moment works better than alternatives and is the most stable.
I commented some points on X, will repost here.

2025-10-30 12:42:53 UTC

We plan to adopt zkEVM networks for problems that require network-wide consensus:
- public names
- server registry
- server infrastructure payments using Community Vouchers represented by SMPX utility tokens on some L2 network TBC
Please read the plan and FAQ here: https://simplex.chat/token/
You can get a free NFT on Ethereum mainnet that will provide access to testnet when launched - planned for 2026.
https://blossom.primal.net/982e7d800a3484f999229711d6d6e90bf93b1c66e0973b971a64c3abd5245cf5.png

2025-10-01 18:00:55 UTC

Join & create SimpleX groups!
The directory can now be viewed on our website: https://simplex.chat/directory
https://blossom.primal.net/314f13698d9fc7c9812ce158a99afc75383ccee617e787feb37c6ec4f1237ec3.jpg

2025-08-14 10:44:02 UTC

- reply

But please note the comment in the post (and Nostr post), that Whitenoise smartly avoided authentication service problem.
What is the most annoying is that this problem is never mentioned in announcements of companies rolling it out and in media publications about MLS.

2025-08-13 07:57:57 UTC

- reply

What I mean is that Nostr relays can track which IP addresses read messages from which group IDs, creating an association with transport level identities of the users. While it's indeed mitigated to some extent by Tor/VPN, which was SimpleX design defence early on, the valid criticism of this argument that either Tor should be built into the clients (which wasn't and won't be the case with SimpleX, and is not the case with Nostr clients), as most users won't use Tor, and will assume that declared security properties hold without any additional measures.
What's worse is that even with Tor or VPN, Nostr relays can associate the list of group IDs with client sessions that read them, and observing sessions over time they would be able to statistically "recognise" users by the list of groups they get messages from. To mitigate this risk clients have to use different connections (and Tor circuits) when reading from different groups, and it's neither practical nor part of the spec. SimpleX clients offered this feature (transport isolation) as opt in.
So the response of SimpleX network design that addressed this criticism was using two independent relays in the message routing path, where the first one can see client session and transport address, but cannot see destination message queue address. And the second relay can see destination queue address, but has no information that could identify the transport session of the client. And the clients are programmed to choose relays operated by different parties to mitigate collusion risks.
What I was saying about our future chat relays design is that they are the usual messaging clients under the hood, just high volume, and won't have any network connection to the group members, even an indirect one, as they will be communicating via the existing messaging network.

2025-08-13 07:34:15 UTC

- reply

As for participation privacy, users don't seem to accept the lack of in-built transport level protection. As long as relays can track on the IP level who reads which groups, they would have a good enough picture of who participates where. That's why we design future chat relays that would handle group broadcasts as high-traffic messaging clients that don't have any network connections with group members (not even indirect connections).

2025-08-13 07:24:56 UTC

- reply

That's why WhiteNoise is explicitly called out as not having this problem. You could make it explicit in your docs, as some digging was required to understand that you use existing identity system instead of separate AS.

2025-08-13 07:22:30 UTC

- reply

Nope, we never agreed that. A bank customer is not a part of the bank. So stop twisting and shilling. You'll only lose whatever audience trust you may have remaining with this approach.

2025-08-13 07:20:35 UTC

- reply

As for address rotation, it's currently possible manually, so they are not completely static, and this feature is used a lot, and it will be automatic next year. The challenge with automatic rotation is reduced usability - data backups do not allow restoring connections, so it requires smarter approach to make sure that the solution is usable.

2025-08-13 07:18:29 UTC

- reply

This has the same problem that was drawing criticism with early design of SimpleX network - while there is no persistent/observable identity on the protocol level, there is a fixed transport identity - relays can see which IP addresses communicate with which IP addresses. So it would require a similar solution to what we did with SimpleX network to mitigate it.

2025-08-13 07:15:45 UTC

- reply

WhiteNoise is mentioned in the post.

2025-08-13 07:14:38 UTC

- reply

Yes, the post mentions WhiteNoise

2025-08-12 20:49:48 UTC

An essay explaining why we don't plan to use MLS: https://www.poberezkin.com/posts/2025-08-12-mls-the-naked-king-of-end-to-end-encryption.html
A sidenote, is that Nostr's Whitenoise avoids its main problem.
TL;DR: MLS security model is "Trust me bro".

2025-08-10 21:43:12 UTC

- reply

s/instead/in return/

2025-08-10 21:42:46 UTC

- reply

Do you even read the nonsense you write? We supported NewOil with a tiny amount because we liked what they do and they promoted SimpleX to their audience instead. Where plural comes from is unclear - it was literally a one-off sponsorship. And Bill gates did not fund us, Village Global did. But you know it all, you are just spreading hate, aren't you?
HydraVeil may be a good thing, happy to review, but you're not making friends with your attitude.

2025-08-03 19:10:21 UTC

- reply

Hey. We love factual criticism, but this is misleading.
Who’s talking to whom - it’s what anybody can see in Nostr clients UI, and Nostr relays can see it as well.
SimpleX relays can’t see it since private routing via two independent relays became the default - it’s been more than a year.
And most Nostr clients don’t offer choosing servers as part of onboarding. Neither does Elements afaik 🤷‍♂️
SimpleX clients currently have 2 preconfigured operators and let users choose which to use during the onboarding. There are many 100s, maybe 1000s servers in SimpleX network - that you don’t see the list is a feature.

2025-07-04 21:59:42 UTC

- reply

Most publicly used communication systems are way more complex, objectively.
SimpleX may be more complex than some simple open-source systems, but given the objective to compete with Signal, Telegram and WhatsApp, it is still too simple, in comparison, simply because of much less money spent.
What's your point of reference for simplicity/complexity?

2025-07-03 20:54:13 UTC

- reply

And the old link will continue to work. This short link is simply a reference to the container with full link, group profile and the key - see the post!

2025-07-03 20:52:54 UTC

- reply

You need to have v6.4-beta.4 version. If you created the link previously, it won't be automatically shortened - there is a button under the QR code to add a short link to it.

2025-07-03 20:49:37 UTC

- reply

Yes! And you will also see group name before joining, and starting from 6.4.1 also group logo and welcome message.

2025-07-03 19:49:46 UTC

SimpleX Chat now has a much better way to make connections – available in v6.4 beta release!
- Short links and more secure
- See the name before connecting
- Send messages without waiting for your contact to be online
Read more in the blog post: https://simplex.chat/blog/20250703-simplex-network-protocol-extension-for-securely-connecting-people.html
v6.4-beta is available on PlayStore, TestFlight and GitHub.

2025-06-05 16:21:49 UTC

SimpleX Chat is #1 messenger recommended by Whonix!
https://www.whonix.org/wiki/Chat#Recommendation

2025-04-23 18:45:04 UTC

The comparison of 6 messengers in c't magazine (Heise.de)
They ranked SimpleX Chat as the best for privacy and security!
https://m.primal.net/Qang.png
https://www.heise.de/select/ct/2025/9/2505715264990543311

2025-03-12 15:28:58 UTC

https://www.youtube.com/watch?v=O3YEeoH2oyU
A great episode of Surveillance Report podcast - we sponsored it!

2025-03-10 19:40:17 UTC

v6.3 of SimpleX Chat is released 🚀
- preventing spam and abuse in public groups.
- group improvements: mention other members, improved performance.
- better chat navigation: organize chats into lists and jump to found and forwarded messages.
- privacy and security improvements: chat retention period and private media file names.
Read more: https://simplex.chat/blog/20250308-simplex-chat-v6-3-new-user-experience-safety-in-public-groups.html

2025-03-04 09:06:42 UTC

We updated SimpleX Chat Privacy Policy & Conditions of Use.
It's more Power to the People!
1. Added content license in groups, and stated that NO LICENSE is granted to the server operators or ourselves.
We do not ask for ANY license to YOUR content!
2. Added the conditions of access to preconfigured servers via modified 3rd party applications.
The previous policy version prohibited it, unintentionally.
Thanks to the users developing apps for suggesting it!
3. Clarified some definitions:
- "aggregate statistics" explicitly excludes any stats that can be related to particular users.
- the content that can be removed changed from "identified illegal content" to "illegal content identified in publicly accessible resources".
These changes do not change how we work: we never had user-related statistics, and we technically and legally cannot access private chats.
Our privacy policy also:
- includes a commitment to run the published code,
- re-confirms the absence of any compulsory requests.
Thanks to all users for suggesting these changes.
The full text: https://simplex.chat/privacy/
Changes: https://github.com/simplex-chat/simplex-chat/commit/7471fd2af5838dc0467aebc570b5ea75e5df3209

2025-03-04 09:04:15 UTC

- reply

To address some incorrect criticism:
> Did you know @SimpleX Chat now has a blockchain/shitcoin built in (called Flux)?
Nope, that's not true. There is no built-in coin. Flux the company offers their servers to the app users. Not their coin.
> Did you know they've also started doing "content moderation"—blocking users, groups and 3rd party servers?
Also not true. We cannot block users, as there are no users, and we do not block 3rd party servers. We do remove addresses of groups that distribute CSAM from our servers, without any impact on users privacy.
> Yeah, so far it's only to stop CSAM distribution but we all know how that's a slippery slope. The good old "Think of the children" tactic. If there's a method to ban, block or censor, it will be used and ABUSED.
Not true. Freedom of speech without SOME restriction cannot exist - unlimited freedom always leads to abuses of power and tyranny. Study some history. Our freedom ends where the freedom of our neighbours starts, so some limits absolutely must exist to defend our freedom.
> SimpleX Chat ... not decentralized
Not true as well - there are 100s if not 1000s of community run servers. If you don't want to use ours or Flux's, use your own or anybody else's - it's all in a single network.
> not censorship-resistant.
This is correct, and this will change, as was explained in livestream.
Censorship-resistance and privacy are technically contradictory requirements, so they have to be balanced.
> I also found out they are getting funded by VCS such a Village Global
We were never hiding it, and who are it's LPs is irrelevant - they have no influence or control on SimpleX Chat.
Read this post: https://simplex.chat/blog/20240814-simplex-chat-vision-funding-v6-private-routing-new-user-experience.html

2025-03-04 08:57:00 UTC

- reply

you can join incognito, with random name, or use different profile, but not different picture in the same profile.

2025-02-04 17:59:27 UTC

Livestream on X: February 11, 5pm UTC, 9am PT.
SimpleX network: Power to the People!
Evgeny and Dan Keller (co-founder of Flux) will talk about:
- extreme decentralisation,
- Flux servers in the apps,
- future commercial model,
- large content channels,
- moderation & freedom of speech.
Join us at https://x.com/SimpleXChat
https://m.primal.net/OQMW.jpg

2025-01-24 20:07:49 UTC

Opt Out podcast: Improving SimpleX Chat w/ Evgeny from SimpleX and Dan Keller from Flux
https://optoutpod.com/episodes/improving-simplex/

2025-01-15 17:37:54 UTC

Privacy-preserving content moderation - preventing abuse of SimpleX network without any compromise to users' privacy and end-to-end encryption.
https://simplex.chat/blog/20250114-simplex-network-large-groups-privacy-preserving-content-moderation.html
This is our response to #ChatControl ideas - no need to scan content to moderate it.
Post your comments!

2024-12-25 16:13:39 UTC

https://image.nostr.build/3492a9c64a81046813f074efe292a7915258bb6122996fb62309b80a7dd8951a.jpg

2024-12-10 19:10:25 UTC

- reply

How would it work? SimpleX client would connect to Wallet Connect?

2024-12-10 19:09:29 UTC

SimpleX Chat v6.2 is out!
The app now includes both servers that we operate and servers independently operated by Flux – thanks to Daniel Keller and Flux team!
More privacy and decentralization for all users!
Also in v6.2:
- business chats!
- better UX: open chat on first unread (not on iOS yet), show who reacted.
- bette iOS notifications!
Read more: https://simplex.chat/blog/20241210-simplex-network-v6-2-servers-by-flux-business-chats.html
https://m.primal.net/MsQN.png

2024-11-25 18:39:38 UTC

Servers operated by Flux added to SimpleX Chat apps (v6.2-beta.1) to improve metadata privacy – a game changer for SimpleX network users!
https://simplex.chat/blog/20241125-servers-operated-by-flux-true-privacy-and-decentralization-for-all-users.html
Huge thanks to Daniel Keller (Flux CEO and co-founder) for supporting our vision for extreme decentralization of communications!

2024-10-16 19:34:30 UTC

- reply

If nobody was paying attention, it would not have been a problem. But many people, beyond the niche of technologists and privacy supporters, are misled to see privacy as something that enables rather than reduces crime, and it may have very damaging consequences for democracy – it's a real threat. So this response is necessary.

2024-10-16 18:41:14 UTC

Our criticism of recently published
Wired article: "Wired's Attack on Privacy"
https://simplex.chat/blog/20241016-wired-attack-on-privacy.html

2024-10-14 17:29:24 UTC

New security review by Trail of Bits and new v6.1 released – better calls, better iOS notifications and better user experience!
https://simplex.chat/blog/20241014-simplex-network-v6-1-security-review-better-calls-user-experience.html

2024-09-19 08:34:35 UTC

v6.1-beta.0 is released with support for SOCKS proxies both in iOS (via TestFlight) and Android (via Github releases as direct APK download: https://github.com/simplex-chat/simplex-chat/releases/tag/v6.1.0-beta.0).
You can host your own SOCKS proxy (this one looks good: https://github.com/heiher/hev-socks5-server) or you can try ours, if you use preset servers (it won't allow connecting to any other servers directly, but you can still send messages to anybody who uses other servers):
Address: 139.162.173.97
Port: 443
Username: user
Password: YJHolWSzTfOny7es

2024-08-31 16:31:15 UTC

- reply

It is not the same. Build reproducibility means that every time you build the app from the source code you would get exactly the same result, identical byte by byte. It would allow independent parties to validate that the apps that we distribute via different channels are built from the source code we publish.
The problem is that to achieve this quality requires that the build process is deterministic, and in general case it is not:
- some libraries may embed timestamps during compilation.
- compilers my use random numbers for some identifiers.
- etc.
We plan to solve this problem, but it is much harder than it may seem.

2024-08-31 16:25:58 UTC

Answering your questions about "private message routing" in SimpleX network:
1. Does SimpleX protect IP addresses? Yes.
2. Doesn't private message routing reinvent Tor? No.
3. Why don't you embed Tor? Tor is great, but not for all.
Read more in FAQ: https://simplex.chat/faq/#does-simplex-protect-my-ip-address

2024-08-24 12:19:46 UTC

- reply

Thanks to our users who highlighted these inaccuracies to us!

2024-08-24 12:19:10 UTC

- reply

6. Is the design well documented? Somewhat
The design documentation was reviewed in preparation for design security audit in July 2024 - report is about to be published.

2024-08-24 12:18:40 UTC

- reply

5. Does the company log timestamps/IP addresses? Yes
This is incorrect, we never logged IP addresses and access timestamps of the users.
Further, the private message routing that is now enabled by default for all users prevents such logging by any 3rd party servers with modified code:
https://simplex.chat/blog/20240604-simplex-chat-v5.8-private-message-routing-chat-themes.html

2024-08-24 12:18:14 UTC

- reply

4. Directory service could be modified to enable a MITM attack? Yes
This is incorrect, as there is no user directory service at all (and no knowledge of even the number of users), and MITM by servers is not possible by design, even without optional security code verification (that exists to mitigate MITM by the channel you used to pass one-time invitation link, e.g. email).

2024-08-24 12:17:43 UTC

- reply

3. Cryptographic primitives. Curve25519 / XSalsa20 256 / Poly1305 (downgraded for the absence of PQ encryption).
We added PQ encryption in March this year: https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html
This is done in the same way as Apple describes as PQ3 here: https://security.apple.com/blog/imessage-pq3/
it provides stronger protection than Signal design where PQ encryption only applies to the initial key exchange.

2024-08-24 12:16:34 UTC

- reply

2. Company jurisdiction: UK
We disagree that there are any jurisdictions that are particularly good for privacy.
Also, this might important for centralised services, like Threema, where the users can't host servers, and much less important for decentralized network, such as SimpleX, where there are hundreds (if not thousands) of servers that we don't control.

2024-08-24 12:15:59 UTC

- reply

1. Main reasons why the app isn't recommended: Provide a transparency report.
It is available online and updated at least quarterly, or if anything changes: https://simplex.chat/transparency/

2024-08-24 12:15:01 UTC

https://securemessagingapps.com by is the great comparison of messaging apps, but there are several incorrect statements about @SimpleXChat there. Commenting in thread 🧵 below.

2024-08-20 15:18:31 UTC

- reply

Opened now again - was limited to 100 responses

2024-08-20 10:48:16 UTC

Please fill this survey about SimpleX Chat: https://gdlgeuc34xt.typeform.com/to/XAKc5N1l
It is a smaller version of the survey we did last year, please answer again if you answered then.
Thank you!

2024-08-14 14:03:15 UTC

- reply

Please upgrade desktop app to v6.0 as well.

2024-08-14 13:41:27 UTC

Announcing $1.3m pre-seed investment from @npub1sg6…f63m and
Asymmetric VC in SimpleX Chat 🚀
https://simplex.chat/blog/20240814-simplex-chat-vision-funding-v6-private-routing-new-user-experience.html
Also SimpleX Chat v6.0 stable is now released with the new user experience and private message routing – details in the post.

2024-08-12 18:41:39 UTC

- reply

If any applicable legislation were to be passed, then we will be getting a legal advice based on its final wording about what is the course of action that is both legal and also benefits our users most.
At this point it would be unprofessional to speculate about it.

2024-08-12 16:24:50 UTC

In case you missed the news, #ChatControl is back on the agenda of the EU governments: https://www.patrick-breyer.de/en/take-action-to-stop-chat-control-now/
We wrote before that strong e2e encryption is the only way to protect children online: https://simplex.chat/blog/20240601-protecting-children-safety-requires-e2e-encryption.html
Write to the MPs you voted for – every single letter can change the outcome.
And huge thanks to Patrick Breyer for fighting this insanity.

2024-08-11 20:22:18 UTC

Please note: we do NOT control the domain simplexchat.org
It might be a phishing site to collect the data (it has an exact copy of our website https://simplex.chat).
We submitted the complaint to the domain registrar (GNAME).
Do NOT download anything from simplexchat.org, obviously.

2024-08-08 22:07:00 UTC

- reply

We love Nostr as a publishing platform that offers unparalleled censorship resistance. But NIP44 does NOT provide most of the important qualities of e2e encryption:
- break-in recovery.
- repudiation (deniability).
- visibility of connection graph to observers.
- fixed message sizes (although it can be provided by the specific app)
- resistance to Shore algorithm (PQ encryption).
It's unclear whether it provides forward secrecy, but the spec implies that it does not - I might be wrong here.
We wrote this post about the qualities of e2e encryption and why they are important: https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html

2024-08-08 21:57:33 UTC

SimpleX Chat v6.0-beta.4 is released!
It is stable to use, and please let us know any issues - any help testing it is really great!
You can get beta version for iOS from Apple TestFlight, and for Android from GitHub or from our F-Droid repo (it's still in review in Play Store beta channel): https://simplex.chat/downloads/
The final release will be published on 8/14, together with the announcements.
https://m.primal.net/Jsqo.jpg

2024-06-30 13:20:30 UTC

- reply

Because I specifically do not want to use any public currency blockchain - I want an accounting method, not money. There many useful legal differences when the flow of money is the opposite to the flow of cryptographic keys. Read the doc.

2024-06-09 08:05:27 UTC

Talking at MoneroKon in 25 min! Watch the livestream here: https://youtube.monerokon.org/

2024-06-08 17:55:25 UTC

- reply

No, not like Session at all.
We are not going to throw away double ratchet, and we are not going to create cryptocurrencies based on public blockchains. If we ever replace double ratchet with any other scheme, we would replace it with the more secure one, not with a less secure one like Session did.
We are moving to a very different direction from Session's: https://simplex.chat/blog/20240516-simplex-redefining-privacy-hard-choices.html
Also, the design of the private routing achieves the level of metadata privacy that onion routing in Session doesn’t provide - I can comment more on it, but here is the post: https://simplex.chat/blog/20240604-simplex-chat-v5.8-private-message-routing-chat-themes.html
I understand that Session fans might be angry about my criticism of Session, but its crisis is of their own doing - Session's decision to remove double ratchet was a wrong one - users who choose Session need double ratchet, at least.
The path for Session to regain users' trust would be:
1) get double ratchet back, with all its qualities, and figure out how to solve multidevice without compromising encryption security - I’d happily collaborate on that, as an acceptable solution doesn’t exist yet.
2) make node ownership optionally transparent and let clients choose nodes owned by known and different operators (to avoid unknown operators who potentially collude undermining onion routing promises - these promises only hold under the assumption that operators of nodes chosen for the circuit do not collude).
3) decentralise media storage in the same way messages are decentralised - Session may as well adopt XFTP protocol we designed - it's independent from messaging, and that can create some collaboration points too.
4) add a notification when another device access the same profile via recovery code.
5) protect access to recovery code in the app with PIN.
In its current state Session is simply dangerous to use for any scenarios requiring privacy and security.
Solving points 4 and 5 would remove Session from "dangerous" territory and make it simply “not too secure”. I don't understand why it wasn't already done after the public conversation with Keith several months ago, see the links here: https://x.com/SimpleXChat/status/1755216356159414602
Solving 1 would make it secure. Solving 2 and 3 would make it private.
It's correct to point out SimpleX network limitations, and we work on resolving them.
But by misleading the audience about Session level of privacy and security you are creating risks that may cost some people their lives or freedom - this is really bad for the community and detrimental for your reputation as well.

2024-06-05 12:51:04 UTC

- reply

You’re ahead of us - thank you, reposted :)

2024-05-16 19:03:53 UTC

Communication privacy and hard product choices: https://simplex.chat/blog/20240516-simplex-redefining-privacy-hard-choices.html

2024-05-03 08:38:05 UTC

We are upgrading the preset SimpleX relays to the new version - it is compatible only with the apps starting from v5.5.3 (released early February) - please upgrade to the latest version and ask your friends to upgrade too.

2024-04-26 22:59:54 UTC

SimpleX Chat v5.7 released:
- quantum resistant e2e encryption with contacts enabled by default.
- forward messages without revealing the source and save them to private notes.
- in-call sounds and switching sound sources.
- customizable profile images - from square to circle.
- better network connection management.
Also, we added Lithuanian interface language to Android and desktop apps - thanks to our users!
Read more: https://simplex.chat/blog/20240426-simplex-legally-binding-transparency-v5-7-better-user-experience.html

2024-03-23 20:53:23 UTC

The post about SimpleX Chat v5.6 release with quantum resistant end-to-end encryption and also about how SimpleX network protocols will be moving to nonprofit governance:
https://
simplex.chat/blog/20240323-sim
plex-network-privacy-non-profit-v5-6-quantum-resistant-e2e-encryption-simple-migration.html
Esra'a Al Shafei has just joined SimpleX Chat team to help us deliver these goals - welcome!

2024-02-24 21:42:43 UTC

Updated "SimpleX Chat Privacy Policy and Conditions of Use"
The updated document: https://github.com/simplex-chat/simplex-chat/blob/stable/PRIVACY.md
The changes: https://github.com/simplex-chat/simplex-chat/pull/3796/files
TL;DR:
- it clarifies that we develop software for communication network, and not a communication service.
- it highlights the requirement of AGPLv3 license to publish any code modifications, and our commitment to run unmodified code.
Let us know any comments / questions!

2024-02-12 21:10:17 UTC

- reply

Would be good to look at the spec.

2024-02-12 19:30:40 UTC

- reply

@npub1gcx…nj5z Thanks for the suggestions. We did indeed consider various ideas about how to reduce the persistence queue ID, but the to rotate the queues to another server periodically seemed simpler and providing better metadata protection. The current approach also allows some basic protection from resource exhaustion attacks.
What I don't quite follow - if the same key A is used to retrieve the messages how it is any better than having queue ID from the perspective of correlating messages to the users? Wouldn't it still identify the user any better, and now instead of mapping IP addresses to queues, the server could map IP addresses to the messages... Maybe I don't understand what you propose?
The ideas we considered were about trying to avoid any persistent IDs entirely, e.g. via some kind of DHT tables, and something like this might happen in "v3" of the protocols (we are currently still moving to "v2").