Age encryption is open source. I suppose I could open source it as I am not looking to make sell anything with this service. I am mostly looking for feedback.
What would give you the peace of mind to use this with confidence? Considering that Signal, WhatApp, etc are all closed source tied with phone numbers requiring extra identifying info I put this together as an experiment.
I will start on releasing the code and build.
Good! This is a great way to get more feedback and potentially more users. I'd encourage you to make it easy for folks to self-host.
You can still maintain control and the ability to make it a paid service, even if you choose an AGPL license.
> Signal, WhatApp, etc are all closed source
False. Signal is open source. See https://news.ycombinator.com/item?id=38585458
Except a server-side anti-spam component, apparently? See https://en.wikipedia.org/wiki/Signal_(software)#Licensing
> tied with phone numbers
This is a valid concern about Signal and it comes up often. I believe any privacy risk around your phone number leaking or being tied to your activity on Signal is sufficiently mitigated by the folks who run the Signal servers (the Signal Foundation) since plaintext phone numbers are only used for initial SMS verification. They are then discarded, apparently. Contact discovery/matching is done on the device only with SHA256 hashes of phone numbers.
And now you can discover/connect with others via usernames that can be changed at any time and hide phone numbers altogether.
Hmm, but https://support.signal.org/hc/en-us/articles/360007061452-Do... disagrees with https://en.wikipedia.org/wiki/Signal_(software)#Contact_disc... ... that's not good.
Right now, if I was to go extra secure, my go to would be something built on the matrix protocol. I would probably spin up my own synapse node for total control. But I am a programmer, technophile, and FOSS nerd, so I may not be your target audience.
That being said, I think I’d have confidence if I could see the code and a signed build with some way to verify that the code I see published by you is in fact the code on my device.