🆕 Software Suggestion | Session (ex-Loki Messenger)

[lrq3000]

Basic Information

Name: Session (ex-Loki Messenger)
Category: Encrypted Instant Messengers - Decentralized
URL: https://getsession.org/
Platforms: Desktop (Mac, Linux, Windows), Android, iOS

Description

Session (new name of the Loki Messenger) is an anonymous text messenger initially forked from the Signal messenger but completely reworked 3-hops onion routing protocol on top of asymmetrically encrypted messages to anonymize all interactions. E2EE is always enabled and only lokinet users can be contacted through the app. Supports 1-on-1, private groups and public rooms text chats. No phone number nor any private information is required to register. App is cross-platform, available on Windows, Linux, Android, iOS. All open-source, including clients.

In the future, Session will migrate to the Lokinet network (ex LOKI blockchain), a blockchain initially forked from Monero which works over a LLARP (Low Latency Anonymous Routing Protocol) onion routing layer using faster UDP packets, that will allow voice calls. Indeed, Session currently only supports text messages for now due to using a TCP onion routing, but voice calls and maybe video are planned for later after migration to Lokinet (but no exact date planned)). It seems the blockchain is already online since years, but it's still in beta due to the LLARP protocol being tested out, whereas the blockchain technology used is relatively well established, the LLARP protocol is new and needs to be ironed out.

Why I am making the suggestion

Seems like a concurrent to BCM #1662, but it is entirely opensource (here for the messenger). The LLARP onion routing protocol is explained here and compared succinctly to TOR and I2P here (TL;DR: the goal is to retain the strong anonymity and security guarantees of both networks but with faster speed and easier network management - I can't describe more precisely as I am no expert). The messenger (Session) is discussed here. Blokt and SecureChatGuide reviewed it last year under beta (it still is but seems to be soon reaching the first stable release).

I think the messenger is the most directly useful part of the project right now, and hence the focus of this ticket, but the LOKI/LLARP network could also be added as an entry in Self-contained Networks (as suggested before #924) if someone with more expertise than me can understand the provided docs.

/EDIT: a technical preprint is available since 11/02/2020: https://arxiv.org/abs/2002.04609

/EDIT: Session's code was independently audited in April 2021: https://getsession.org/session-code-audit/

My connection with the software

No link, I am just interested in privacy protecting networks.

•  I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

[lrq3000]

Mmmm Maybe this ticket should be put on hold until the final release comes out, here is the introductory message when installing the software:

Thanks for testing Loki Messenger! This software is a beta version of the full Loki Messenger software suite, and so is missing some of the features the full version will have.
This version of Loki Messenger provides no guarantees of metadata privacy.
While your messages are secured using end to end encryption, in this beta version of Loki messenger, third parties (like your ISP or the Service Node network) can see who you’re talking to and when you’re sending or receiving messages.
It is also possible that third parties could correlate your public key to your IP address and your real identity if they learn your public key.
However, no one except you and your intended recipients will be able to see the contents of your messages. We recommend using existing methods, like Tor or I2P to mask your IP address while using Loki Messenger beta version.
As a beta, this software is still experimental. When things aren't working for you, or you feel confused by the app, please let us know by filing an issue on Github or making suggestions on Discord.

At least, it looks like they take security very seriously. Up to you guys to see whether you want to add the entry with a warning, or wait for the final release to fix these issues.

[KeeJef]

Hey, I'm the CTO on the Loki/Session project, just to confirm, yes we will be launching Session in a few days on Desktop, iOS and Android, so probably best to hold off until then for research/review.

[lrq3000]

@KeeJef that's great news to hear! Can't wait to test the stable release with all the anonymity features implemented :-)

[wuniversales]

My God, what an amazing application.
Thank you

[wuniversales]

New website: https://getsession.org/

[ian-tedesco]

Hey, I'm the CTO on the Loki/Session project, just to confirm, yes we will be launching Session in a few days on Desktop, iOS and Android, so probably best to hold off until then for research/review.

When exactly are you launching? Great project!

[lrq3000]

The app is already available, I have used it before posting this issue, but some important features were missing such as group chat, but on the new website it's written this is now possible, so i guess that's what was meant, the deployment of the new release with these important group features and security updates? Le lun. 10 févr. 2020 à 16:10, 5a384507-18ce-417c-bb55-d4dfcc8883fe < notifications@github.com> a écrit :

…

Hey, I'm the CTO on the Loki/Session project, just to confirm, yes we will be launching Session in a few days on Desktop, iOS and Android, so probably best to hold off until then for research/review. When exactly are you launching? Great project! — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://github.com/privacytoolsIO/privacytools.io/issues/1678?email_source=notifications&email_token=AAIRFXTMMKI6EJ6MOAU6ZSTRCFU77A5CNFSM4KOP2STKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELI3M7Y#issuecomment-584169087>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIRFXQYIG4FVLNCNXFIIMDRCFU77ANCNFSM4KOP2STA> .

[ian-tedesco]

The app is already available, I have used it before posting this issue, but some important features were missing such as group chat, but on the new website it's written this is now possible, so i guess that's what was meant, the deployment of the new release with these important group features and security updates? Le lun. 10 févr. 2020 à 16:10, 5a384507-18ce-417c-bb55-d4dfcc8883fe < notifications@github.com> a écrit :
…
Hey, I'm the CTO on the Loki/Session project, just to confirm, yes we will be launching Session in a few days on Desktop, iOS and Android, so probably best to hold off until then for research/review. When exactly are you launching? Great project! — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1678?email_source=notifications&email_token=AAIRFXTMMKI6EJ6MOAU6ZSTRCFU77A5CNFSM4KOP2STKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELI3M7Y#issuecomment-584169087>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAIRFXQYIG4FVLNCNXFIIMDRCFU77ANCNFSM4KOP2STA .

Yes, I meant the new features and security updates. I gave it a look on the desktop client but couldn't find a way of installing it on mobile without using Google Play store, do you know if the .apk is available somewhere?

[KeeJef]

Hey, I'm the CTO on the Loki/Session project, just to confirm, yes we will be launching Session in a few days on Desktop, iOS and Android, so probably best to hold off until then for research/review.

When exactly are you launching? Great project!

As mentioned above Session is now launched on all platforms at https://getsession.org , today we also published a whitepaper https://getsession.org/whitepaper which goes through the design in detail. We are still working through a number of issues discovered when we launched with Multi-device setups so that might not be working as expected if you encounter and edge case.