Session (software)

Last updated

Session
Developer(s) The Oxen Project
Initial releaseFebruary 2020;4 years ago (2020-02)
Stable release(s)
Android1.17.5 / January 12, 2024;57 days ago (2024-01-12) [1]
iOS2.4.4 / December 19, 2023;2 months ago (2023-12-19) [2]
Repository github.com/oxen-io/session-android/
Operating system
Type Instant messaging
License BSD-3-Clause
MIT
GPL-3.0
Website getsession.org

Session is a cross-platform end-to-end encrypted instant messaging application emphasizing user confidentiality and anonymity. Developed by The Oxen Project under the non-profit Oxen Privacy Tech Foundation, it employs a blockchain-based decentralized network for transmission. Users can send one-to-one and group messages, including various media types such as files, voice notes, images, and videos. [3]

Contents

Session provides applications for various platforms, such as macOS, Windows, and Linux, along with mobile clients available on both iOS and Android.

Features

Session does not require a telephone number or email address for account creation. Instead, it utilizes a randomly generated 66-digit alphanumeric number for user identification. Communication between users, including messages, voice clips, photos, and files, is end-to-end encrypted using the Session protocol. Session uses the Loki blockchain network for transmissions. In 2021, an independent review by the third-party Quarkslab verified these claims. [4] [5] [6] [7]

Development

Session started as a fork of another messenger, Signal, aiming to build upon its foundation. However, concerns about the centralized structure of Signal Protocol and potential metadata collection led the team to deviate and create their own protocol, called "Session Protocol". This approach prioritized increased anonymity and decentralization. During development, the team encountered various challenges, leading to the necessity of abandoning or modifying many features. [6] [8]

Limitations

Session lacks support for two-factor authentication, and its underlying protocols are still in a developmental phase. Following the migration from the Signal Protocol to its internally developed protocol, forward secrecy and deniable authentication were not implemented. [9]

Related Research Articles

The landscape for instant messaging involves cross-platform instant messaging clients that can handle one or multiple protocols. Clients that use the same protocol can typically federate and talk to one another. The following table compares general and technical information for cross-platform instant messaging clients in active development, each of which have their own article that provide further information.

Off-the-record Messaging (OTR) is a cryptographic protocol that provides encryption for instant messaging conversations. OTR uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides forward secrecy and malleable encryption.

This is a comparison of voice over IP (VoIP) software used to conduct telephone-like voice conversations across Internet Protocol (IP) based networks. For residential markets, voice over IP phone service is often cheaper than traditional public switched telephone network (PSTN) service and can remove geographic restrictions to telephone numbers, e.g., have a PSTN phone number in a New York area code ring in Tokyo.

<span class="mw-page-title-main">Moxie Marlinspike</span> American entrepreneur

Moxie Marlinspike is an American entrepreneur, cryptographer, and computer security researcher. Marlinspike is the creator of Signal, co-founder of the Signal Technology Foundation, and served as the first CEO of Signal Messenger LLC. He is also a co-author of the Signal Protocol encryption used by Signal, WhatsApp, Google Messages, Facebook Messenger, and Skype.

<span class="mw-page-title-main">Bitmessage</span> Peer-to-peer encrypted communication protocol

Bitmessage is a decentralized, encrypted, peer-to-peer, trustless communications protocol that can be used by one person to send encrypted messages to another person, or to multiple subscribers.

Wickr is an American software company based in New York City, known for its instant messenger application of the same name. The Wickr instant messaging apps allow users to exchange end-to-end encrypted and content-expiring messages, and are designed for iOS, Android, Mac, Windows, and Linux operating systems. Wickr was acquired by Amazon Web Services (AWS) mid-2021 and shut down the free version of the app in December 2023.

<span class="mw-page-title-main">Telegram (software)</span> Cross-platform encrypted instant messaging service

Telegram Messenger, commonly known as Telegram, is a cloud-based, cross-platform, encrypted instant messaging (IM) service. It was originally launched for iOS on 14 August 2013 and Android in October 2013. It allows users to exchange messages, share media and files, and hold private and group voice or video calls as well as public livestreams. It is available for Android, iOS, Windows, macOS, Linux, and web browsers. Telegram also offers end-to-end encryption in voice and video calls, and in optional private chats, which Telegram calls Secret Chats.

<span class="mw-page-title-main">ChatSecure</span> Messaging application

ChatSecure is a messaging application for iOS which allows OTR and OMEMO encryption for the XMPP protocol. ChatSecure is free and open source software available under the GPL-3.0-or-later license.

<span class="mw-page-title-main">Twister (software)</span> Blog software

Twister is a decentralized, experimental peer-to-peer microblogging program which uses end-to-end encryption to safeguard communications. Based on BitTorrent- and Bitcoin-like protocols, it has been likened to a distributed version of Twitter.

TextSecure was an encrypted messaging application for Android that was developed from 2010 to 2015. It was a predecessor to Signal and the first application to use the Signal Protocol, which has since been implemented into WhatsApp and other applications. TextSecure used end-to-end encryption to secure the transmission of text messages, group messages, attachments and media messages to other TextSecure users.

<span class="mw-page-title-main">Open Whisper Systems</span> Open source software organization

Open Whisper Systems was a software development group that was founded by Moxie Marlinspike in 2013. The group picked up the open source development of TextSecure and RedPhone, and was later responsible for starting the development of the Signal Protocol and the Signal messaging app. In 2018, Signal Messenger was incorporated as an LLC by Moxie Marlinspike and Brian Acton and then rolled under the independent 501c3 non-profit Signal Technology Foundation. Today, the Signal app is developed by Signal Messenger LLC, which is funded by the Signal Technology Foundation.

Threema is a paid cross-platform encrypted instant messaging app developed by Threema GmbH in Switzerland and launched in 2012. The service operates on a decentralized architecture and offers end-to-end encryption. Users can make voice and video calls, send photos, files, and voice notes, share locations, and make groups. Unlike many other popular secure messaging apps, Threema does not require phone numbers or email address for registration, only a one-time purchase that can be paid via an app store or anonymously with Bitcoin or cash.

Wire Swiss GmbH is a software company with headquarters in Zug, Switzerland. Its development center is in Berlin, Germany. The company is best known for its messaging application called Wire.

<span class="mw-page-title-main">Signal (messaging app)</span> Privacy-focused encrypted messaging app

Signal is an encrypted messaging service for instant messaging, voice, and video calls. The instant messaging function includes sending text, voice notes, images, videos, and other files. Communication may be one-to-one between users or may involve group messaging.

<span class="mw-page-title-main">Matrix (protocol)</span> Networking protocol for real-time communication and data synchronization

Matrix is an open standard and communication protocol for real-time communication. It aims to make real-time communication work seamlessly between different service providers, in the way that standard Simple Mail Transfer Protocol email currently does for store-and-forward email service, by allowing users with accounts at one communications service provider to communicate with users of a different service provider via online chat, voice over IP, and videotelephony. It therefore serves a similar purpose to protocols like XMPP, but is not based on any existing communication protocol.

In cryptography, the Double Ratchet Algorithm is a key management algorithm that was developed by Trevor Perrin and Moxie Marlinspike in 2013. It can be used as part of a cryptographic protocol to provide end-to-end encryption for instant messaging. After an initial key exchange it manages the ongoing renewal and maintenance of short-lived session keys. It combines a cryptographic so-called "ratchet" based on the Diffie–Hellman key exchange (DH) and a ratchet based on a key derivation function (KDF), such as a hash function, and is therefore called a double ratchet.

The Signal Protocol is a non-federated cryptographic protocol that provides end-to-end encryption for voice and instant messaging conversations. The protocol was developed by Open Whisper Systems in 2013 and was first introduced in the open-source TextSecure app, which later became Signal. Several closed-source applications have implemented the protocol, such as WhatsApp, which is said to encrypt the conversations of "more than a billion people worldwide" or Google who provides end-to-end encryption by default to all RCS-based conversations between users of their Google Messages app for one-to-one conversations. Facebook Messenger also say they offer the protocol for optional Secret Conversations, as does Skype for its Private Conversations.

Wire is an encrypted communication and collaboration app created by Wire Swiss. It is available for iOS, Android, Windows, macOS, Linux, and web browsers such as Firefox. Wire offers a collaboration suite featuring messenger, voice calls, video calls, conference calls, file-sharing, and external collaboration – all protected by a secure end-to-end-encryption. Wire offers three solutions built on its security technology: Wire Pro – which offers Wire's collaboration feature for businesses, Wire Enterprise – includes Wire Pro capabilities with added features for large-scale or regulated organizations, and Wire Red – the on-demand crisis collaboration suite. They also offer Wire Personal, which is a secure messaging app for personal use.

<span class="mw-page-title-main">Conversations (software)</span> Free software instant messaging client for the XMPP protocol

Conversations is a free software, instant messaging client application software for Android. It is largely based on recognized open standards such as the Extensible Messaging and Presence Protocol (XMPP) and Transport Layer Security (TLS).

xx messenger is a cross-platform decentralized encrypted instant messaging service developed by PrivaTegrity Corporation. Messages are delivered over a variety of mix network first described in 2016. Users can send one-to-one and group messages, which can include voice notes and images.

References

  1. "Private Messenger APKs for Android". APKMirror. April 8, 2021. Archived from the original on October 19, 2023. Retrieved December 7, 2023.
  2. "Private Messenger". Softonic. October 31, 2023. Retrieved December 7, 2023.
  3. Bhattacharjee, Shomik Sen (October 8, 2021). "Session Is a Blockchain-Based Private Messenger That Uses Decentralised Server Nodes To Ensure Anonymity". Gadgets 360. Archived from the original on June 18, 2023. Retrieved June 18, 2023.
  4. Ankush, Das (February 10, 2022). "8 Reasons to Try Session as a Private Messaging App". MakeUseOf. Archived from the original on October 31, 2022. Retrieved December 8, 2022.
  5. "New WhatsApp Alternative "Session" Works Without Your Phone Number". Fossbytes. March 9, 2020. Archived from the original on May 31, 2023. Retrieved July 31, 2023.{{cite web}}: CS1 maint: bot: original URL status unknown (link)
  6. 1 2 "Session Messenger Review – Best Secure Messaging App?". RestorePrivacy. Archived from the original on October 10, 2021. Retrieved October 11, 2021.
  7. Oxen Session Audit Technical Report (PDF). Quarkslab SAS. 2021. Archived (PDF) from the original on October 23, 2021. Retrieved October 11, 2021.
  8. Florence, Eric (January 6, 2022). "Session Messenger Review". SecurityTech. Archived from the original on August 1, 2023. Retrieved August 3, 2023.
  9. "The Session Protocol: What's changing — and why - Session Private Messenger". Session. December 16, 2020. Archived from the original on June 4, 2023. Retrieved August 10, 2023.