[clug] TextSecure, GPLv3 encrypted chat for Android

[Chris Smart]

I know that a few CLUG members already use this, but it seems good
software so I thought I'd mention it in case others aren't aware.

TextSecure is a free software, OTR based chat program[1] that uses
end-to-end encryption (Curve25519, AES-256, HMAC-SHA256) with perfect
forward secrecy. It's available on Android[2] and also on iOS (called
Signal).

Originally it supported encryption of SMS as well as chat, however this
has recently been removed[2] (unencrypted SMS support remains though).

For chat, registration is required. This sends a hash of your phone
number to the WhisperPush server (although in theory you could run your
own). Your contact list details are also hashed, this way the client
running on your phone can know who is running TextSecure without leaking
your contact list.

Previously, the Android version required Google Play Services for push
notifications,[3] however they recently added WebSockets support and now
handle that themselves. Unfortunately, Google Play Services is still
used for wake up events.

I compiled an older version from source a while back and it ran just
fine in SMS only mode on a phone without Google Apps installed. I
haven't checked how the new version would run with chat on such a phone.

They are also working on a cross-platform browser client[4].

WhisperSystems also provides a GPLv3 end-to-end encrypted SIP client
(using ZRTP), called RedPhone[5] (bundled with Signal on iOS).

[1] https://github.com/WhisperSystems/TextSecure/
[2]
<https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms&hl=en>
[3] https://whispersystems.org/blog/goodbye-encrypted-sms/
[4]
<http://support.whispersystems.org/customer/portal/articles/1476204-why-do-i-need-google-play-installed-to-use-textsecure-on-android->
[5] https://github.com/WhisperSystems/TextSecure-Browser
[6] https://github.com/WhisperSystems/RedPhone