It’s quite an impressive little app. Under the hood, it’s an advanced XMPP client that has:
- Excellent text chats with file upload support, including solid optional encryption (OMEMO, based on Signal’s encryption but modified to be compatible with federation)
- Group voice/video calls with screensharing (must use a chromium based browser to screenshare an app’s audio at the moment)
- A neat integrated blogging feature for communities & individuals
- a fun built-in paint program to draw stuff into the chat
- Full working and proven federation thanks to the XMPP back-end, which allows it to scale up reliably and easily self-host (XMPP is very lightweight).
- Uses the AGPL license, ensuring that cropos won’t be able to take it over. It’ll be community-owned forever.
In message-mode, it looks fairly similar to Discord:
If you’re curious if it’d work as a Discord replacement, it’s still missing Discord-like servers with collections of rooms in them, as well as drop-in voice rooms. However, the developer is actively working on implementing those features, with the server w/rooms part likely to be implemented within the next few weeks. They already posted what it looks like in the development branch:
To stay updated on its progress, the !xmpp@slrpnk.net community pretty reliably posts news about it.
Is it using the latest OMEMO or sticking with outdated and insecure versions?
I can’t really find anywhere that clarifies what version of OMEMO that Movim is currently using, but if I had to guess it would be 0.3.0.
However, I want to point out that the creator of that linked blog actually removed a response in the comments from an OMEMO developer which clarified some things (you can it read here), which personally I think was rather odd/bad faith of them to do.
According to that response, there’s nothing really wrong with OMEMO 0.3.0, as the OMEMO developer considers it a stable standard that clients can safely implement, and the newer versions basically being public beta releases toward a stable ‘OMEMO 2’ standard that can eventually replace 0.3.0.
I also think the blog author’s argument should be put into perspective; from most security expert’s POV (including the blog author linked), any app that allows encryption to be disabled is considered flawed or insecure compared to the gold standard of always on E2EE. This would rule out Matrix, XMPP, and certainly any other Discord replacement like Fluxer or Stoat (which offer no encryption). Ultimately only Signal, Deltachat or similar app would be the only options a security expert could recommend, as those experts are prioritizing security above all, regardless of use-case, needs, or practical threat level.
Signal is centralized and requires a phone number (deal-breaker for me), where as Deltachat is decentralized and does not. Deltachat is a fantastic messenger, but it is only a good replacement for Signal, not Discord. Nor are any of the other ‘encrypted by default with no option to disable’ messengers.
If we contrast Movim with optional OMEMO against Discord (which is not only entirely unencrypted, but also actively working with authorities and spying on you); Movim is a monumental improvement while still (eventually) providing Discord-like features. No other possible Discord replacement comes close besides Matrix (which has its own problems, more than XMPP I would say).
I would suggest that for the average user, XMPP with OMEMO 0.3.0 is pretty darn good. It’ll certainly provide very good privacy for encrypted DMs to your friends or groups where it’s enabled, and no nosy server owner or relay server will be able to read or decrypt them.
For people where security is absolutely paramount, and they believe they may be specifically targeted by a state actor, then they should probably stick with an E2EE always-enabled platform like Deltachat.
But for most, who likely isn’t even using a VPN, or Tor, or may even still be using Windows or a non-grapheneOS phone? XMPP with OMEMO 0.3.0 is going to more than suffice.
And as time goes on, that new ‘OMEMO 2’ will become stable, and the clients can then migrate to that. But it’s already the best privacy respecting Discord alternative we’ve got (IMO), and it’ll likely only get better :)
Thanks for such an excellent and well thought out comment. We’ll definitely read those links!
No prob ^^
This is FUD (and I am getting really tired of this half-assed blog post being shared everywhere). The older OMEMO version used is not insecure. The newer version is better, yes, but it is an enhancement in regards to metadata protection, the core e2ee of the message body is unchanged and secure in both versions.