Threema is a paid cross-platform encrypted instant messaging app developed by Threema GmbH in Switzerland and launched in 2012. Users can make voice and video calls, send photos, files, and voice notes, share locations, and join groups. The service offers end-to-end encryption. Unlike many other popular secure messaging apps, Threema does not require phone numbers or email addresses for registration, only a one-time purchase that can be paid via an app store or anonymously with Bitcoin or cash. Threema is available on Android and iOS, and has clients for HarmonyOS, Linux, macOS and Windows. It can be accessed via web browser but requires a mobile app to function.
Features The service claims to be based on the privacy by design principles by not requiring a phone number or other personally identifiable information. This helps anonymize the users to a degree. Threema uses a randomly generated user ID, created after the initial app launch, instead of requiring a linked email address or phone number to send messages. It is possible to find other users by phone number or email address, if the user allows the app to synchronize their address book. Linking a phone number or email address to a Threema ID is optional. Hence, the service can be used anonymously. Users can verify the identity of their Threema contacts by scanning their QR code when they meet in person. The QR code contains the public key of the user, which is cryptographically tied to the ID and will not change during the lifetime of the identity. Using this strong authentication feature, users can make sure they have the correct public key from their chat partners, which provides additional security against a man-in-the-middle attack. Threema classifies contacts according to three verification trust levels. The verification level of each contact is displayed in the Threema application as dots next to the corresponding contact. In addition to text messaging, users can make voice and video calls, share locations, voice messages, and send media or other files. A web app, Threema Web, can be used on desktop devices, but only as long as the phone with the Threema installation of the user is online. There is a beta for iOS users, which allows for the phone to be offline while using a desktop app. In addition to one-to-one chats, Threema offers group chats with up to 256 people. Files are limited to 50MB per file. It is also possible to create polls in personal or group chats. To emulate the 'Saved Messages' feature available in other messengers, one can create a group with only oneself as a member. For licensing and privacy reasons, Threema does not include a GIF library natively, but it is compatible with GIF keyboards and plays animations seamlessly in the chat.
Software Threema is developed by the Swiss company Threema GmbH. The servers are in Switzerland and the development is based in Pfäffikon SZ. As of May 2021, Threema had 10 million users and the business version, Threema Work, was used by 2 million users across 5,000 companies and organizations. At the end of July, 2021 Threema introduced the ability for companies to host the messenger on their own server, primarily intended for companies with significantly high privacy concerns.
Clients With Threema Web, a client for web browsers, Threema can be used from other devices like desktop computers, though only as long as the original device is online. Threema optionally supports Android Wear smartwatch and Android Auto. Threema launched support for end-to-end encrypted video calls on August 10, 2020. The calls are person-to-person with group calls unavailable. The application does not allow the self-deletion of messages after a period defined by the interlocutors. The application does prevent screenshots in conversations when configured to do so.
Architecture The entire communication via Threema is end-to-end encrypted. During the initial setup, the application generates a key pair and sends the public key to the server while keeping the private key on the user's device. The application then encrypts all messages and files that are sent to other Threema users with their respective public keys. Once a message is delivered successfully, it is immediately deleted from the servers. The encryption process used by Threema is based on the open-source library NaCl library. Threema uses asymmetric ECC-based encryption, with 256-bit strength. Threema offers a "Validation Logging" feature that makes it possible to confirm that messages are end-to-end encrypted using the NaCl Networking and Cryptography library. In August 2015, Threema was subjected to an external security audit. Researchers from cnlab confirmed that Threema allows secure end-to-end encryption, and claimed that they were unable to identify any weaknesses in the implementation. Cnlab researchers also confirmed that Threema provides anonymity to its users and handles contacts and other user data as advertised.
… excerpt ends here. Continue reading the full article.
