OII Milestone One: Initial tools and tool-selection criteria

The Open Integrity Initiative (OII) will soon begin developing profiles on five tools. We propose the following asynchronous mobile messaging platforms for this milestone:

• The stock Android Messenger SMS/MMS client (source)
• Skype for Android (source: N/A)
• Whatsapp for Android (source: N/A)
• Signal for Android (source)
• Chat Secure / Conversations for Android (source) (About the Chat Secure Conversations plans)

We have selected these tools in order to:

• Focus on a particular class of application (asynchronous mobile messengers)
• Improve the likelihood of meaningful one-to-one comparisons
• Focus on well known or widely deployed software
• Share data on at least half of our tools with the Eff's Secure Messaging Scorecard
• Maximize diversity within the critiera enumerated below

Tool selection criteria

In addition to the conditions described above, we considered the the following three means of classification when selecting tools for Milestone One. (It bears clarifying that this set of criteria is entirely separate from — albeit likely to overlap with — the actual metrics used by the OII to evaluate the adoption of digital security best practices among the developers of these and other tools.)

The tables below include possible tools for Milestone Two or later that would expand the messenger family to encompass:

• Desktop applications
• Synchronous messengers
• Non-end-to-end encrypted messengers
• OpenPGP

Sourcecode transparency

For our initial set of tools, we would like to cover a cross-section of approaches to license freedom and sourcecode transparency. At the moment, we are looking at an openness continuum along the lines of the following:

Encryption protocol

For Milestone One, we will focus on the security properties of these tools' messaging and attachment features. The OII profiles on these tools will consider more granular metrics — end-to-end encryption, authentication mechanisms, forward secrecy, etc. — but a high level protocol breakdown should be sufficient for the tool-selection criteria itself.

Back-end hosting and federation

It is challenging to find a cross-section within this criterion. There are very few asynchronous mobile messengers that support self-hosting and federation. And, even with an expanded family of messenging tools (including email, desktop tools, and OTR clients), there is a clear divide between platforms with a centralized back-end and those that are both self-hostable and federated.

Possible future tools

Should we decide to expand this family of tools in subsequent Milestones, likely additions to the list might include:

• Signal Desktop for Chrome
• Gajim (and OMEMO plugin) for Linux
• ChatSecure for Android
• Tor-messenger for Linux
• WhatsApp for Android
• k9/OpenKeychain for Android
• Thunderbird/GnuPGP for Linux
• SMSSecure for Android
• Viber for Android
• iMessage for iOS
• Google Hangouts for Chrome