Every month we write about a messenger app, but this months it's more then just the usual 'secure or not' and it's not just about a messenger. It's about Nextcloud Talk. Which is fully integrated into the whole Nextcloud setup. Personally, I am a very big fan of Nextcloud, but not only for the talk app, but for the overall benefits of a self hosted cloud.
Privacy Advocate
Company
Nextcloud GmbH is the German based publisher of the Nextcloud software. It was established in 2016 by the development team from ownCloud, Nextcloud is, basically, an open-source fork from that project.
One might think at this point that we should be talking about the fact that Germany is one of the so-called '14 eyes countries', the international security collective, and how that could compromise the safety of your data, however, since Nextcloud doesn’t actually host any of your data nor even sell you the software, this allays any concerns we might have had here.
We will devote an entire article to our upcoming 'Nextcloud for readers' release, which we'll be giving away to some of our readers in the near future. Today, however, it is all about Nextcloud Talk, the messenger that makes screensharing, online meetings and web conferencing easy and leak-free...but is it really as secure as advertised?
Specifications
Let's start with a look at the specs:
- FOSS (Free Open Source Software)
- Self-hosted with the option of third party hosting
- Supports 2FA
- HIPAA GDPR and CCPA compliant
- Optional 3rd party integration
- Great Nextcloud Hub for team collaboration
- Federated connection to connect with other nextcloud servers, however not for Talk what is hopefully on the roadmap.
- Encrypted, peer-to-peer audio and video calls
- WebRTC for cross-platform support
- Easy screen sharing
- Easy File sharing
- Offline support Nextcloud Talk 9.0.0 upwards
- Optional at rest encryption using AES-256
- Optional end-to-end encryption with AES-128-GCM (not yet fully implemented)
- Integrated Personal Information Management (calendar, contacts, notes, tasks)
- Media streaming
- Synchronizes across all your devices and browsers
Encryption
Every user gets a unique public/private key combination when they first enable end-to-end encryption. The public key is sent to the server and signed into a certificate. The certificate is checked by the users' other clients and used by other users to share encrypted files with the first user, based on Trust On First Use.
You can read more here: https://nextcloud.com/endtoend/
Note: this for the entire Nextcloud not just for Talk!
E2EE (end-to-end-encryption) is not fully production ready! Audio/Video chat with WebRTC and applies to peer-2-peer calls, so larger conference calls are not encrypted!
This is sadly an issue with WebRTC and also affects Jitsi Meet so not just a problem on Nextcloud conference calls.
Nextcloud employs industry-standard TLS to encrypt data in transfer.
Client side encryption
End-to-end Encryption client-side is available from Nextcloud 13 and newer as a folder-level option to keep extremely sensitive data fully secure even in the event of a full server breach. The server facilitates key exchange for syncing between devices and sharing but has Zero Knowledge, that is, never has access to any of the data or keys in unencrypted form.
I am a f-droid user and don't use Google cloud services for push, and that brings me to the first big minus on Nextcloud Talk. They only offer an out of date f-droid version which has no push support. You need to open the app to get messages, you don't new messages have arrived as all relies on Google's Firebase Cloud Messaging (FCM). That is sad and could be fixed so easily with a polling every 5, 10 or 15 minutes (similar to how Threema does it).
The Talk version on android also makes it impossible to send pictures from your local folders, however, you can send and share from your Nextcloud. For a day to day messenger this is sub optimal, I hope this will be addressed in a future version.
The Play Store version equal to or newer than 1.5.0 for Nextcloud supports push notifications which use the Google servers. However Google does not have access to the actual notification data. Only a header with a subject is sent via Google, but in encrypted form, and the rest of the content is retrieved directly from your Nextcloud server and not sent through Google. The iOS client works in a similar way.
As I've already mentioned Nextcloud is very complex and, potentially, your perfect cloud replacement for say, iCloud or (of course) Google. It works flawlessly and is open-source, the talk option on mobile is sadly not there yet for me to use with the team, well, at least not on mobile. However, the browser version of Talk! is a pretty good option, at least as long as it's p2p and therefore fully encrypted.
A great feature is that the moderators are able to turn off microphones of participants and have the ability to limit created conversations to a specific group. The biggest plus is that you own your data, as long you self-host Nextcloud. You can share files from one Nextcloud to someone elses', but again that doesn't count for the Nextcloud Talk.
The team at decentralize.today loves Nextcloud in its entirety, but Nextcloud Talk is not yet there for us. That said, if you use iOS or Google services then give it a try, because if you host your own Nextcloud it would be a natural thing to do.
Next month, in a similar vein, I will be looking at another decentralized social media offer that incorporates a messenger...Movim...intrigued? You should be...more next month!
Stay safe, stay secure!
