Signal Contingency Plan (spoiler: it's Delta Chat)

If the vibes keep on deteriorating and there would be a crackdown on messengers and signaling infrastructure a messenger is the last of your worries.

And if Signal gets specifically targeted, there will be warning signs and time to shift away.

OpenPGP for encryption through autocrypt is a BIG NO for me. OpenPGP is inherently flawed, read any reasonable cryptographer's opinions on it. DeltaChat is a significant security downgrade from Signal. I would much rather use SimpleX or Briar.

If you're in a country that is shutting down servers, then your contingency plan should involve serverless p2p apps like Quiet or Keet.

The reticulum project with the Sideband client is probably a lot more censorship resistant than DeltaChat or Meshtastic.

https://eylenburg.github.io/im_comparison.htm

Falling back to email isn't a most preferred backup, I'd rather do simplex

If Signal gets blocked, why not use a Signal Proxy?

matrix.org is my new favorite

You can move to any other service, but once it becomes popular enough to draw attention they might also get blocked as well. If it's centralized, then the central servers can be blocked and it's not longer working. If it's decentralized and peer to peer, then the bootstrap nodes can be blocked and it's no longer working.

Even if it's self hosted and not advertised, the adversary can run active probes to detect banned services and block it if it detects any.

The only thing that can work reliably is something that can be concealed and can't easily be detected.

A simple HTTPS website that runs a small blog, forum or an image board, can have a lot of bot traffic, and human traffic that makes the traffic analysis hard, it also provides plausible deniability if someone asks why you visit that site often, you can say that you are playing games or browse images there. Such website can have a secret interface that can be used as an interaction point for secure chatting (in a store and forward manner), which responds only if the requests are cryptographically signed by the participants, otherwise the server can play dumb and show a 404 error. Therefore an active prober can't easily detect that the website hosts that interface the first place, because they cannot produce a signed request unless they manage to compromise one of the participants.

Threat analysis:

• Obviously if the endpoints are compromised, all bets are off.
• The certificate authority (CA) that issued the certificate for the website can be compelled to issue certificates for man-in-the-middle (MITM) observation and then the MITM-er can detect the secret interface. But nowadays this is difficult to pull off due to certificate transparency (CT), TLS clients can be configured to not accept the cert if it's not logged by a CT provider, and domain owners can get an immediate alert if someone else issues a fraudulent and logged cert for their domains.

Someone should make an app that works this way. Only one tech savvy person of the given group need to set this up (preferably someone who alredy have a website), then others in the group can be invited into it and can use it without much friction.

Good idea. (Also "server not found" on your link.) Here for the info. Please mention if these methods allow for video and voice calls.

take a look at Jami.

Does Signal host its user's data?

Not sure why privacy-conscious people would be recommending it over something like Matrix. Unless they're paid off or stupid.