Signal is generally considered the most secure of the secure messaging services. End-to-end encrypted (a.k.a. E2E encrypted or E2EE) and capturing almost no metadata, Signal has been about as secure and private as it is possible to get.
But there is a new kid on the block, named Session. The Session messenger is a fork of Signal, designed to be even more secure than Signal. In this Session review, we will test out and examine the service. We’ll go over what it is that makes Session different from Signal, and whether or not Session is likely to be more secure and private than its cousin, Signal.
Session messenger basics
Behind the scenes, Session is fundamentally different than most other secure messaging services. To make the rest of this Session review easier to understand, we need to go over some basics now.
Conversations in Session are secured using client-side E2E encryption. Only the sender and the recipient of a message can read it. But Session goes beyond providing message security. Session also protects the identities of its users. It makes your communications private and anonymous, as well as secure.
Session can do this because it connects users through a Tor-like network of thousands of Service Nodes. Service Nodes are servers that pass messages back and forth through the network as well as provide additional services. The onion request system that Session uses to protect messages ensures that no Service Node in the network ever knows both a message’s origin (your IP address) and destination (the recipient’s IP address).
Session takes a number of additional steps to protect your identity:
- No phone number is required for registration (unlike with Signal)
- No email is required for registration (unlike with Wire)
- No geolocation data, device data, or metadata is collected
The Service Nodes are grouped together into swarms. Swarms provide redundancy to the network as well as temporary storage when messages cannot be delivered to their destination. Each Session client connects to a swarm to send and receive messages in real time, as well as to retrieve relevant messages that are stored in the swarm awaiting delivery.
You’ll notice that we haven’t talked about any kind of central server here. The Session network is decentralized, with no single point of failure, and no main server for bad guys to hack. The Session service should prove to be very resilient, and continue functioning even as individual Service Nodes join or leave the network.
Note: Session launched using proxy routing instead of onion requests to secure messaging traffic. Proxy routing offers high levels of privacy, security, and anonymity, but onion requests are better. As of the date of this review, the Session team was in the process of transitioning to onion requests.
And with that background information, we’re now ready to talk intelligently about Session.
Session pros & cons
+ Pros
- End-to-end (E2E) encryption secures text and voice messages as well as attachments
- Encryption algorithms: Signal protocol, with Perfect Forward Secrecy (PFS)
- Does not require telephone number or email address to sign up
- Open source
- Log in simultaneously with multiple devices
- Does not log IP Addresses or metadata
- Encrypted closed groups (max of 10 people) and open groups (no limit to size)
– Cons
- Does not support 2FA (two factor authentication)
- Very new with onion routing protocol still under development
- Can be buggy and unreliable
Now we’ll examine the key features of Session messenger.
Session feature summary
Here are features you’ll want to consider when evaluating Session:
- It uses the excellent Signal encryption protocol, on top of a distributed, anonymous, worldwide server network
- 100% open source code. (The code is available on GitHub.)
- Clients for Android, iOS, macOS, Windows, Linux
- The system is still under heavy development
Session company information
Session is a project of the Loki Foundation. The Loki Foundation is a registered charitable foundation based in Victoria, Australia. The foundation states that their purpose is to, “…build open-source, metadata-free communications tools and apps that defend privacy in the digital world.”
Where is your Session data stored?
Messages that are sent to you are actually sent to your swarm. The messages are temporarily stored on multiple Service Nodes within the swarm to provide redundancy. Once your device picks up the messages from the swarm, they are automatically deleted from the Service Nodes that were temporarily storing them.
Note that this is not the same as a peer-to-peer architecture. Per the Session FAQ,
Session clients do not act as nodes on the network, and do not relay or store messages for the network. Session’s network architecture is closer to a client-server model, where the Session application acts as the client and the Service Node swarm acts as the server.
Session’s client-server architecture allows for easier asynchronous messaging (messaging when one party is offline) and onion routing-based IP address obfuscation, relative to peer-to-peer network architectures.
Note: Session’s strong approach to not collecting metadata is a huge plus. I consider the metadata issue to be the Achilles heel of many secure email services. Even the most popular secure email services, such as ProtonMail, do not have a good solution to the metadata problem.
Third-party testing and audits of Session
Session is very new and is still rolling out its onion request system. As a result, they have not had any third-party testing or auditing done yet. According to the Session FAQ, that could change in the near future:
Session is in the process of arranging a full third-party code audit. This audit will provide independent verification around Session’s security, privacy and anonymity. Session is fully open-source, so if you’re interested and have the technical know-how, we encourage you to take a look at our codebase for your own peace of mind; however, we don’t recommend using Session in cases where proven and independently verified security is required.
Session hands-on testing
For this Session review, I installed the Android app, along with the Windows and Linux desktop clients.
Session Android app
I downloaded the Session Android app from the Google Play store. At that time the app had 406 reviews, and was rated 4.0 out of 5 stars (on the Apple App Store, Session Messenger had 59 reviews with a 4.4 out of 5 stars rating).
Launching Session highlighted one of the key differences between it and Signal: no need to enter a phone number or email address. Instead, Session gives you the opportunity to create an account by generating a Session ID, or of signing in to an existing account (by entering an existing Session ID).
A Session ID is a unique address people can use to contact you on Session. As Session explains, the reason using a Session ID is better than using a phone number of email address is, “Your Session ID is totally private, anonymous, and has no connection to your real identity.” Signal and other messaging apps that identify you with a phone number cannot give you this anonymity.
Once you create a Session ID, Session will ask you to pick your display name, and tell Session how to handle push notifications. And once that’s all done, Session will show you your Recovery Phrase and give you the opportunity to store it somewhere safe.
A Recovery Phrase is a string of words that you can enter to recover your account if you lose the Session ID, or change to a new device. To restore your Session ID, launch Session and tap Continue your Session. Session will give you the opportunity to enter your Recovery Phrase and get back to where you were when you last used that Session ID.
With all that out of the way, you are finally ready to start working with Session.
Working with Session
At first, Session will seem pretty dead. That’s because you still need to connect with people. While a service like Signal can scan your phone’s contact list looking for phone numbers that are registered as Signal users, Session needs you to tell it who to connect to. You do that by creating a New Session. A New Session is a chat session that you initiate by entering the Session ID of the person you want to chat with.
How do you know the Session ID of the person you want to chat with? You either get them to give it to you, or you scan a QR code that contains their Session ID. Unless you happen to be physically located in the same place, thereby able to pass the Session ID or display the QR code directly, one of you will need to share your Session ID to the other to get this thing started.
Once you enter someone’s Session ID, you can send them a message. Once they accept it, you can freely exchange messages like any other chat app.
Tapping the icon for a contact opens your ongoing chat session with that contact.
Beyond basic chatting, Session has a number of additional useful features. Here are some of them:
- Encrypted groups – Create small closed groups (10 people or less) or huge open groups (no size limit).
- Voice messages – Create and share encrypted voice messages.
- Attachments – Message attachments are encrypted too.
- Safety Numbers – Verify that you are communicating with the device you expect to be talking to by comparing safety numbers.
Session Desktop clients
I installed the Session Desktop client on both Windows and Linux machines.
Session Windows Desktop
Downloading and installing the Sessions Windows Desktop client used the standard “install a Windows app” process.
Session Linux Desktop
The Session Linux Desktop comes as an AppImage. If you don’t know how to work with this portable Linux file package, click this link for a short video tutorial.
Running and configuring Session Desktop
Once you’ve got the desktop downloaded and installed, you need to fire it up. You’ll want to connect your desktop client to your mobile device. You can do this by selecting Sign In, instead of Create Account, then selecting Link Device to Existing Session ID and following the instructions.
The Session desktop apps I tested for this review were easy to use to get going and use.
Support
Session’s support area reminds me a lot of Keybase. There’s an FAQ page, and a blog, rather than a regular Support page like you would find for a paid product. The FAQ is pretty useful, although a little sparse (not surprising for a product that is still under heavy development).
If you have questions that the FAQ can’t answer, the company does offer email support and social media contacts. They also have links where you can report bugs and look for solutions. But those all take you to GitHub pages where you can look at the code and check existing issues pages. This is okay for hardcore techies, but is likely to freak out some regular users.
How secure and private is Session?
Once Session is completed and fully developed, it should be super secure, extremely private, anonymous, and generally excellent. However, the product isn’t there yet. The onion request system is not yet functional, causing Session to use proxy servers as workarounds. Until onion requests are fully implemented, and the promised third-party test results are published, we won’t really know how secure and private Session will turn out to be.
Concerns about Australia and data security
On the topics of privacy and the security of your data, we must discuss where Session is based. As noted above, Session is based in Australia. Unfortunately, Australia is not a very good privacy jurisdiction for a few reasons.
As we recently discussed in our guide on the best VPNs for Australia, the country passed a law to undermine encryption and data security in 2018. Here’s a quick overview of this law:
The Australian Parliament passed a contentious encryption bill on Thursday to require technology companies to provide law enforcement and security agencies with access to encrypted communications.
Privacy advocates, technology companies and other businesses had strongly opposed the bill, but Prime Minister Scott Morrison’s government said it was needed to thwart criminals and terrorists who use encrypted messaging programs to communicate.
In privacy circles, the “Assistance and Access Bill” is sometimes called the “encryption-busting law” or the “anti-encryption law” because of what it allows. This law would fundamentally affect businesses that provide encrypted communication services, including Session, VPN services, and other privacy-focused business.
The Loki Foundation that is behind Session addressed this thorny issue in a blog post:
Obviously, we were terrified when we first saw this bill. The potential for the project to be entirely undermined by this legislation did not go unnoticed. We had begun to consider how we might set up failsafes to allow people to catch bad code being injected into our codebase, or to pay someone external to Loki to do regular inspections of our binaries that we release and ensure they are not leaking extra information or mismatching the codebase in some way.
If we were to be issued a TCN [Technical Capability Notice], we would not be able to tell anyone about it. If we set up some sort of canary system, we could be imprisoned. So whatever failsafe we did set up would have to be external to Loki, and would have to be regularly auditing us to make sure we haven’t been compromised before a TCN was issued.
Ultimately, the Loki Foundation believes they can still operate a secure messenger service in this perilous legal environment. Their blog post on the topic really goes deep into technical and legal details, which you can investigate if you have the time and inclination.
So is your data safe and secure with Session messenger?
I have my doubts after researching the Assistance and Access bill, but you can come to your own conclusions.
Other privacy concerns with Australia
It’s also worth noting that the anti-encryption legislation is not the only privacy issue that plagues Australia. Consider this:
- Mandatory data retention – In 2017, Australia implemented a mandatory data retention framework. This forces all internet providers and telephone companies to store connection data for government agencies for a full two years.
- Five Eyes – We have also noted before that Australia is a member of the Five Eyes surveillance alliance. This alliance works together to collect and share mass surveillance data.
And if you think that various agencies are not exploiting these laws to collect data on Australians, think again. Here is a recent headline from The Guardian:
Due to metada collection laws in Australia, it’s great that Session makes every effort to not collect any metadata. However, it’s also clear that everyone in Australia should be using a VPN service to encrypt and anonymize web browsing activity.
Session business features
Like its ancestor, Signal, Session doesn’t have any business-specific features or versions at this time.
Session prices
Session is free and open source software. There is no charge for using Session and as far as I can tell, no plans to charge for the product in the future.
Session review conclusion
Session is a promising product, but it comes with Pros and Cons. Once complete, it should be just as secure as Signal, even more private than Signal, and anonymous as well. But there are still lingering concerns about Australia, data privacy, and the Loki Foundation’s ability to keep user data secure in this environment.
Based on testing out and using Session for this review, I must say that it isn’t close to being ready for prime time. Without the onion request system, it isn’t as secure, private, and anonymous as it will be. And in my testing, it was difficult to carry on a chat of more than a handful of messages without some kind of error popping up. My usual test phone, a Samsung S9+, could receive, but couldn’t send messages at all. A borrowed Huawei could exchange messages, but after a few moments, lost sync with the other person in the chat and was never able to regain it.
Is Session right for you?
Perhaps in the future Session will take its place as the best secure messaging service available. But in my opinion, it isn’t close to ready yet. In the meantime, you may want to check out our other secure messenger reviews.
- Keybase review (Keybase was acquired by privacy-abusing Zoom)
- Telegram review
- Signal review
- Wire messenger review
Sven, Do you have any thoughts, and would you or your team possible consider reviewing CoverMe and Private Line (formerlyBurnerline)? I believe both are under the same development team and they have apps for Google and Apple. CoverMe uses military grade encryption for messaging, texts, and calls. Private line claims to use End to End Encryption. These apps may be possible substitutes to replace Google services on phones, and in addition their services are similar to Line2. CoverMe has a lot of features similar to other secure messaging apps, such as self destructing messages. The only thing they don’t have, which I value, is 2FA.
Due to time limitations, we generally only focus on apps and services with a bigger audience. But we could keep this in mind for the future.
NP, and understood. Thank you, Sven, for educating and informing the community! Excellent platform.
I don’t get the point about Australia and laws… this app is open source, anyone in this world can review the code. If this is E2E encrypted and the code proves it is, there is no way for Australian law forces to access content information. IPs are protected by Tor, which is also open source and audited for years and years.
Metadata could be the only things to be gathered but as no one can ever know the man/girl behind the session ID…
So…
Could even be made by a secret service as I read in the comments, whatever…
To me Session sounds safe and secure as long as the code is audited and approved by cybersec famoust specialists.
Love this site and its reviews. I trust you guys. All we need is regular updates and reviews of more products. Especially the new products with their “Respecting Privacy” claims
Hi Jimmy, with all of the recent interest in secure messenger products (alternatives with WhatsApp), we are updating all of these reviews in the next two weeks and then posting a new roundup guide on the best secure messaging systems when the reviews are finished/updated.
Would another review of Sessions to account for the many updates they’ve made be a good idea? I’m using it with confidence. It’s ditched the proxy routing protocol for the onion routing protocol awhile ago too.
Yep, we’ll check it out again soon for some updates. Feel free to add any other thoughts you have or share your own review in the comments.
@Sven,
If they are using the onion, and have a third party audit (happening now) would that make them recommended in your mind?
Yes that would go a long way. It also just needs to work well without bugs. And if I recall correctly, receiving messages was spotty when Heinrich and I were testing it on different platforms. But that was last year also.
@Sven,
Thank you for your input. Here is what I found and your thoughts helped me to give them a try.
1) The move to being Onion was highly important. They have switched to it.
https://getsession.org/onion-requests-session-new-message-routing-solution/
2) Being reviewed from an outside company. It is in the process. this is from their FAQ titled “Security Audit”, “Session’s desktop, Android, and iOS clients are currently undergoing a security audit by Quarkslab. The results of the audit will be published once it is completed.”.
https://getsession.org/faq/
Both of these are positive steps. Thanks.
Great news, thanks for the update J.M.
You’re welcome and thank you.
I have it and am trying to get people over to it…but maybe in time.
I did do a practice run but I sent a few messages only and received them.
They reccommend going through Google’s setup as it is faster but the Metadata is even more locked down if you pull it from what they call the Hive or swarm.
Little longer but it seemed good. Hoping to try more later.
I wonder how many of those encrypted communication apps are launched by different secret services masqueraded as foundations….
Signal or any other messenger that insists on attaching itself to deeply personal information like a phone number (or even email, although a secondary email address is clearly much easier to acquire) is a complete non-starter for me; unfortunately, it seems generally accepted that you MUST provide something like that with essentially no exceptions – which is why I found Session in the first place and why it’s so appealing to me. To someone who has been around long enough to see instant messaging be born and need nothing more that a meaningless string of numbers (ICQ) or a unique username to function, the modern insistence on easily identifiable personal data is about unnatural, jarring and generally unacceptable as it can possibly get. A phone or a computer is just a communication channel, NOT the identifier of who you are.
Additionally, for-pay services – even when they seem both reasonably priced AND reasonably trustworthy – are impractical for not one but TWO reasons: first, if you’re paying for access you have now attached even stronger personally identifiable information to your account: your credit card number (unless payment by cryptocurrency is available – but that is rare, and comes with its own set of problems); and second, even if YOU would be willing to pay for the service, it’s hard enough to convince others you actually want to communicate with to follow you to some new platform they never heard of through all the hassle of installing and setting it up – telling them they also have to pay to use it (even just a little bit) would be a complete non-starter. “WhatsApp is free so why would they want to pay…?”. Free access therefore makes Session even more appealing, especially considering how rare such a thing is when the service is being paid for neither by you nor by leveraging the data collected.
Unfortunately as modern history clearly shows the Facebook-era general public can not be relied on to create a demand and support for properly private services, mirrored by the general lack of such services being offered; which is why I find Session so important – it, or something close to it clearly needs to exist and we are very fortunate to have that work done for us by those offering it. I just hope Session turns out to be financially sustainable and free of… undue influence. But as it is, it looks like the best (and only acceptable) bet right now.
Tinfoil chat is better than Session.
https://github.com/maqp/tfc
Please review Threema. I just started using it—have only sent a few SMS messages and made a few test calls to family members. From my layperson’s perspective, it seemed the most secure, and it’s in Switzerland. Threema does not require a phone number, but it provides the OPTION of linking to a phone number and scanning one’s contact list if one wishes. I had not heard of Session until today, and I would be interested to read a review of Threema which might compare it to Session and Signal. For personal use, Threema costs only CHF 3.99 for a lifetime license, which is quite affordable.
Please give best privacy friendly DNS servers list and review cloudflare dns separately
We could review DNS separately, but we recommend using a good VPN service, which will already handle all DNS requests encrypted in the VPN tunnel. Using only encrypted, “privacy” DNS services is an incomplete solution because your IP address remains exposed to every website you visit, ads, and trackers. Additionally, even with encrypted DNS, your ISP can see (and record) the sites you visit, even if they aren’t handling DNS requests. As for Cloudflare, it is a US company that records DNS requests (browsing history) the last time I checked the privacy policy. And it could be forced to hand over any of this info, just like an American ISP.
Those who can’t afford VPN should use private, encrypted DNS anyway. Private, encrypted DNS can protect users by preventing: 1) redirection to a site preferred by ISP aka DNS spoofing , 2)DNS-based blocking as well as 3) direct logging of DNS queries.
True, ISP can gain info on websites visit via reverse DNS lookup but reverse lookup is not 100% reliable.
2FA is not really needed for Session at all. There’s no central servers, so you hold your identity on the device itself (offline).
Agree. It’s listed as a “con” in the article, but 2FA is actually a big negative from a privacy standpoint. It’s a system-confirmation of PII. That’s a bad thing for privacy. Standard 2FA works in general but is not without breach risks too, especially if leveraging SMS.
Also, agree with the author that Australia is a heavy surveillance state, and not the ideal launching pad for security oriented projects. But because of the open design, this system could be reloaded elsewhere without a ton of effort, if it came to that.
Dear Mr. Long,
I just want to first thank you for such a wonderful review! I feel some shame that I haven’t looked properly into Session yet, though I have heard some buzz about it; the excuse for my behavior is probably that the privacy scene has been just so turbulent as of late. Services seem to be getting acquired or exposed left and right, and what alternatives remain are far from ideal. Even your short list of secure messaging services has probably one real contender. Keybase has been acquired by Zoom, Telegram is hit with vulnerabilities every few months (and is far from built on private and secure infrastructure), and Wire has been playing catch-up with Signal for years. And then Signal itself is lacking in some critical areas of privacy, although I would be loathe to criticize its security construction. But I don’t want to fall into the classic pattern of hopelessly keysmashing about how privacy has been dying since 9/11. Back to your review, for all of the merits and demerits of Session, you covered things neutrally and painted a clear picture. That’s commendable in any area where it would be easy to “accidentally” favor X service just a bit much, lest they cut off their contribution dollars…I hope you continue to write with Sven and the rest of the growing Restore Privacy “squad” (posse? gang?). Great stuff.
Sincerely,
Anonymous
Just because you ban something on paper , does not mean its banned in practice .
Thank you for the review. Seems to have similarities with Threema (no phone, no email, randomized ID, server middle-man for asynchronous messaging, messages deleted from server once delivered, no metadata log, no GIFs?) except that Threema is not decentralized, is based in Switzerland and cannot be logged on multiple devices on the same time.
Switzerland is a place to avoid too due the relations with US