Datenschutz-Plaudereien · Martin Steiger & Andreas Von Gunten, Datenschutzpartner

DAT342 Instant Messaging mit Threema (Peter Szabó, Teil 1)

·23 min·1 clip

Threema's legal counsel argues Telegram is 'probably the worst choice by far' for end-to-end encryption because users assume security they don't have — which is worse than no security at all.

1. Datenschutz-Plaudereien host Martin Steiger interviews Threema legal counsel Peter Sabo in Part 1 of a conversation about Threema's privacy and security approach. 2. Peter Sabo is legal counsel and data protection officer at Threema GmbH, based in Pfeffingen, Switzerland; he previously studied law at the University of Zurich and holds an MOSI compliance certificate from ZHAW. 3. The episode establishes Threema's basic profile: founded 2012, approximately 50 employees, servers owned and located in Switzerland (Zurich region, not hosted by hyperscalers), and currently 10-12 million registered users. 4. Threema has three product tiers: Threema Private (one-time payment, consumer-focused), Threema Work (annual per-user fee for organizations), and Threema On-Prem (self-hosted variant for organizations that don't want cloud hosting). 5. On the competitive landscape, Sabo ranks Telegram as the worst choice for privacy — it has no end-to-end encryption by default, is close to the Russian state, and users who wrongly believe it's secure are in a worse position than those on openly non-private platforms. 6. He distinguishes WhatsApp (E2E encryption but closed source and data-funded) from Signal (open source, donation-funded) and frames Threema as the only option that charges upfront and uses data exclusively to deliver the service. 7. Threema's codebase for Android, iOS, and desktop clients is available on GitHub, allowing independent verification and consistent with the Kerckhoffs principle of security through transparency rather than obscurity. 8. An open question raised is that Threema's infrastructure code is not open source; Sabo defers to the technical team for the rationale, noting the business and infrastructure layers differ from the client code. 9. In 2020 Threema was acquired by Affinum, a German investment vehicle; the three original founders retain representation in the holding structure, and Sabo argues Affinum has an incentive to preserve Threema's privacy reputation as it is central to the product's value. 10. On data retention, Sabo explains Threema stores only six data points per user: Threema ID, public key, two timestamps (account creation and last login), and optionally a hashed phone number and hashed email address. 11. Phone number and email registration are voluntary at Threema — used only to help users find contacts — whereas at WhatsApp and Signal they are required. 12. Both are stored as one-way hashes, described as 'a salad of numbers and letters, completely unreadable to a human,' though Sabo acknowledges that hash collisions on limited phone number spaces remain a theoretical concern. 13. Users can independently check their own Threema data at any time via my.threema.ch (my3data), receiving an exact export of what Threema holds. 14. The push token — provided by Apple or Google to enable notifications — is flagged as a potential exposure point: US authorities could theoretically identify users by querying Apple or Google with a Threema push token obtained via international legal assistance. 15. Android users can switch to Threema's own push service to avoid the Google push token entirely; this is not possible on Apple devices due to Apple's walled garden approach, though the EU's Digital Markets Act may eventually change this. 16. Steiger raises the message archiving limitation: Threema's end-to-end encryption makes it unsuitable for industries with mandatory communication archiving requirements such as banking (anti-money-laundering compliance), since messages cannot be retrieved from the server. 17. Sabo says users can manually export chats or full backups, and that Threema advises regulated-industry clients to establish internal protocols for periodic manual backups — but places responsibility on the client to determine suitability for their compliance needs. 18. The episode also covers Threema's published transparency report, which Steiger describes as one of the best in Switzerland, updated semi-annually and detailing authority data requests. 19. Journalists, whistleblowers, lawyers, and individuals in Switzerland or the EU who need to make informed messaging security decisions will find the most value here. 20. General listeners who are not choosing between secure messaging apps or unfamiliar with Swiss data protection law (DSG) and EU GDPR (DSGVO) may find some sections too technical or jurisdiction-specific.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Datenschutz-Plaudereien