1

I've had Threema for a few days (a couple of friends forced me to buy it). It's pretty neat but I'm afraid that I'm not connected to everyone since my mail/phone-number data is pretty small or outdated.

So, I thought it would be a good idea to post my threema-id to Facebook and tell everyone: "Hey if you want to connect your Threema, add me via 1F33OO7." Is this a good idea? Would that negatively effect my security somehow?

1

Nope, you should be just fine sharing your Threema-ID. The reason being that your communication is protected with end to end encryption.

Strength of the encryption: The asymmetric ECC based encryption used by Threema has a strength of 255 bits. Accordingto a NIST estimate (page 64), this corresponds at least with the strength provided by 2048 bit RSA. ECDH on Curve25519 is used in conjunction with a hash function and a random nonce to derive a unique 256 bit symmetric key for each message, and the stream cipher XSalsa20 is then used to encrypt the message. A 128 bit message authentication code (MAC) is also added to each message to detect manipulations/forgeries.

Sharing your ID is akin to sharing your public key. Unless someone has the private key, your communication will remain secure, regardless of who has access to your public key. Threema does all encryption and decryption of messages locally, according to its FAQ, so your private key remains in your possession at all times. And if you want to communicate securely, you need the other party to access your public key.

On top of these facts, you don't have to reply/add anyone who you do not trust. So if anything feels fishy, you can just nuke that person from your "friends" list.

More info on the encryption techniques Threema employs can be found here

1

As INV3NT3D has already explained, publicly sharing your Threema ID is totally fine. However, you should not share your ID's QR code. If someone scans it, your verification level on their device will be "3" (when, in fact, it's only "1"), see here for more information. You should only scan QR codes in person.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.