Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've had Threema for a few days (a couple of friends forced me to buy it). It's pretty neat but I'm afraid that I'm not connected to everyone since my mail/phone-number data is pretty small or outdated.
So, I thought it would be a good idea to post my threema-id to Facebook and tell everyone: "Hey if you want to connect your Threema, add me via 1F33OO7." Is this a good idea? Would that negatively effect my security somehow?
They now even suggest sharing your ID via their "share link" feature. From their post about this: https://threema.ch/en/blog/posts/share-link-en
To streamline the process of adding contacts to Threema and to make it easier to share one’s own ID, there is now a unique Share Link for each Threema ID....
Their example: https://threema.id/ECHOECHO
Nope, you should be just fine sharing your Threema-ID. The reason being that your communication is protected with end to end encryption.
Strength of the encryption: The asymmetric ECC based encryption used by Threema has a strength of 255 bits. Accordingto a NIST estimate (page 64), this corresponds at least with the strength provided by 2048 bit RSA. ECDH on Curve25519 is used in conjunction with a hash function and a random nonce to derive a unique 256 bit symmetric key for each message, and the stream cipher XSalsa20 is then used to encrypt the message. A 128 bit message authentication code (MAC) is also added to each message to detect manipulations/forgeries.
Sharing your ID is akin to sharing your public key. Unless someone has the private key, your communication will remain secure, regardless of who has access to your public key. Threema does all encryption and decryption of messages locally, according to its FAQ, so your private key remains in your possession at all times. And if you want to communicate securely, you need the other party to access your public key.
On top of these facts, you don't have to reply/add anyone who you do not trust. So if anything feels fishy, you can just nuke that person from your "friends" list.
More info on the encryption techniques Threema employs can be found here
As INV3NT3D has already explained, publicly sharing your Threema ID is totally fine. However, you should not share your ID's QR code. If someone scans it, your verification level on their device will be "3" (when, in fact, it's only "1"), see here for more information. You should only scan QR codes in person.
Classic example of security vs privacy.
If all you care about is security, sharing your ThreemaID on your facebook, instagram, etc. social media presence(s) is no big deal.
If you are using Threema specifically for privacy (in addition to mere security,) you should not share it on your social media so as to not provide an association between those profiles and your ThreemaID.
I am using Threema w/o phone or email association, specifically so as to being able to communicate securely and privately with friends & family. If all I care about is secure comms, I use Signal (different email, Viper phone #.)
The (few) trusted friends I use Threema with know not to associate real identities or identifiable profiles with our ThreemaIDs, so we should be good from metadata exposure as well.
Might be overly paranoid, but I do because I can :).
I think sharing your Threema ID is as good or bad as sharing your phone number or E-Mail address: Anybody who has it can call you (i.e.: send a Threema message to you).
You'll have to decide what to do or how to handle unwanted messages.
Changing the Threema ID periodically is probably not the best idea, and it would be nice if Threema would support more than one ID (like one for the public, and one for good friends). Then you could just change your public ID occasionally if you are getting too much SPAM or noise.
Actually I had suggested to implement such a feature.
