twonly

This repository contains the complete source code of the twonly app. twonly is a replacement for Snapchat, but its purpose is not to replace instant messaging apps, as there are already many fantastic alternatives out there. It was started because I liked the basic features of Snapchat, such as opening with the camera, the easy-to-use image editor, and the focus on sending fun pictures to friends. But I was annoyed by Snapchat's forced AI chat, receiving random messages to follow strangers, and not knowing how my sent images/text messages were encrypted, if at all. I am also very critical of the direction in which the US is currently moving and therefore try to avoid US providers wherever possible.

If you decide to give twonly a try, please keep in mind that it is still in its early stages and is currently being developed by a single student. So if you are not satisfied at the moment, please come back later, as it is constantly being improved, and I may one day be able to develop it full-time.

Features

• Offer a Snapchat™ like experience
• End-to-End encryption using the Signal Protocol
• Open Source and can be downloaded directly from GitHub
• No email or phone number required to register
• Privacy friendly - Everything is stored on the device
• The backend is hosted exclusively in Europe

Roadmap

Currently

• Focus on user-friendliness so that people enjoy using the app
  • User discovery without a phone number
  • Passwordless recovery without a phone number
• Implementation of features so that Snapchat can actually be replaced
  • E2EE cloud backup of memories
  • Importing memories from Snapchat

Next on the bucket list

• For Android: Support for [UnifiedPush] (https://unifiedpush.org/)
• For Android: Reproducible builds
• Implementation of Sealed Sender (or a similar protocol) to minimize metadata
• Switch from the Signal protocol to MLS for post-quantum crypto support
• Decentralize the server so that anyone can run their own server

Security Issues

If you discover a security issue in twonly, please adhere to the coordinated vulnerability disclosure model. Please send us your report to security@twonly.eu. We also offer for critical security issues a small bug bounties, but we can not guarantee a bounty currently :/

Development

Setup Instructions (macOS)

Building

Some dependencies are downloaded directly from the source as there are some new changes which are not yet published on pub.dev or because they require some special installation.

git submodule update --init --recursive

cd dependencies/flutter_zxing
git submodule update --init --recursive
./scripts/update_ios_macos_src.s

Debugging files

run-as eu.twonly.testing ls /data/user/0/eu.twonly.testing/

Signing Keys

When you download the app via GitHub or F-Droid you can verify the signing keys using for example the AppVerifyer and the following SHA-256 fingerprint of the signing certificate.

eu.twonly E3:C4:4D:56:8C:67:F9:32:AC:8C:33:90:99:8A:B9:5E:E8:FF:2D:7A:07:3C:24:E3:66:77:93:E6:EA:CD:77:0A

License

This project is licensed under the GNU AGPL 3.0 license.