Ekko: Post-Quantum E2EE for Mainstream Messengers

Getting coworkers or clients to switch to Signal or SimpleX is usually a losing battle because nobody wants to migrate their entire chat history or manage five different apps. The real friction isn't the lack of secure tools; it's the "network effect" of WhatsApp, Instagram, and Telegram.

I've been looking into Ekko as a way to bypass this migration headache. Instead of forcing a platform switch, it functions as a browser extension that layers post-quantum end-to-end encryption (E2EE) directly on top of the messengers people already use. Essentially, you keep your existing accounts, but the content is encrypted before it ever hits the company's servers.

From a technical perspective, it's using a hybrid approach to stay ahead of future decryption threats:

• Key Exchange: Hybrid X25519 + ML-KEM-768
• Symmetric Encryption: XChaCha20-Poly1305
• Key Management: Private keys are generated and stored locally on the device, not by the service provider.

The current deployment state is a Chromium extension, with experimental builds for Firefox and Safari. It supports WhatsApp Web, Instagram, Telegram Web, and Messenger. For those who want full control, there's a self-hostable public-key directory.

If you're setting this up for a team, the workflow is basically:
1. Install the extension.
2. Claim a handle to simplify public key exchange.
3. Chat through the web version of your preferred messenger.

The source code is available for a deep dive into the protocol:

https://github.com/useekko/ekko-core

It's a clever workaround for the "adoption gap" in secure communications. Rather than fighting the ecosystem, it just upgrades the security of the existing one.