Most Secure Way to Communicate?

- One method could be a Linux laptop and using SSH to talk over devzat [1] They should generate a site-specific ssh key to talk to your devzat instance. The developer is here on HN. Configure devzat to listen on port 443. To do this as a non-root account use "setcap cap_net_bind_service=+ep /path/to/devzat". They have a live instance both of you could try out. Using SSH takes most of the risk of compromised state-run certificate authorities out of the picture.

- If the goal is to have voice chat then install uMurmur [2] on your router or a VM or any node that is publicly reachable. They should use Mumble on a Linux laptop but if they had to use a cell phone then there is the Mumla app to talk to your uMurmur instance. uMurmur takes a couple minutes to set up. Self-hosted uMurmur reduces the risk of utilizing platforms that have a "wink wink nod nod" relationship with the state. Either use LetsEncrypt or a self signed cert if you do not trust LE.

He cannot be sure his phone or device isn't compromised.

Most of the Linux distributions today can be run from RAM first to ensure that the OS works prior to installing it. Your friend can burn a few USB thumb drives with different distributions and find one that suits them best. They could even continue just running Linux from RAM and leaving the internal disk untouched.

I agree that in politically unstable locations the phone can not be even remotely trusted. It must be put into airplane mode and then shut down and put into a shielded phone case.

[1] - https://github.com/quackduck/devzat

[2] - https://github.com/umurmur/umurmur/wiki/Configuration

"He cannot be sure his phone or device isn't compromised."

Well first he absolutely needs a new computer, and a new usb drive that he never used on any of his other devices.

Install some linux distro on his usb drive from the NEW device with full encryption, remove the hard drive, then use PGP from the usb drive.

Then the USB should stay in an absolutely safe space, with a physical way to know if someone tampered with it(maybe same for the laptop, UEFI virus are a thing)

But all of this doesn't matter if he lives in a country where they can just torture you to get your password, in that case you may be able to have a decoy partition with innocent looking stuff on it.(actually you shouldn't even save any sensible information even on the encrypted partition, but there could still be salvageable remnants of it)

> He cannot be sure his phone or device isn't compromised

all bets are off then. And by the way that might not matter as mobile phones can be compromised "over the wire" [!]

[!] https://en.wikipedia.org/wiki/Pegasus_(spyware)

https://chatsecure.org/

> ChatSecure is a free and open source messaging app that features OMEMO encryption and OTR encryption over XMPP. You can connect to your existing Google accounts or create new accounts on public XMPP servers (including via Tor), or even connect to your own server for extra security.

> Unlike other apps that keep you stuck in their walled garden, ChatSecure is fully interoperable with other clients that support OMEMO or OTR and XMPP, such as Conversations (Android), CoyIM (Desktop), and more.