Background
Is the Wire messaging app secure? is the only question I find on Wire here.
I am helping a group (non-technical, non-business) to decide on whether to use Wire or Threema for event coordination/general chat. They have picked those two candidates because they are seemingly similar - per their marketing providing end-to-end encryption, storing nothing on the server, not trying to catch your soul etc.
The decision is not based around the actual encryption of the messages - this is a sports group, not a terrorist organization. Several people are being strict with the management of their identities though, and opposed to linking accounts, having accounts linkage on servers and such.
I personally am having this impression, ordered by increasing impact.
Impressions about the two
Open source: tit for tat, both are essentially closed source (Wire pretends to be open source by having a github, but essential parts like server side Account Management are closed source, and the github repository obviously (judging from their own README in there) is not their "real", internal repository but an edited mirror). You cannot compile the server component of either, or run your own server.
Peer review: Threema has, if I recall correctly, had official, accepted peer reviews (by invitation) of their server side software, as well as the client. I'm unclear about Wire - they market with it on their website, but I don't remember seeing anything about what actually was peer reviewed. I'd say it's tit for tat.
End-to-end encryption: Threema, 100%. Wire, only for chat messages; the rest seems not to be end-to-end.
Business model: Both have regular for-profit Swiss companies behind them. Threema seems to be open with this. They take money for the app, period. Wire seems to not get any money from their users; there seems to be a backing company behind them, and it is so far unclear (to me) how they are supposed to generate revenue.
Accounts: the big one. Threema generates a random account (PPK) locally, period. It is not linked to a mail address or phone number - you can use it right after creating it; and if you use something like Xprivacy, the app cannot get those IDs behind your back. You can transfer your public key offline with a qcode. Wire forces you to enter a phone number (which is actually verified by SMS), thus linking your Wire account to other accounts immediately. For me, that is the biggest no-no (the previous points I can ignore as beeing too paranoid), a complete blocker, purely based on my personal level of paranoia, which is a choice which I ask you to accept as given for this particular question.
So. For both, we effectively don't know (in a paranoia/security context) what's happening server-side. For Wire, we know that they immediately have our identities (assuming a bunch of non-tech, non-sec people are not going to each get a dedicated smartphone just to use this app with a separate phone number and faked name, address etc. ;)
Questions
Can you share some thoughts on my points? Please stick with the level of paranoia I have given in the question, this is one not negotiable part. I am not interested whether the NSA has our chat texts, but in business uses of our identities, linkability of identities and such, and your general impressions about the ethics of those two companies.
Especially I am interested in whether you know of trustworthy sources (i.e., trustworthy, independent, well-known security experts) which dispel my rather bleak view of Wire, or which shed more doubt on Threema.
I also am not interested in alternative apps, for this particular question - the two have been chosen by someone else, and I am simply interested in weighing the both against each other.
