I recently made a post talking about how im using briar but wanted ppl to recommend other apps but this article talks about some problems of those apps https://serpentsec.1337.cx/secure-messaging-choosing-a-chat-app
I recently made a post talking about how im using briar but wanted ppl to recommend other apps but this article talks about some problems of those apps https://serpentsec.1337.cx/secure-messaging-choosing-a-chat-app
The metadata thing is mostly to do with the server having a plaintext record of things like your contact list but honestly it’s a moot point if you run your own server for your friends.
This is one of these “true, but” kind of things. Of course in a federated network servers need to communicate with each other and that “leaks” meta-data to them. Maybe XMPP could be optimized a bit more to share less metadata (but it already shares less then Matrix), but in the end there is no way to totally avoid that if you want to enable federation.
IMHO I think the privacy benefits outweigh the downsides, because in XMPP each server only has a limited subset of the metadata and thus is it much harder to do AI driven data-mining on it.
Thank you for the insights, do you know which data that is in particular? For federation I would think 1) who you’re speaking to (both servers?), 2) on which server they are, 3) how long, how often, etc. Is that about right?
Yes, and all of that lives inside TLS, so only the server admins on both ends would see it.
Also: are XMPP’s voice calls (jingle) E2EE?
I’ve read a few months ago that voice calls via Conversations IM are E2EE. Alas forgot where I read that. Anyone ?
The new implementation standard (as used in Conversations) AFAIK uses p2p WebRTC, which is encrypted by default.
Yes, but back in June 2020 it sent the keys over transport encryption, not inside OMEMO, meaning it was effectively transport encrypted and not E2EE.
I’m asking whether that changed.
For reference: https://github.com/iNPUTmice/Conversations/issues/1234#issuecomment-644670884
Calls do not use OMEMO, but instead use DTLS-SRTP - which is still end-to-end encrypted as only both devices have the keys for the calls.
That said, as of a few weeks ago, Conversations does use verified OMEMO keys in the handshake to display a shield on the call: https://github.com/iNPUTmice/Conversations/releases/tag/2.9.8 (note that this requires that you have physically scanned the QR code of your contact’s OMEMO key).