3 ms·

Isn't the fact neither XMPP nor IRC are e2e-encrypted a factor in them catching on? Nobody wants to use a messenger that's public, or that with a single centra

Isn't the fact neither XMPP nor IRC are e2e-encrypted a factor in them catching on? Nobody wants to use a messenger that's public, or that with a single centralised compromise/hack could make all their messages become so. To me that disqualifies them as even being potential solutions to the problem. Matrix has significant usability issues in its currently-available form(s) - but it at least meets the most basic of requirements that user messages are private, and does so fundamentally.

mouldysammich 6y ago
XMPP has omemo for encryption which is support by default by both major severs and every client i've tried -- especially the ones that aim for user-freindlyness likes conversations
Andrew_nenakhov 6y ago
XMPP lost popularity long before the public became (unhealthily) obsessed with encryption.
- argvargc 6y ago
  Care to explain? I can't think of a single example where encrypting a private message passed over a public network would be unhealthy.
  - Andrew_nenakhov 6y ago
    Users do not understand that E2EE means no easy device syncing and no serverside search, they just want to feel 'safe', but are not ready to perform such necessary things as fingerprint verification. And without verifying the identity of the remote party, E2EE is totally meaningless. Telegram's far better UX than Whatsapp is possible because they do not have e2ee on anything but Secret Chats (and I've never seen anyone on Telegram using them). See, for most users the promise of security is better than actual security and all attached UX problems.
betterunix2 6y ago
Remember OTR messaging? The benefit of an open system like XMPP is that you can add end-to-end encryption if you want to do so. Really though, why is end-to-end encryption the one thing that should disqualify a system? What about a10y, i18n, etc.? For a vision-impaired user a10y matters a whole lot more than encryption. That is the real point of openness and federation -- allowing users' needs to be met by any developers who have the time and inclination to do so, rather than leaving users at the mercy of a single team (or even a single person).
- hiq 6y ago
  > Really though, why is end-to-end encryption the one thing that should disqualify a system? Because security as an afterthought is known to fail.
  - betterunix2 6y ago
    Empathy, the Gnome messaging software, has yet to implement end-to-end encryption because of this mode of thinking. Rather than implement OTR they said they felt it was better to implement a protocol with E2E built in since it would be supported by native clients (what does that even mean for XMPP?). As a result, their users never had end-to-end encrypted messaging at all. That is what being religious about these things gets you. Signal is completely closed and its users are at the mercy of the developers. XMPP+OTR was a kludge but it worked and the only reason the outstanding problems were not resolved is that the cryptographers behind OTR decided to focus on Signal. Matrix is basically irrelevant right now and whatever security benefits it might have are equally irrelevant because very few people are using it.

mouldysammich 6y ago

XMPP has omemo for encryption which is support by default by both major severs and every client i've tried -- especially the ones that aim for user-freindlyness likes conversations

Andrew_nenakhov 6y ago

XMPP lost popularity long before the public became (unhealthily) obsessed with encryption.

argvargc 6y ago
Care to explain? I can't think of a single example where encrypting a private message passed over a public network would be unhealthy.
- Andrew_nenakhov 6y ago
  Users do not understand that E2EE means no easy device syncing and no serverside search, they just want to feel 'safe', but are not ready to perform such necessary things as fingerprint verification. And without verifying the identity of the remote party, E2EE is totally meaningless. Telegram's far better UX than Whatsapp is possible because they do not have e2ee on anything but Secret Chats (and I've never seen anyone on Telegram using them). See, for most users the promise of security is better than actual security and all attached UX problems.

betterunix2 6y ago

Remember OTR messaging? The benefit of an open system like XMPP is that you can add end-to-end encryption if you want to do so. Really though, why is end-to-end encryption the one thing that should disqualify a system? What about a10y, i18n, etc.? For a vision-impaired user a10y matters a whole lot more than encryption. That is the real point of openness and federation -- allowing users' needs to be met by any developers who have the time and inclination to do so, rather than leaving users at the mercy of a single team (or even a single person).

hiq 6y ago
> Really though, why is end-to-end encryption the one thing that should disqualify a system? Because security as an afterthought is known to fail.
- betterunix2 6y ago
  Empathy, the Gnome messaging software, has yet to implement end-to-end encryption because of this mode of thinking. Rather than implement OTR they said they felt it was better to implement a protocol with E2E built in since it would be supported by native clients (what does that even mean for XMPP?). As a result, their users never had end-to-end encrypted messaging at all. That is what being religious about these things gets you. Signal is completely closed and its users are at the mercy of the developers. XMPP+OTR was a kludge but it worked and the only reason the outstanding problems were not resolved is that the cryptographers behind OTR decided to focus on Signal. Matrix is basically irrelevant right now and whatever security benefits it might have are equally irrelevant because very few people are using it.