3 ms·

I love XMPP, but its OTR plugin is kind of glitchy.

by eimrine 12d ago

andix 12d ago
E2E encryption should be part of the main protocol spec and mandatory. It's 2026 now. Nobody needs a messenger that isn't encrypted.
- verdverm 12d ago
  > Nobody needs a messenger that isn't encrypted. Businesses want to analyze internal company messages. Chat protocols / platforms need to make inroads with one of the core audiences for online chat. Those are largely taken right now, (slack/teams business, discord gaming/oss). If it is personal/small group messaging, several E2EE options already exist, though I understand Jabber/XMPP is trying to be in the chatroom genre
  - iamnothere 12d ago
    Not every messenger needs to support every use case
    - verdverm 12d ago
      you'll need one major group if traction is the goal, which seems to be what the posted link is really after chat is network effect, so a chat app needs to answer "which network of people" if the creators about traction?
      - iamnothere 12d ago
        True, segmentation is already happening with users choosing apps based on geography, age, and sometimes by social group. It’s possible to target and win over a select group of people if you have a compelling feature or an experience that’s geared towards their needs. You just have to decide who you are focusing on. I can easily imagine a future where people switch between three messengers, one for general communications with acquaintances and family, one for work, and one for their social circle. Many already do this with social networks.
        verdverm 12d ago
        text, slack, discord for those three already (for me); none were my choice, unlikely I would chose any of them given better options, yay capitalism!
  - foobiekr 12d ago
    There is literally nothing about enterprise inspecting proxies that requires the client operate without default and always on crypto. That makes no sense at all. The way businesses handle this is by installing a certificate they manage and deploy to their proxies.
    - verdverm 12d ago
      one does not typically do data science on message content by capturing it at the proxy, go to the database and dump the data set
  - OkayPhysicist 12d ago
    You can do E2E encryption for organizations, you just establish all conversations as at least 3-way conversations: the two members of the org, and the org itself. You let the server refuse to host any conversation it isn't privy to, and then apps that support organization mode automatically add the org listener, and users using third-party clients can add it manually.
    - mahboi 12d ago
      The org can just host non-E2EE XMPP, and it'd be the same as this wrt trust, easier to implement too.
    - verdverm 12d ago
      E2EE has well known issues for scaling, which is why it's found primarily in small group / personal chat
- aboardRat4 12d ago
  E2EE will never be the default, because people lose their devices all the time, and don't want to lose message history.
  - jeroenhd 12d ago
    WhatsApp doesn't even have the option to disable e2ee anymore and it's doing just fine, despite their best efforts to screw over their customers.
    - mahboi 12d ago
      WhatsApp depends heavily on centralization.
  - codedokode 12d ago
    Who are those people having lot of time to re-read their old message history? I assume most people only read last several messages in a chat. This matches the real life conversations which are not stored anywhere. However, police will definitely be happy to discover that your many years messaging history is intact. I would rather want a feature, like Telegram has, where you can set auto-delete of all messages older than N days.
    - jprjr_ 12d ago
      For me searching my old messages is really useful. I don't scroll back through history but I'll search for things like "plumber" to find the number of a plumber a friend texted me a while back.
    - aboardRat4 12d ago
      >Who are those people having lot of time to re-read their old message history? Everyone who has to, say, prove that they kept paying their rent for a year without interruptions. You sent a photo of your money transfer from the bank app to your landlord, and he sends the "received" screenshot from his bank app. Moreover, a lot (even most) people make personal notes by sending messages to themselves.
    - 12d ago
- mahboi 12d ago
  I disagree. XMPP wasn't designed for it, and there are already others that have done E2EE better, while still having some downsides. The only way XMPP has an edge is by not doing E2EE.
gatlin 12d ago
OMEMO has superseded xmpp for a while now.
ValdikSS 12d ago
Everybody has switched to OMEMO. It's the same encryption standard which Signal uses. It supports multiple devices and encrypted group chats as well.

I love XMPP, but its OTR plugin is kind of glitchy.

by eimrine 12d ago

I love XMPP, but its OTR plugin is kind of glitchy.

andix 12d ago

E2E encryption should be part of the main protocol spec and mandatory. It's 2026 now. Nobody needs a messenger that isn't encrypted.

verdverm 12d ago
> Nobody needs a messenger that isn't encrypted. Businesses want to analyze internal company messages. Chat protocols / platforms need to make inroads with one of the core audiences for online chat. Those are largely taken right now, (slack/teams business, discord gaming/oss). If it is personal/small group messaging, several E2EE options already exist, though I understand Jabber/XMPP is trying to be in the chatroom genre
- iamnothere 12d ago
  Not every messenger needs to support every use case
  - verdverm 12d ago
    you'll need one major group if traction is the goal, which seems to be what the posted link is really after chat is network effect, so a chat app needs to answer "which network of people" if the creators about traction?
    - iamnothere 12d ago
      True, segmentation is already happening with users choosing apps based on geography, age, and sometimes by social group. It’s possible to target and win over a select group of people if you have a compelling feature or an experience that’s geared towards their needs. You just have to decide who you are focusing on. I can easily imagine a future where people switch between three messengers, one for general communications with acquaintances and family, one for work, and one for their social circle. Many already do this with social networks.
      - verdverm 12d ago
        text, slack, discord for those three already (for me); none were my choice, unlikely I would chose any of them given better options, yay capitalism!
- foobiekr 12d ago
  There is literally nothing about enterprise inspecting proxies that requires the client operate without default and always on crypto. That makes no sense at all. The way businesses handle this is by installing a certificate they manage and deploy to their proxies.
  - verdverm 12d ago
    one does not typically do data science on message content by capturing it at the proxy, go to the database and dump the data set
- OkayPhysicist 12d ago
  You can do E2E encryption for organizations, you just establish all conversations as at least 3-way conversations: the two members of the org, and the org itself. You let the server refuse to host any conversation it isn't privy to, and then apps that support organization mode automatically add the org listener, and users using third-party clients can add it manually.
  - mahboi 12d ago
    The org can just host non-E2EE XMPP, and it'd be the same as this wrt trust, easier to implement too.
  - verdverm 12d ago
    E2EE has well known issues for scaling, which is why it's found primarily in small group / personal chat
aboardRat4 12d ago
E2EE will never be the default, because people lose their devices all the time, and don't want to lose message history.
- jeroenhd 12d ago
  WhatsApp doesn't even have the option to disable e2ee anymore and it's doing just fine, despite their best efforts to screw over their customers.
  - mahboi 12d ago
    WhatsApp depends heavily on centralization.
- codedokode 12d ago
  Who are those people having lot of time to re-read their old message history? I assume most people only read last several messages in a chat. This matches the real life conversations which are not stored anywhere. However, police will definitely be happy to discover that your many years messaging history is intact. I would rather want a feature, like Telegram has, where you can set auto-delete of all messages older than N days.
  - jprjr_ 12d ago
    For me searching my old messages is really useful. I don't scroll back through history but I'll search for things like "plumber" to find the number of a plumber a friend texted me a while back.
  - aboardRat4 12d ago
    >Who are those people having lot of time to re-read their old message history? Everyone who has to, say, prove that they kept paying their rent for a year without interruptions. You sent a photo of your money transfer from the bank app to your landlord, and he sends the "received" screenshot from his bank app. Moreover, a lot (even most) people make personal notes by sending messages to themselves.
  - 12d ago
mahboi 12d ago
I disagree. XMPP wasn't designed for it, and there are already others that have done E2EE better, while still having some downsides. The only way XMPP has an edge is by not doing E2EE.

gatlin 12d ago

OMEMO has superseded xmpp for a while now.

ValdikSS 12d ago

Everybody has switched to OMEMO. It's the same encryption standard which Signal uses. It supports multiple devices and encrypted group chats as well.