10 ms·

Mandatory encryption on XMPP starts today

191 points by MattJ100 12y ago

zx2c4 12y ago
I'm hoping with the ousting of Vic Gundotra, Google will reenable XMPP federation with Hangouts... For those unaware, for years GTalk supported using XMPP/Jabber to talk to other servers. A handle of whateverwhatever@gmail.com could speak through GTalk to someone using a different XMPP server with somethingelse@personaldomain.com. With the introduction of Hangouts, this is no longer possible. In order to talk to GTalk users, you might be using a Google account. Now before there's too much confusion: yes, Hangouts/GTalk users can still use XMPP clients, like Pidgin or Adium, to talk to other Hangouts/GTalk users. But such users can no longer talk to people using the global federated XMPP network of servers that are not Google. For years I enjoyed being able to run my own XMPP server, do some interesting things with it, and still talk to my friends and family on GTalk. Now I'm forced to use Google to maintain this. In other words, they took a well functioning standard that was successfully decentralized, federated, and working extremely well, and deliberately neutered the decentralized aspects. Now there is the nice decentralized XMPP, and Google's XMPP, separate, distinct, broken. It's a damn shame. Gtalk federation worked great for years, and it's only been with the G+era strangulation that it's disappeared.
- darklajid 12y ago
  I don't share your hope, but oh yes. That'd be amazing. Currently it's a usability nightmare and entirely unclear who can reach you and who cannot. As someone without Hangout or G+ people with a @gmail.com suffix might or might not be able to contact me, sometimes depending on the age of their mobile or whether they use GMail at this particular moment. Their presence might or might not be accurate, because they are either away or use Hangout and stay 'away' forever (not offline, nooooo. They are away in G+ land..). I hope you are right and I'm wrong.
  - zx2c4 12y ago
    > Currently it's a usability nightmare and entirely unclear who can reach you and who cannot. Yes! Exactly this. I had started working on a Prosody server side plugin that would route messages for Hangouts users through a Google Account if they were on Hangouts instead of old-Gtalk, but the details of detection seemed flaky at best. When I have some time, I'll give it another look by examining the User-Agent the client sends. I'm not hopeful, but I guess there's a chance.
- higherpurpose 12y ago
  Facebook is shutting down the XMPP gateway too next year: http://eion.robbmob.com/blog/2014/05/14/facebook-to-shut-down-their-xmpp-service/ http://eion.robbmob.com/blog/2014/05/14/facebook-to-shut-dow... Interestingly, it was announced a couple of days after Cryptocat launched its Facebook encryption plugin. https://blog.crypto.cat/2014/05/cryptocat-now-with-encrypted-facebook-chat/ https://blog.crypto.cat/2014/05/cryptocat-now-with-encrypted...
- grinich 12y ago
  What did the XMPP change have to do with Vic?
  - presootto 12y ago
    Nothing at all; this was a decision made by the Hangouts team. The XMPP change has to do with the NIH syndrome a lot of Google engineers suffer from, combined with the incompetence of the Hangouts PM, Kate Cushing. Disclaimer: I work for Google.
    - zanny 12y ago
      But google invented Jingle, and in the XMPP space I can't imagine they didn't have a dominate authority. And you can add whatever extensions you want to XMPP, standard or not.
      - ralphm 12y ago
        Google did start Jingle and large part of their work ended up in the Jingle standards at the XMPP Standards Foundation. However, Google Talk and the old Hangouts took quite a while to move to the standardized version, and were never fully compliant. Also, in other areas, Google never quite interacted with the community and left major issues unresolved. Basically all of the issues, perceived flaws or missing features attributed to XMPP in the old implementation of Hangouts were either misinformed or have seen development or new specifications in the XSF. Google never contributed to such discussions, with the exception of individual Googlers helping with Domain Name Associations (DNA, http://tools.ietf.org/html/draft-ietf-xmpp-dna-05 http://tools.ietf.org/html/draft-ietf-xmpp-dna-05).
    - zx2c4 12y ago
      So far as I can see, the Hangouts implementation still uses XMPP, and even sends some federated messages to other servers. It looks like there has been some kind of code added to specifically block the functionality for which code already exists.
      - 12y ago
- pjc50 12y ago
  Presumably the defederalisation was to enforce chatting (a) such that google knew your real name and (b) such that you were subject to surveillance.
- girvo 12y ago
  Know the worst part of Hangouts? Using any client other than the crappy extension for Chrome, you can't do group text chats. Flamingo[0] is an amazing XMPP client for Hangouts, but is useless for work because we use group chats for everything. Drives me crazy, and Google refuse to release an actual API for Hangouts, so it's not being fixed anytime soon. I'm trying to convince work to move to IRC or HipChat, or anything other than Hangouts (but my boss loves Google everything, so that's a losing battle). [0] http://flamingo.im http://flamingo.im
  - joosters 12y ago
    Yes! It's really frustrating because if you are using another chat client (e.g. Apple messages), everything seems to work except you won't see any sign of group chats. This has caused plenty confusion for me with friends wondering why I'm not responding to messages. What's even worse is that Google's hangouts app is pretty much unusable. For some reason it doesn't list all of my contacts, won't show if anyone is available and gives no indication about who I could chat with.
    - girvo 12y ago
      Yep. And it refuses to use Mavericks notification centre, and it hates multi monitor setups as well. Sigh.
    - sitkack 12y ago
      We don't we just stop using google hangouts if they are such a PoS? Is it the screen sharing? Everyone is already logged in? I find them infuriating, and only use it begrudgingly.
  - fossuser 12y ago
    I'd recommend checking out slack for your work - we started using it and it's the best chat/collaboration software I've ever used. https://slack.com/ https://slack.com/
  - drdaeman 12y ago
    > and Google refuse to release an actual API for Hangouts In old good days we didn't ask for protocols. We just took the specs by force, by reverse engineering. Worked well with ICQ, AIM, MSN Messenger and loads of others, except for, possibly, Skype (which was reverse engineered, but late to the party) And "alternative" messengers survived and even prospered (seriously outplaying the dysfunctional, overweight and ad-ridden "official" ones), even if they were actively fought by network owners. Given that official Hangouts "desktop" app is is nearly completely unusable - and even more for those who don't use Chrome - and even web messenging support is lacking (you just can't put a button "Contact me on Hangouts" on your site), I'm a bit curious why no one cared about Hangouts enough to play that game once again.
- izacus 12y ago
  That would be awesome, but I don't have high hopes - Google probably wants to have ability to modify protocol as they wish for new features. It seems they practically have no will to build a translation layer :/
  - ralphm 12y ago
    In short, it is very unlikely the reasons for abandoning federation, or dropping XMPP altogether with Google Voice, are technical in nature.
  - darklajid 12y ago
    That doesn't make a lot of sense though. There are already lots of places where that stuff is falling back to "Sorry, can't do this". Ignoring hardware limitations (running hangout on a phone without a front facing camera maybe?) you already have the 'user runs a browser that needs a plugin to fullfil the request, but plugin is missing' case. Which is reported as a failure to both users (with a somewhat helpful message). Using anything hangout-y over xmpp can fail for all I care. That's not the problem. The problem is that they broke the parts that _map well_. You cannot text me if you're using hangout (unless you're on gmail.com and use the 'gtalk' chat widget). I cannot see your presence. There's a difference between 'not building a translation layer' (for oh-so-awesome new features) and deliberately breaking things that work since, like, forever. I agree with the sibling: It's deliberate and just another Google 'Move to out platform and never get out' move. (Other examples: »"Upgrade" your browser to Chrome.« »Install a "modern" browser to get automatic translation of websites.« - ignoring all the 'Join G+' nonsense)
- Svip 12y ago
  I am confused. I use DuckDuckGo's Jabber/XMPP service (dukgo.com), and I can easily talk to Google Accounts through Bitlbee, even if they are using Pidgin, GMail's chat interface or whatever. The only obstetrical I have encountered so far, is that it requires at least 3 or 4 tries to add a Google user. But afterwards, it's not a problem. Edit: One of my friends using dukgo.com also confirms this behaviour.
  - zx2c4 12y ago
    If they've switched to Hangouts, you will no longer be able to reach them. Google users using the old non-plus-ified gchat, which is being phased out, will still work as before, but for people who get upgraded to Hangouts, they'll be cut off. So this basically includes everyone on a smartphone, or everyone using video chat, and soon it will be just everyone entirely.
    - Svip 12y ago
      Aha. Maybe I just keep good company for failing to notice that.
      - dmix 12y ago
        Apparently they plan to end support for the "old" hangout version at some point in the future. Hopefully it's not soon.
    - josteink 12y ago
      Well that's certainly interesting, but me too, I haven't really noticed that. Because while in the past, my primary reason for installing Pidgin was connecting to Google's excellent XMPP service, I now only have it hooked up to my Facebook account. I don't see any value in Hangouts. That's right. As creepy and closed as Facebook is, I still find it a much higher value service than Hangouts. Plus it actually lets me connect to people I know reliably. Hangouts is the perfect example of taking a good service and throwing it in the shitters. I can barely use the official Android-client. It's just gone completely downhill. It may not be too late for Google to recover from the terrible slope they've taken on ever since the persisted, user-hostile G+ fiasco, but I can't imagine the tarnish their brand has taken to ever have been worth it.
- lnanek2 12y ago
  I wish they would support open protocols too, but that just isn't Google any more. They are closing down lots of APIs besides XMPP compatibility after all.
- shmerl 12y ago
  Google is totally messed up. Complete lack of communication of their plans, weird betrayal of XMPP efforts and etc. I gave up on them completely.
- dunham 12y ago
  One case I think you left out (although I may have misread what you wrote): You can talk between GTalk and a federated XMPP server if the the GTalk user is logged in via XMPP. So if I send a message from my work XMPP server to my google address, it shows up in Adium, but not in the hangouts client. It's almost as if Google's XMPP network is separate from hangouts, and they only allow messages directly to/from the Google XMPP to propagate between them.
- Aloha 12y ago
  For the past couple weeks I have been able to IM from inside the hangouts app to non-google XMPP users this includes the reverse, wherein I get notifications from them too.
wesley 12y ago
What happens to group chats? as far as I know encrypted group chat is still not supported yet?
- pgeorgi 12y ago
  That's only for transport level security - messages can still be sent in the clear within the encrypted connection.
- daveid 12y ago
  That's only for end-to-end encryption, say, OTR. What this is about is connection encryption client-to-server and server-to-server.
- MattJ100 12y ago
  It's possible to achieve quite secure group chats in XMPP, as long as you have a server that you trust (emphasis on that last part). You're probably talking about OTR though, which is quite tricky for multi-party situations. This isn't XMPP's or OTR's fault - from a high level to have a secure multi-party discussion, every participant must individually verify every other participant. This creates a lot of overhead with large groups. What you can do instead is to delegate your trust to, say, a key member of the group - if they trust every member, so do you. This is the model that XMPP supports. Set up a server that only accepts encrypted and securely-authenticated connections (using whichever mechanism you have the most faith in) and only grant access to the room to trusted individuals.
  - drdaeman 12y ago
    I had heard TextSecure/WhisperPush (which uses OTR-like protocol with similar properties) has multiparty/group secure conversations. However I'm unaware of any attempts to apply those to XMPP MUCs, neither I've seen any vetted solution for end-to-end encrypted MUCs.
pgeorgi 12y ago
Luckily they don't require "valid" certificates at this time - trying to get all XMPP server operators to agree on a set of CA providers they all trust will be a nightmare.
- andreasvc 12y ago
  A nightmare? What gives you that idea? There's free as in beer certificates from StartCom, and free as in freedom certificates from CAcert. Agreeing on those would go a long way.
  - Zash 12y ago
    CAcert.org is no longer included by default in many major distributions. They were removed from Debian a while ago. And they also started using SHA-512 (?) signatures that don't work with some TLS stacks, notably GNU TLS.
  - pgeorgi 12y ago
    There are parties vested in _not_ supporting CAcert - so that won't happen. But I'm not even talking about those: CAs centralize trust and trust on the internet is a hot topic right now. Right now there's a certain homogenity in which CAs are supported by vendors. And for those that aren't, it isn't much of an issue in the web browser because users can manually click through. Now consider the talk about "Why is CNNIC/TurkTrust/Symantec in my list?" that's raised by various parties recently (concerned about the influence the governments of China, Turkey and the USA respectively can exert), what happens when XMPP servers decide not to trust CNNIC (to pick one)? Users will only notice in that they can't talk to peers. They won't know which server is responsible (or if maybe the GFW is kicking in) and there's nothing they can do about it. From the point of server operators, with mandantory CA signatures they have to decide if they're rather willing to drop perfectly fine connections or if they're accepting "secure" connections subverted by parties they weren't willing to trust in the first place.
    - andreasvc 12y ago
      Yes there is a lot of red tape surrounding certificates, but I was specifically suggesting that the authors of XMPP clients and servers could agree on these 2 alternative CAs.
pdkl95 12y ago
Still wish I had an option for encryption. - certs cost money, which I (and many other people I know) CANNOT[1] afford. StartSSL won't give me a cert (they did previously, but want $$$ now). This problem affects more people than you probably realize. Remember that 15% of the population (48 million people people)[2] in the USA are below the poverty line. The internet has already been a powerful tool, accessible in various ways even at this end of the income spectrum. Despite that, the PKI system is serving as a barrier-to-entry if you want to encrypt. So I ask again: what is a FREE option for SSL. TCP, HTTP, DNS and most other protocols work fine once you can send packets, and do not require an extra regular fee. SSL does. Or is the intent to have secure communication only for those that can afford it - the rest of us doomed to plaintext or rejected as "self signed" by the SSL servers of the rich and middle class? Or are we supposed to only use the internet as if it was TV, and be forced to trust our plaintext with some 3rd party? sigh - I suspect the answer will instead be "[-1] Don't want to be reminded of the hard issues." [1] I realize that the idea of not having an extra $15 doesn't make sense to those of you with salaried jobs. Well, lets see you come up with that extra $15 on a tiny SSDI check. Domain (3rd level) is free. Internet is very cheap and flat-rate. An extra $15 would be some new(-ish) clothes, not a SSL cert. [2] https://www.census.gov/hhes/www/poverty/about/overview/ https://www.census.gov/hhes/www/poverty/about/overview/
- MattJ100 12y ago
  A self-signed certificate is free, you don't need a CA-issued certificate just to use encryption. Most XMPP servers on the internet today are forgiving of certificates they don't trust - they will encrypt the connection and then use "dialback" to authenticate you based on DNS. Obviously falling back to DNS is not as secure, and as mentioned in the blog post - there are people working on ways to allow people to use any certificate (including self-signed) securely.
  - pdkl95 12y ago
    > Most XMPP servers on the internet today are forgiving of certificates they don't trust... I was not aware of that - I'll certainly investigate that possibility. > Obviously falling back to DNS is not as secure Of course, but it's still better than "plaintext".
ape4 12y ago
How about switching away from XML!
- claudius 12y ago
  Why? What potential gain could possibly justify breaking the entire protocol and extension-ecosystem?
  - andreasvc 12y ago
    XML has a large amount of overhead, both in bandwidth and parsing (have a look at the amount of XML that is exchanged just for logging in with XMPP). For low powered devices and low bandwidth connections such as with mobile devices, there is an undeniable gain. It's not necessary to break anything, just as TLS and compression are optional features of the connection, something like switching to ASN.1 would be possible, given a mapping of a pre-defined subset of the main XMPP protocol and commonly used extensions.
    - MattJ100 12y ago
      http://xmpp.org/extensions/xep-0322.html http://xmpp.org/extensions/xep-0322.html (originating from the IoT community, where XMPP is commonly, and successfully, used on embedded devices like you describe). Just please don't mention ASN.1 again :)
- shmerl 12y ago
  What to? XMP provides a powerful way to manage extensions to the protocol (with namespaces). What else do you propose to use?
ultramancool 12y ago
You're still trusting the server. This is only a gain if you were already the one running the XMPP server with everyone you talk to. Use a real end-to-end solution to this problem: OTR.
- MattJ100 12y ago
  OTR only protects the text content of your messages. It doesn't protect the metadata, or many of the other features XMPP provides from status to file transfers and voice/video calls.
  - shmerl 12y ago
    For media calls there is ZRTP.
    - MattJ100 12y ago
      I'm not an expert in this field, but as far as I know ZRTP trust is bootstrapped from the signalling channel (in this case your XMPP connection). So a MITM there could also MITM your voice/video. And again, your metadata and signalling would still be exposed without encryption - along with your IP addresses (ICE candidates), etc.
makomk 12y ago
Well, looks like this kills off my personal XMPP server - I don't think the software I'm using (djabberd) supports encryption for s2s connections and it's not really developed anymore. That's annoying.
- Zash 12y ago
  Considered migrating to some other XMPP server software?
  - makomk 12y ago
    Most of the XMPP server software out there is neither lightweight nor easy to configure and there's no real migration paths between them. I probably don't even have enough system resources on my personal server to run some of the more well-known servers anyway; they tend to be oriented towards deployment on large multi-user systems.
    - Zash 12y ago
      http://prosody.im/ http://prosody.im/ is pretty light weight and easy to configure. (I'm one of the devs) I don't know how easy it is to move data out of djabberd but I'm sure we can help you with that if you can provide schemas or example data. :)
      - makomk 12y ago
        Yeah, was looking at Prosody. It's probably relatively simple in my case since I'm using the standard SQLite backends for roster storage etc. (Large-scale djabberd deployments likely aren't so lucky - djabberd was designed to make it easy for people to write code hooking in to their existing systems and many did. The only example I can find took a couple of months[1]) [1] http://blog.fastmail.fm/2011/08/24/new-xmppjabber-server/ http://blog.fastmail.fm/2011/08/24/new-xmppjabber-server/
    - andreasvc 12y ago
      I wouldn't worry about system resources; if anything, I'd say that a high-level dynamic language adds most to the overhead. I can recommend http://ejabberd.im http://ejabberd.im
imaginator 12y ago
One of the big problems with XMPP security was testing the server's connection. It's worth pointing out that much of this move has been supported by @xnyhps project: xmpp.net. This lets you stick in an XMPP enabled site and see the results. For example: Google - https://xmpp.net/result.php?domain=gmail.com&type=server https://xmpp.net/result.php?domain=gmail.com&type=server (nothing) and prosody.im: https://xmpp.net/result.php?domain=prosody.im&type=server https://xmpp.net/result.php?domain=prosody.im&type=server
shmerl 12y ago
Looks like things started moving for OTR support in Telepathy: https://bugs.freedesktop.org/show_bug.cgi?id=16891 https://bugs.freedesktop.org/show_bug.cgi?id=16891 ZRTP however is still stalled: https://bugs.freedesktop.org/show_bug.cgi?id=29904 https://bugs.freedesktop.org/show_bug.cgi?id=29904
X4 12y ago
XMPP is an awful protocol [1] [2] . -- [1] http://about.psyc.eu/Jabber#Technical_Issues_in_Jabber http://about.psyc.eu/Jabber#Technical_Issues_in_Jabber [2] https://news.ycombinator.com/item?id=2069810 https://news.ycombinator.com/item?id=2069810
- MattJ100 12y ago
  Two clearly unbiased and factual analyses there :) It would take quite some time to sit down and address all the points gathered on the PSYC page. That page has been around a long time, and used to be a lot more aggressive than it reads now. At one point it even contained a quote from a mailing list post of mine, snipped to remove just the right amount of context. I'm glad to see they've cleaned it up a bit, to at least make it appear somewhat more objective, even if they still think it's objective to make technical statements like "XMPP isn't proper XML". One of its main points is of performance and scalability. Well I'm afraid that horse bolted - for nearly a decade Google have been successfully running (one of?) the world's largest IM services using XMPP. Regarding your second link, well, that seems to be set on comparing XMPP to IRC: > A protocol that, despite an immense range of features, can easily be typed by a human on a telnet prompt, in real time. Making a protocol that could be typed over telnet obviously wasn't the goal of XMPP. For what it did set out to do - create an open standard IM protocol to give normal people a path to freedom from the old IM silos that were around 10 years ago - I'd say it has been pretty successful. Maybe not as successful as one might have hoped, those silos are still around, but for political and commercial reasons rather than technical ones.

191 points by MattJ100 12y ago

zx2c4 12y ago

I'm hoping with the ousting of Vic Gundotra, Google will reenable XMPP federation with Hangouts... For those unaware, for years GTalk supported using XMPP/Jabber to talk to other servers. A handle of whateverwhatever@gmail.com could speak through GTalk to someone using a different XMPP server with somethingelse@personaldomain.com. With the introduction of Hangouts, this is no longer possible. In order to talk to GTalk users, you might be using a Google account. Now before there's too much confusion: yes, Hangouts/GTalk users can still use XMPP clients, like Pidgin or Adium, to talk to other Hangouts/GTalk users. But such users can no longer talk to people using the global federated XMPP network of servers that are not Google. For years I enjoyed being able to run my own XMPP server, do some interesting things with it, and still talk to my friends and family on GTalk. Now I'm forced to use Google to maintain this. In other words, they took a well functioning standard that was successfully decentralized, federated, and working extremely well, and deliberately neutered the decentralized aspects. Now there is the nice decentralized XMPP, and Google's XMPP, separate, distinct, broken. It's a damn shame. Gtalk federation worked great for years, and it's only been with the G+era strangulation that it's disappeared.

darklajid 12y ago
I don't share your hope, but oh yes. That'd be amazing. Currently it's a usability nightmare and entirely unclear who can reach you and who cannot. As someone without Hangout or G+ people with a @gmail.com suffix might or might not be able to contact me, sometimes depending on the age of their mobile or whether they use GMail at this particular moment. Their presence might or might not be accurate, because they are either away or use Hangout and stay 'away' forever (not offline, nooooo. They are away in G+ land..). I hope you are right and I'm wrong.
- zx2c4 12y ago
  > Currently it's a usability nightmare and entirely unclear who can reach you and who cannot. Yes! Exactly this. I had started working on a Prosody server side plugin that would route messages for Hangouts users through a Google Account if they were on Hangouts instead of old-Gtalk, but the details of detection seemed flaky at best. When I have some time, I'll give it another look by examining the User-Agent the client sends. I'm not hopeful, but I guess there's a chance.
higherpurpose 12y ago
Facebook is shutting down the XMPP gateway too next year: http://eion.robbmob.com/blog/2014/05/14/facebook-to-shut-down-their-xmpp-service/ http://eion.robbmob.com/blog/2014/05/14/facebook-to-shut-dow... Interestingly, it was announced a couple of days after Cryptocat launched its Facebook encryption plugin. https://blog.crypto.cat/2014/05/cryptocat-now-with-encrypted-facebook-chat/ https://blog.crypto.cat/2014/05/cryptocat-now-with-encrypted...
grinich 12y ago
What did the XMPP change have to do with Vic?
- presootto 12y ago
  Nothing at all; this was a decision made by the Hangouts team. The XMPP change has to do with the NIH syndrome a lot of Google engineers suffer from, combined with the incompetence of the Hangouts PM, Kate Cushing. Disclaimer: I work for Google.
  - zanny 12y ago
    But google invented Jingle, and in the XMPP space I can't imagine they didn't have a dominate authority. And you can add whatever extensions you want to XMPP, standard or not.
    - ralphm 12y ago
      Google did start Jingle and large part of their work ended up in the Jingle standards at the XMPP Standards Foundation. However, Google Talk and the old Hangouts took quite a while to move to the standardized version, and were never fully compliant. Also, in other areas, Google never quite interacted with the community and left major issues unresolved. Basically all of the issues, perceived flaws or missing features attributed to XMPP in the old implementation of Hangouts were either misinformed or have seen development or new specifications in the XSF. Google never contributed to such discussions, with the exception of individual Googlers helping with Domain Name Associations (DNA, http://tools.ietf.org/html/draft-ietf-xmpp-dna-05 http://tools.ietf.org/html/draft-ietf-xmpp-dna-05).
  - zx2c4 12y ago
    So far as I can see, the Hangouts implementation still uses XMPP, and even sends some federated messages to other servers. It looks like there has been some kind of code added to specifically block the functionality for which code already exists.
    - 12y ago
pjc50 12y ago
Presumably the defederalisation was to enforce chatting (a) such that google knew your real name and (b) such that you were subject to surveillance.
girvo 12y ago
Know the worst part of Hangouts? Using any client other than the crappy extension for Chrome, you can't do group text chats. Flamingo[0] is an amazing XMPP client for Hangouts, but is useless for work because we use group chats for everything. Drives me crazy, and Google refuse to release an actual API for Hangouts, so it's not being fixed anytime soon. I'm trying to convince work to move to IRC or HipChat, or anything other than Hangouts (but my boss loves Google everything, so that's a losing battle). [0] http://flamingo.im http://flamingo.im
- joosters 12y ago
  Yes! It's really frustrating because if you are using another chat client (e.g. Apple messages), everything seems to work except you won't see any sign of group chats. This has caused plenty confusion for me with friends wondering why I'm not responding to messages. What's even worse is that Google's hangouts app is pretty much unusable. For some reason it doesn't list all of my contacts, won't show if anyone is available and gives no indication about who I could chat with.
  - girvo 12y ago
    Yep. And it refuses to use Mavericks notification centre, and it hates multi monitor setups as well. Sigh.
  - sitkack 12y ago
    We don't we just stop using google hangouts if they are such a PoS? Is it the screen sharing? Everyone is already logged in? I find them infuriating, and only use it begrudgingly.
- fossuser 12y ago
  I'd recommend checking out slack for your work - we started using it and it's the best chat/collaboration software I've ever used. https://slack.com/ https://slack.com/
- drdaeman 12y ago
  > and Google refuse to release an actual API for Hangouts In old good days we didn't ask for protocols. We just took the specs by force, by reverse engineering. Worked well with ICQ, AIM, MSN Messenger and loads of others, except for, possibly, Skype (which was reverse engineered, but late to the party) And "alternative" messengers survived and even prospered (seriously outplaying the dysfunctional, overweight and ad-ridden "official" ones), even if they were actively fought by network owners. Given that official Hangouts "desktop" app is is nearly completely unusable - and even more for those who don't use Chrome - and even web messenging support is lacking (you just can't put a button "Contact me on Hangouts" on your site), I'm a bit curious why no one cared about Hangouts enough to play that game once again.
izacus 12y ago
That would be awesome, but I don't have high hopes - Google probably wants to have ability to modify protocol as they wish for new features. It seems they practically have no will to build a translation layer :/
- ralphm 12y ago
  In short, it is very unlikely the reasons for abandoning federation, or dropping XMPP altogether with Google Voice, are technical in nature.
- darklajid 12y ago
  That doesn't make a lot of sense though. There are already lots of places where that stuff is falling back to "Sorry, can't do this". Ignoring hardware limitations (running hangout on a phone without a front facing camera maybe?) you already have the 'user runs a browser that needs a plugin to fullfil the request, but plugin is missing' case. Which is reported as a failure to both users (with a somewhat helpful message). Using anything hangout-y over xmpp can fail for all I care. That's not the problem. The problem is that they broke the parts that _map well_. You cannot text me if you're using hangout (unless you're on gmail.com and use the 'gtalk' chat widget). I cannot see your presence. There's a difference between 'not building a translation layer' (for oh-so-awesome new features) and deliberately breaking things that work since, like, forever. I agree with the sibling: It's deliberate and just another Google 'Move to out platform and never get out' move. (Other examples: »"Upgrade" your browser to Chrome.« »Install a "modern" browser to get automatic translation of websites.« - ignoring all the 'Join G+' nonsense)
Svip 12y ago
I am confused. I use DuckDuckGo's Jabber/XMPP service (dukgo.com), and I can easily talk to Google Accounts through Bitlbee, even if they are using Pidgin, GMail's chat interface or whatever. The only obstetrical I have encountered so far, is that it requires at least 3 or 4 tries to add a Google user. But afterwards, it's not a problem. Edit: One of my friends using dukgo.com also confirms this behaviour.
- zx2c4 12y ago
  If they've switched to Hangouts, you will no longer be able to reach them. Google users using the old non-plus-ified gchat, which is being phased out, will still work as before, but for people who get upgraded to Hangouts, they'll be cut off. So this basically includes everyone on a smartphone, or everyone using video chat, and soon it will be just everyone entirely.
  - Svip 12y ago
    Aha. Maybe I just keep good company for failing to notice that.
    - dmix 12y ago
      Apparently they plan to end support for the "old" hangout version at some point in the future. Hopefully it's not soon.
  - josteink 12y ago
    Well that's certainly interesting, but me too, I haven't really noticed that. Because while in the past, my primary reason for installing Pidgin was connecting to Google's excellent XMPP service, I now only have it hooked up to my Facebook account. I don't see any value in Hangouts. That's right. As creepy and closed as Facebook is, I still find it a much higher value service than Hangouts. Plus it actually lets me connect to people I know reliably. Hangouts is the perfect example of taking a good service and throwing it in the shitters. I can barely use the official Android-client. It's just gone completely downhill. It may not be too late for Google to recover from the terrible slope they've taken on ever since the persisted, user-hostile G+ fiasco, but I can't imagine the tarnish their brand has taken to ever have been worth it.
lnanek2 12y ago
I wish they would support open protocols too, but that just isn't Google any more. They are closing down lots of APIs besides XMPP compatibility after all.
shmerl 12y ago
Google is totally messed up. Complete lack of communication of their plans, weird betrayal of XMPP efforts and etc. I gave up on them completely.
dunham 12y ago
One case I think you left out (although I may have misread what you wrote): You can talk between GTalk and a federated XMPP server if the the GTalk user is logged in via XMPP. So if I send a message from my work XMPP server to my google address, it shows up in Adium, but not in the hangouts client. It's almost as if Google's XMPP network is separate from hangouts, and they only allow messages directly to/from the Google XMPP to propagate between them.
Aloha 12y ago
For the past couple weeks I have been able to IM from inside the hangouts app to non-google XMPP users this includes the reverse, wherein I get notifications from them too.

wesley 12y ago

What happens to group chats? as far as I know encrypted group chat is still not supported yet?

pgeorgi 12y ago
That's only for transport level security - messages can still be sent in the clear within the encrypted connection.
daveid 12y ago
That's only for end-to-end encryption, say, OTR. What this is about is connection encryption client-to-server and server-to-server.
MattJ100 12y ago
It's possible to achieve quite secure group chats in XMPP, as long as you have a server that you trust (emphasis on that last part). You're probably talking about OTR though, which is quite tricky for multi-party situations. This isn't XMPP's or OTR's fault - from a high level to have a secure multi-party discussion, every participant must individually verify every other participant. This creates a lot of overhead with large groups. What you can do instead is to delegate your trust to, say, a key member of the group - if they trust every member, so do you. This is the model that XMPP supports. Set up a server that only accepts encrypted and securely-authenticated connections (using whichever mechanism you have the most faith in) and only grant access to the room to trusted individuals.
- drdaeman 12y ago
  I had heard TextSecure/WhisperPush (which uses OTR-like protocol with similar properties) has multiparty/group secure conversations. However I'm unaware of any attempts to apply those to XMPP MUCs, neither I've seen any vetted solution for end-to-end encrypted MUCs.

pgeorgi 12y ago

Luckily they don't require "valid" certificates at this time - trying to get all XMPP server operators to agree on a set of CA providers they all trust will be a nightmare.

andreasvc 12y ago
A nightmare? What gives you that idea? There's free as in beer certificates from StartCom, and free as in freedom certificates from CAcert. Agreeing on those would go a long way.
- Zash 12y ago
  CAcert.org is no longer included by default in many major distributions. They were removed from Debian a while ago. And they also started using SHA-512 (?) signatures that don't work with some TLS stacks, notably GNU TLS.
- pgeorgi 12y ago
  There are parties vested in _not_ supporting CAcert - so that won't happen. But I'm not even talking about those: CAs centralize trust and trust on the internet is a hot topic right now. Right now there's a certain homogenity in which CAs are supported by vendors. And for those that aren't, it isn't much of an issue in the web browser because users can manually click through. Now consider the talk about "Why is CNNIC/TurkTrust/Symantec in my list?" that's raised by various parties recently (concerned about the influence the governments of China, Turkey and the USA respectively can exert), what happens when XMPP servers decide not to trust CNNIC (to pick one)? Users will only notice in that they can't talk to peers. They won't know which server is responsible (or if maybe the GFW is kicking in) and there's nothing they can do about it. From the point of server operators, with mandantory CA signatures they have to decide if they're rather willing to drop perfectly fine connections or if they're accepting "secure" connections subverted by parties they weren't willing to trust in the first place.
  - andreasvc 12y ago
    Yes there is a lot of red tape surrounding certificates, but I was specifically suggesting that the authors of XMPP clients and servers could agree on these 2 alternative CAs.

pdkl95 12y ago

Still wish I had an option for encryption. - certs cost money, which I (and many other people I know) CANNOT[1] afford. StartSSL won't give me a cert (they did previously, but want $$$ now). This problem affects more people than you probably realize. Remember that 15% of the population (48 million people people)[2] in the USA are below the poverty line. The internet has already been a powerful tool, accessible in various ways even at this end of the income spectrum. Despite that, the PKI system is serving as a barrier-to-entry if you want to encrypt. So I ask again: what is a FREE option for SSL. TCP, HTTP, DNS and most other protocols work fine once you can send packets, and do not require an extra regular fee. SSL does. Or is the intent to have secure communication only for those that can afford it - the rest of us doomed to plaintext or rejected as "self signed" by the SSL servers of the rich and middle class? Or are we supposed to only use the internet as if it was TV, and be forced to trust our plaintext with some 3rd party? sigh - I suspect the answer will instead be "[-1] Don't want to be reminded of the hard issues." [1] I realize that the idea of not having an extra $15 doesn't make sense to those of you with salaried jobs. Well, lets see you come up with that extra $15 on a tiny SSDI check. Domain (3rd level) is free. Internet is very cheap and flat-rate. An extra $15 would be some new(-ish) clothes, not a SSL cert. [2] https://www.census.gov/hhes/www/poverty/about/overview/ https://www.census.gov/hhes/www/poverty/about/overview/

MattJ100 12y ago
A self-signed certificate is free, you don't need a CA-issued certificate just to use encryption. Most XMPP servers on the internet today are forgiving of certificates they don't trust - they will encrypt the connection and then use "dialback" to authenticate you based on DNS. Obviously falling back to DNS is not as secure, and as mentioned in the blog post - there are people working on ways to allow people to use any certificate (including self-signed) securely.
- pdkl95 12y ago
  > Most XMPP servers on the internet today are forgiving of certificates they don't trust... I was not aware of that - I'll certainly investigate that possibility. > Obviously falling back to DNS is not as secure Of course, but it's still better than "plaintext".

ape4 12y ago

How about switching away from XML!

claudius 12y ago
Why? What potential gain could possibly justify breaking the entire protocol and extension-ecosystem?
- andreasvc 12y ago
  XML has a large amount of overhead, both in bandwidth and parsing (have a look at the amount of XML that is exchanged just for logging in with XMPP). For low powered devices and low bandwidth connections such as with mobile devices, there is an undeniable gain. It's not necessary to break anything, just as TLS and compression are optional features of the connection, something like switching to ASN.1 would be possible, given a mapping of a pre-defined subset of the main XMPP protocol and commonly used extensions.
  - MattJ100 12y ago
    http://xmpp.org/extensions/xep-0322.html http://xmpp.org/extensions/xep-0322.html (originating from the IoT community, where XMPP is commonly, and successfully, used on embedded devices like you describe). Just please don't mention ASN.1 again :)
shmerl 12y ago
What to? XMP provides a powerful way to manage extensions to the protocol (with namespaces). What else do you propose to use?

ultramancool 12y ago

You're still trusting the server. This is only a gain if you were already the one running the XMPP server with everyone you talk to. Use a real end-to-end solution to this problem: OTR.

MattJ100 12y ago
OTR only protects the text content of your messages. It doesn't protect the metadata, or many of the other features XMPP provides from status to file transfers and voice/video calls.
- shmerl 12y ago
  For media calls there is ZRTP.
  - MattJ100 12y ago
    I'm not an expert in this field, but as far as I know ZRTP trust is bootstrapped from the signalling channel (in this case your XMPP connection). So a MITM there could also MITM your voice/video. And again, your metadata and signalling would still be exposed without encryption - along with your IP addresses (ICE candidates), etc.

makomk 12y ago

Well, looks like this kills off my personal XMPP server - I don't think the software I'm using (djabberd) supports encryption for s2s connections and it's not really developed anymore. That's annoying.

Zash 12y ago
Considered migrating to some other XMPP server software?
- makomk 12y ago
  Most of the XMPP server software out there is neither lightweight nor easy to configure and there's no real migration paths between them. I probably don't even have enough system resources on my personal server to run some of the more well-known servers anyway; they tend to be oriented towards deployment on large multi-user systems.
  - Zash 12y ago
    http://prosody.im/ http://prosody.im/ is pretty light weight and easy to configure. (I'm one of the devs) I don't know how easy it is to move data out of djabberd but I'm sure we can help you with that if you can provide schemas or example data. :)
    - makomk 12y ago
      Yeah, was looking at Prosody. It's probably relatively simple in my case since I'm using the standard SQLite backends for roster storage etc. (Large-scale djabberd deployments likely aren't so lucky - djabberd was designed to make it easy for people to write code hooking in to their existing systems and many did. The only example I can find took a couple of months[1]) [1] http://blog.fastmail.fm/2011/08/24/new-xmppjabber-server/ http://blog.fastmail.fm/2011/08/24/new-xmppjabber-server/
  - andreasvc 12y ago
    I wouldn't worry about system resources; if anything, I'd say that a high-level dynamic language adds most to the overhead. I can recommend http://ejabberd.im http://ejabberd.im

imaginator 12y ago

One of the big problems with XMPP security was testing the server's connection. It's worth pointing out that much of this move has been supported by @xnyhps project: xmpp.net. This lets you stick in an XMPP enabled site and see the results. For example: Google - https://xmpp.net/result.php?domain=gmail.com&type=server https://xmpp.net/result.php?domain=gmail.com&type=server (nothing) and prosody.im: https://xmpp.net/result.php?domain=prosody.im&type=server https://xmpp.net/result.php?domain=prosody.im&type=server

shmerl 12y ago

Looks like things started moving for OTR support in Telepathy: https://bugs.freedesktop.org/show_bug.cgi?id=16891 https://bugs.freedesktop.org/show_bug.cgi?id=16891 ZRTP however is still stalled: https://bugs.freedesktop.org/show_bug.cgi?id=29904 https://bugs.freedesktop.org/show_bug.cgi?id=29904

X4 12y ago

XMPP is an awful protocol [1] [2] . -- [1] http://about.psyc.eu/Jabber#Technical_Issues_in_Jabber http://about.psyc.eu/Jabber#Technical_Issues_in_Jabber [2] https://news.ycombinator.com/item?id=2069810 https://news.ycombinator.com/item?id=2069810

MattJ100 12y ago
Two clearly unbiased and factual analyses there :) It would take quite some time to sit down and address all the points gathered on the PSYC page. That page has been around a long time, and used to be a lot more aggressive than it reads now. At one point it even contained a quote from a mailing list post of mine, snipped to remove just the right amount of context. I'm glad to see they've cleaned it up a bit, to at least make it appear somewhat more objective, even if they still think it's objective to make technical statements like "XMPP isn't proper XML". One of its main points is of performance and scalability. Well I'm afraid that horse bolted - for nearly a decade Google have been successfully running (one of?) the world's largest IM services using XMPP. Regarding your second link, well, that seems to be set on comparing XMPP to IRC: > A protocol that, despite an immense range of features, can easily be typed by a human on a telnet prompt, in real time. Making a protocol that could be typed over telnet obviously wasn't the goal of XMPP. For what it did set out to do - create an open standard IM protocol to give normal people a path to freedom from the old IM silos that were around 10 years ago - I'd say it has been pretty successful. Maybe not as successful as one might have hoped, those silos are still around, but for political and commercial reasons rather than technical ones.