This is great, I have not seen this post before. Thank you for sharing.
You make an excellent point here, that the burden of security and privacy is put on the user, and that means that the other party in which you’re engaged in conversation with can mess it up for the both of you. It’s far from perfect, absolutely. Ideally you can educate those that are willing to chat with you on XMPP and kill two birds with one stone, good E2EE, and security and privacy training for a friend. XMPP doesn’t tick the same box as Signal though, certainly. I still rely heavily on Signal, but that data resides on and transits a lot of things that I don’t control. There’s a time and a place for concerns with both, but I wanted to share my strategy for an internal chat server that also meets some of those privacy and security wickets.
Never cared for the way this fellow tries to argue that everything is too difficult to be useful. I’ve gotten plenty of friends and family on XMPP and the clients that don’t have encryption on by default are easy to remember. Really blowing it out of proportion.
Honestly, what do security researchers like this even know about normal people? They sit through all kinds of inconveniences to use Facebook. This is a thought experiment.
Some of these are valid criticisms, of course, a lot of XMPP stuff feels like it from the 2010s. It’s still the only real option. Matrix client or server is bloated garbage, theu moved server fixes into a walled garden, its development is dependent on funding from the USA National Endowment for Democracy technology fund. Signal has similar funding issues and is very shady with its centralization, trust issues, demanding phone numbers. Sets users up to leak all kinds of stuff in notifications like Matrix.
The strange insistence that only Signal meets their requirements makes me skeptical, as does the way they have operated in Github threads. They seem like an emotional nightmare to work with.
This is great, I have not seen this post before. Thank you for sharing.
You make an excellent point here, that the burden of security and privacy is put on the user, and that means that the other party in which you’re engaged in conversation with can mess it up for the both of you. It’s far from perfect, absolutely. Ideally you can educate those that are willing to chat with you on XMPP and kill two birds with one stone, good E2EE, and security and privacy training for a friend. XMPP doesn’t tick the same box as Signal though, certainly. I still rely heavily on Signal, but that data resides on and transits a lot of things that I don’t control. There’s a time and a place for concerns with both, but I wanted to share my strategy for an internal chat server that also meets some of those privacy and security wickets.
Never cared for the way this fellow tries to argue that everything is too difficult to be useful. I’ve gotten plenty of friends and family on XMPP and the clients that don’t have encryption on by default are easy to remember. Really blowing it out of proportion.
Honestly, what do security researchers like this even know about normal people? They sit through all kinds of inconveniences to use Facebook. This is a thought experiment.
Some of these are valid criticisms, of course, a lot of XMPP stuff feels like it from the 2010s. It’s still the only real option. Matrix client or server is bloated garbage, theu moved server fixes into a walled garden, its development is dependent on funding from the USA National Endowment for Democracy technology fund. Signal has similar funding issues and is very shady with its centralization, trust issues, demanding phone numbers. Sets users up to leak all kinds of stuff in notifications like Matrix.
The strange insistence that only Signal meets their requirements makes me skeptical, as does the way they have operated in Github threads. They seem like an emotional nightmare to work with.