Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Messenger systems compared by security, privacy, compatibility, and features

docs.google.com

Post reply on HN
Print view View original

71–80 of 242 posts

Re: Messenger systems compared by security, privacy, compatibility, and features

#71

Post by pmlnr »

arendtio wrote: post #42

Well, that is a protocol comparison. A client comparison would be much closer to the real world user experience. Don't get me wrong, I am a huge fan (and daily user) of XMPP, but the best protocol will not be of any use if the clients are too complicated or buggy to use. So yes, XMPP supports audio and video calls but finding two different clients which work on the first try together can be a challenge. Sometimes I w…

> real world user experience

I'm getting so tired of this. Real world user experience is that the constantly changing interfaces are driving everyone mad.

Stick to a thing and let people learn it.

Re: Messenger systems compared by security, privacy, compatibility, and features

#72

Post by pmlnr »

fyfy18 wrote: post #10

Are there any good XMPP clients that provide a "modern" messenger experience? For example seamlessly switching between online/offline mode, built in audio and video calls, sharing photos/videos.

Cross platform, closed source, including Jingle (audio/video): http://astrachat.com/

Android (no audio/video): https://conversations.im/

Web: https://conversejs.org/

Web with extras: https://movim.eu/

Desktop (Mac): https://adium.im/

Desktop (Win): https://gajim.org/ (not sure about this)

Desktop (Linux): http://pidgin.im/ (needs extras: https://petermolnar.net/instant-messenger-hell/#extra-plugin... )

Re: Messenger systems compared by security, privacy, compatibility, and features

#73

Post by vader1 »

lvh wrote: post #68
arendtio wrote: post #61

Earlier quoted context omitted.

Your points are valid but you didn't mention that OMEMO [1] implements Double Ratchet for XMPP. You can find a list of clients which support OMEMO on https://omemo.top [1] https://en.wikipedia.org/wiki/OMEMO

That's a fair point, but the fact that there's yet another protocol, not mentioned on the XMPP E2E wiki, kinda plays into the point itself: XMPP has E2E maybe with a bunch of random protocols and the stars (and the people you talk with) need to align _just right_ for all of it to work. I think it would be fair to say that everyone uses WhatsApp and I know what they get, and at this point only XMPP people use XMPP (ex…

Fair enough, but this is kind of inherent for anything based on open standards. Was your email encrypted? It depends on whether the sending and receiving mailserver support TLS. Is your website visit perfect-forward-secret? Depends on whether your browser and the webserver support modern cipher suites. Is your DNS request encrypted? Only if your OS and your DNS server support DNSSEC or DoH.

These are valid challenges, but moving to propietary and centralized solutions instead is throwing away the baby with the bathwater. Was your WhatsApp conversation encrypted? You honestly can't know, and even if it is right now, Facebook could disable Whatsapp's e2e encryption at any time without you even noticing.

FWIW, OMEMO has been the (only) de facto encryption mechanism for modern XMPP clients in the last couple of years, and most clients that support it clearly distinguish encrypted and non-encrypted messages.

Re: Messenger systems compared by security, privacy, compatibility, and features

#75

Post by [deleted] »

cbg0 wrote: post #55
lucideer wrote: post #37

As there's pretty obvious bias showing in the values, some methodology would be good to accompany this sheet. e.g. - Telegram: E2E Private: TRUE - WhatsApp: E2E Private: CLAIMED These are either both "true", or both "claimed". Pick one. In particular, what's the definition of the "Open Spec" column? Signal's GPL spec gets a FALSE here so I'm presuming the definition is something along the lines of "Spec produced by o…

The comments specify what "claimed" means: > Not possible to verify as application is closed source. Maintainer could compromise security at any time without detection. I think it's useful to have this differentiation, even though technically you could say E2E is TRUE for both of these.

[deleted]

Re: Messenger systems compared by security, privacy, compatibility, and features

#76

Post by LinuxBender »

There is no mention of Mumble (client) or Murmur (server). [1] From a privacy perspective, I find it superior to everything else. End-to-end voice encryption with PFS. As much or little server logging as you wish. Super easy to set up and scales to large numbers of people. I have a few of them running on VM's with 1GB ram. Only downside for me: It is not as happy-clicky (frictionless) as discord, yet.

Authentication can be tied into 3rd party apps (LDAP, phpBB, etc) but I have not tested this yet. [2]

If you try it, use their latest snapshot for server and client. Incredible sound quality. Nice UI/UX experience. Decent support for game overlays. Very low CPU usage.

[1] - https://wiki.mumble.info/wiki/Main_Page

[2] - https://wiki.mumble.info/wiki/3rd_Party_Applications#Authent...

Re: Messenger systems compared by security, privacy, compatibility, and features

#77

Post by vader1 »

pmlnr wrote: post #72
fyfy18 wrote: post #10

Are there any good XMPP clients that provide a "modern" messenger experience? For example seamlessly switching between online/offline mode, built in audio and video calls, sharing photos/videos.

Cross platform, closed source, including Jingle (audio/video): http://astrachat.com/ Android (no audio/video): https://conversations.im/ Web: https://conversejs.org/ Web with extras: https://movim.eu/ Desktop (Mac): https://adium.im/ Desktop (Win): https://gajim.org/ (not sure about this) Desktop (Linux): http://pidgin.im/ (needs extras: https://petermolnar.net/instant-messenger-hell/#extra-plugin... )

Pidgin is barely maintained for the last couple of years and doesn't support most modern XMPP extensions. I'd definitely recommend Gajim on both Windows and Linux, which supports everything you need out of the box.

Re: Messenger systems compared by security, privacy, compatibility, and features

#78

Post by pmlnr »

vader1 wrote: post #77
pmlnr wrote: post #72

Earlier quoted context omitted.

Cross platform, closed source, including Jingle (audio/video): http://astrachat.com/ Android (no audio/video): https://conversations.im/ Web: https://conversejs.org/ Web with extras: https://movim.eu/ Desktop (Mac): https://adium.im/ Desktop (Win): https://gajim.org/ (not sure about this) Desktop (Linux): http://pidgin.im/ (needs extras: https://petermolnar.net/instant-messenger-hell/#extra-plugin... )

Pidgin is barely maintained for the last couple of years and doesn't support most modern XMPP extensions. I'd definitely recommend Gajim on both Windows and Linux, which supports everything you need out of the box.

> doesn't support most modern XMPP extensions

Hence the link for extras, but it is a valid issue. Gajim is XMPP only, where Pidgin is multi-protocol, which is the main reason why I'm still using it.

Re: Messenger systems compared by security, privacy, compatibility, and features

#80

Post by Boulth »

lvh wrote: post #45

This is neat but it has plenty of flaws. I wish the definitions were spelled out. It says Signal isn't "anonymous", which I assume means "uses a phone number to find peers". And it has the usual feature matrix problem: sure XMPP "does E2E". But what does that mean? It supports S/MIME. Do you want S/MIME? (You don't.) It supports OTR, TS and SCIMP too: but you need to be an expert in messaging schemes to understand ho…

> It supports S/MIME. Do you want S/MIME? (You don't.)

Could you provide your source? I've never seen S/MIME used in XMPP. Client certificates for authentication sure but not for E2E security.

> It supports OTR, TS and SCIMP too: but you need to be an expert in messaging schemes to understand how those are different.

OTR is being rolled back from clients in favor of OMEMO for good reasons: https://conversations.im/omemo/

Post reply on HN