XMPP: Admin-in-the-middle

#1

Post by decrypt » Thu, Nov 04, 2021, 7:19 AM UTC

XMPP: Admin-in-the-middle
infosec-handbook.eu

Re: XMPP: Admin-in-the-middle

#2

Post by po1nt » Thu, Nov 04, 2021, 8:33 AM UTC

I wanted to change Matrix for XMPP, now I have one less reason to do so.

Re: XMPP: Admin-in-the-middle

#3

Post by Semaphor » Thu, Nov 04, 2021, 8:38 AM UTC

The article is a weird mix, partially very relevant information [0], partially just saying "using XMPP without E2E encryption is… not E2E encrypted" which is a weird ting to get worked up about. Maybe I’m missing something here?

[0]: And honestly, something I have not thought about. I host my own XMPP server (Prosody) with only 2 accounts, mine and my wife’s, so it doesn’t affect me. But obviously you can’t expect everyone to just host their own server.

Re: XMPP: Admin-in-the-middle

#4

Post by topdancing » Thu, Nov 04, 2021, 8:38 AM UTC

po1nt wrote: post #2

I wanted to change Matrix for XMPP, now I have one less reason to do so.

Most of the problems described here also apply to Matrix.

Also came up on Reddit: https://reddit.com/r/PrivacyGuides/comments/qkhqf7/xmpp_admi...

Re: XMPP: Admin-in-the-middle

#5

Post by Semaphor » Thu, Nov 04, 2021, 8:39 AM UTC

po1nt wrote: post #2

I wanted to change Matrix for XMPP, now I have one less reason to do so.

If only Matrix had nice clients like Conversation or Gajim instead of all those mIRC and Discord look-alikes.

Re: XMPP: Admin-in-the-middle

#6

Post by rvz » Thu, Nov 04, 2021, 8:46 AM UTC

So the hype around XMPP is no better than Matrix then. Oh dear.

Going to keep using Matrix then.

Re: XMPP: Admin-in-the-middle

#7

Post by edhelas » Thu, Nov 04, 2021, 8:48 AM UTC

po1nt wrote: post #2

I wanted to change Matrix for XMPP, now I have one less reason to do so.

Those issue applies as well to the Matrix network since the global architecture is similar :)

Re: XMPP: Admin-in-the-middle

#8

Post by edhelas » Thu, Nov 04, 2021, 8:49 AM UTC

rvz wrote: post #6

So the hype around XMPP is no better than Matrix then. Oh dear. Going to keep using Matrix then.

So the hype around Matrix is no better than XMPP then. Oh dear.

Going to keep using the IETF XMPP Standard then.

Re: XMPP: Admin-in-the-middle

#9

Post by topdancing » Thu, Nov 04, 2021, 8:55 AM UTC

rvz wrote: post #6

So the hype around XMPP is no better than Matrix then. Oh dear. Going to keep using Matrix then.

If there's anything that's overhyped these days, it's Matrix.

https://news.ycombinator.com/item?id=27557113 was so brilliant at capturing my own thoughts/concerns on it.

Re: XMPP: Admin-in-the-middle

#10

Post by lmm » Thu, Nov 04, 2021, 9:20 AM UTC

topdancing wrote: post #9

rvz wrote: post #6

So the hype around XMPP is no better than Matrix then. Oh dear. Going to keep using Matrix then.

If there's anything that's overhyped these days, it's Matrix. https://news.ycombinator.com/item?id=27557113 was so brilliant at capturing my own thoughts/concerns on it.

I think that bit of history shows what a false idol extensibility is. 20 years of extension and improvement has resulted in a chat system that is still staggeringly worse in practice than its competitors of 20 years ago. (Seriously, XMPP is still worse than AIM for actual day-to-day use).

Look at XML vs JSON for another example. A simple standard that has no improvement path except completely replacing it turns out to be much more usable than an extensible, upgradeable standard.