Live data from Hacker News

Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

getkaiwa.com

21–30 of 142 posts

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#21
post #18
post #13

Can I chat with Google Talk users from this?

You will first need an XMPP account but then you can add GTalk users to your roster and chat with them.

GTalk has broken federation for Hangouts users, and they failed to enable s2s encryption, which is mandatory since February: https://github.com/stpeter/manifesto/blob/master/manifesto.t...

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#22

Is there a good mobile client to use with a xmpp serveR?

Besides of the ones referenced in the article, there is also ChatSecure [0] for Android and iOS (with a strong focus on security) and Xabber [1] and yaxim [2] for Android (I am the maintainer of yaxim).

[0] https://chatsecure.org/

[1] http://www.xabber.org/

[2] https://yaxim.org/

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#23
post #19
post #6

I'm curious how E2E encryption (OTR e.g.) could be implemented with a client like this (preferably without having the keys leaked all over the place), it's the only interesting feature I miss from a quick glance.

Unfortunately, this won't improve your security. The client code comes from the server, so you need to trust it anyway. While it is possible to implement OTR or PGP in the client, the server admin could poison the implementation code and leak your private keys.

> The client code comes from the server, so you need to trust it anyway.

Sure, but we have TLS for that. E2E is still needed to cover everything else (e.g., I trust the server now, but I don't want to have plain-text logs on it in case the feds seize it).

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#25
post #14

Excellent work. Is there a reason why you chose Prosody over MongooseIM or ejabberd?

Thank you. We chose Prosody because it supports the XEP we needed and it was originally used by Otalk from which we forked.

Relatedly, why are you recommending only Pidgin, and not Gajim? Gajim covers a lot more XEPs than Pidgin (e.g. editing sent message).

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#26
post #23
post #19

Earlier quoted context omitted.

Unfortunately, this won't improve your security. The client code comes from the server, so you need to trust it anyway. While it is possible to implement OTR or PGP in the client, the server admin could poison the implementation code and leak your private keys.

> The client code comes from the server, so you need to trust it anyway. Sure, but we have TLS for that. E2E is still needed to cover everything else (e.g., I trust the server now , but I don't want to have plain-text logs on it in case the feds seize it).

OTR also breaks Message Archive Management (MAM) and Carbons - the two features making multi-client operation any useful, and highlighted in the article. And with MAM, there actually are plain-text logs of your conversations on the server.

The call is still open on end-to-end encryption over XMPP when multiple devices (or more than two parties) are involved.

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#27
I think this is great. If there were more people pushing clients like this, not only will it push the guys who already make money off of it, but we can do a better job coming up with new communication ideas as a whole.

I'm ONLY using Hangouts because they don't allow group messaging in any other client. I'd like to see that change!

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#28
post #20

I'm planning on setting this up for myself later today but a few questions before I do that: - Will this stay connected to my account and the history will be there if I close the tab / browser / computer in the meantime? - Is it possible to replace certain strings with images? This is not at all an important feature but just something I got used over the years. (Example: :string: replaced with image.png and displayed…

On the homepage they mention they use Message Carbons, so your history should be retained, yes:

  Using Message Carbons (XEP-0280) all of your active conversations will be synced to your Kaiwa client.
Don't know about the second question as I haven't looked at the source, but it doesn't seem all too hard to implement even if its not there.

Re: Show HN: Kaiwa, a Modern Open-Source XMPP Web Client

#30
post #19
post #6

I'm curious how E2E encryption (OTR e.g.) could be implemented with a client like this (preferably without having the keys leaked all over the place), it's the only interesting feature I miss from a quick glance.

Unfortunately, this won't improve your security. The client code comes from the server, so you need to trust it anyway. While it is possible to implement OTR or PGP in the client, the server admin could poison the implementation code and leak your private keys.

> The client code comes from the server

How about hosting E2E js lib somewhere like on Github and include them there?

Or you can always map to local js files.

Post reply on HN