Why Jabber reigns across the Russian cybercrime underground

Re:Why Jabber reigns across the Russian cybercrime underground by sillysaurusx on Sunday January 17, 2021 @10:02PM (#25817658)

About a decade ago (Oh no, it's never a good sign when you can legitimately start a story like that...) I was introduced to Jabber by a friend. I was complaining that I really wanted to talk to him about a certain topic, but that the topic was sensitive enough that I was paranoid about it being logged forever on some server somewhere.

He pointed out the OTR plugin, and it blew my mind that it was guaranteed that no one could possibly snoop our conversation.

I knew that it was theoretically possible, but I can't overstate how important it is to package the crypto in a user-friendly way. Being able to get the session going in about 30 seconds was a killer feature.

But, more than that, it seemed to have an advantage over present-day Signal: I use Signal now, but I always feel a bit queasy about trusting it implicitly. I do trust it, but it's such a massive ecosystem now that it doesn't feel nearly as "transparent" as the OTR plugin did. The OTR plugin was like, if this is broken, there are many eyeballs that will know pretty quickly. Whereas Signal doesn't quite feel the same way.

I'm not entirely sure why, or if that feeling is just me. There's no reason to feel like an OTR plugin is inherently more secure. And yet, as evidenced by the article, it was rock solid for 18 years.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by throwawa4234324 on Sunday January 17, 2021 @11:09PM (#25818007)

> I use Signal now, but I always feel a bit queasy about trusting it implicitly. I do trust it, but it's such a massive ecosystem now that it doesn't feel nearly as "transparent" as the OTR plugin did

Conversations on Android works quite well for XMPP on Android. Quicksy by the same author even has phone-based discoverability.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by approxim8ion on Monday January 18, 2021 @05:19AM (#25820236)

Conversations reminds me of Google Talk in a good way. Also blown away by how fast onboarding and message delivery is over XMPP.

Movim is another pretty great XMPP client.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by vlovich123 on Sunday January 17, 2021 @10:34PM (#25817798)

The technical and product requirements that Signal is solving is drastically different to anything attempted before in the open source community. Signal is only looking to generate a movement to guarantee e2e encryption across all chat and social stacks. They don’t care who ends up owning the social wars, as long as that becomes the new standard. Think of it as an attempt to strike at the heart of the capitalistic forces that have diverted that kind of research away from production. It’s a brilliant strategic play they’re doing so I’m more grateful to figuring out how to do that because it looked like it had repeatedly failed in the past.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by joe_the_user on Sunday January 17, 2021 @10:42PM (#25817843)

I'm in one reading group that uses signal primarily for its communication. We have not been able to figure out what we're going to read next because suggested texts get lost as people make random comments.

I hope that post Facebook messages gets to the level of threaded messages. Sometimes pure chat is enough and sometimes chat is really annoying for accomplishing things.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by nyokodo on Monday January 18, 2021 @02:09AM (#25819078)

Maybe have a channel for chat and a separate one for reading suggestions?

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by oh_sigh on Monday January 18, 2021 @12:31AM (#25818516)

The alternative to capitalistic forces showing you ads personalized based on your conversation isn't to get the same app with no ads at all - it is either get the same app just with non-personalized ads, or no app at all.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by remexre on Monday January 18, 2021 @01:11AM (#25818735)

well... signal doesn't have ads...

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by nine_k on Monday January 18, 2021 @01:19AM (#25818784)

Why, outright paying for products and services is pretty capitalistic! Works well in many cases.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by esyir on Monday January 18, 2021 @03:20AM (#25819477)

That's a fine argument and all, but practically speaking, we see that as driven content for free outcompetes.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by vlovich123 on Friday January 22, 2021 @03:10AM (#25869542)

Disallowing such content then might be the right solution if you view the societal trade offs as not being worth the increased economic activity.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by pabs3 on Sunday January 17, 2021 @11:59PM (#25818336)

OTRv3 is definitely not considered secure now, there is an unimplemented and unfinished OTRv4 that updates the crypto though:

https://github.com/otrv4/otrv4

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by upofadown on Monday January 18, 2021 @05:15AM (#25820208)

OTR is certainly simpler than Signal. Signal's claim to fame is that it can deal with the case of an offline client and still offer forward secrecy. In Signal's case that means a server based infrastructure to store cryptographic state that the decentralized OTR gets along without. On top of that, Signal's per message forward secrecy (OTR is per session) adds even more complexity.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by nousermane on Monday January 18, 2021 @08:13AM (#25821455)

> deal with the case of an offline client and still offer forward secrecy.

Wasn't that addressed by OMEMO, the OTR "replacement" protocol?

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by upofadown on Monday January 18, 2021 @04:11PM (#25826678)

Yeah. Basically Signal protocol over XMPP. It uses the XMPP server for the stored/delayed cryptographic state which is why you need a server that can do PEP (Personal Eventing Protocol) if you want to do OMEMO.

OMEMO has pretty much replaced OTR in the clients so if you want simple/stateless you are left with one of the two PGP flavours.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by 1ark on Sunday January 17, 2021 @10:39PM (#25817828)

You are right to feel uneasy about Signal, because there is a possibility (I don't know how big) to snoop and is centralized. Checkout Session, forked Signal with decentralized infrastructure.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by 1vuio0pswjnm7 on Monday January 18, 2021 @12:02AM (#25818352)

Session relies the Loki network overlay. Loki is another cryptocurrency.

Any decentralised alternatives without the cryptocurrency linkage.

[ Parent | on HN ]

Re:Why Jabber reigns across the Russian cybercrime underground by 1ark on Monday January 18, 2021 @04:29AM (#25819921)

Yes, the Loki is the incentive to running nodes. Jami is decentralized without incentives. Berty.tech is distributed, also without incentives.

[ Parent | on HN ]