Re:Drawbacks of P2P and a defense of Signal
by southerntofu on Sunday January 31, 2021 @03:01PM
(#25982019)
> Matrix has a really good solution for end to end encrypted group chat
It's basically the same encryption scheme as Jabber/XMPP uses with OMEMO. The two were developed around the same time. On Jabber existing rooms need to be set to "members only" and "non-anonymous" for encrypted groupchat to take place because Jabber multi-user chats enable using nicknames (only the MUC operators know your address) which prevents clients from querying each other's key.
> I had to bundle something like 30 megs of jar files for a simple hello world app.
That sounds horrible. There's pretty good XMPP libraries around nowadays, like slixmpp if python is your thing. There's also a WIP Rust xmpp library if you'd rather.
> Also some silly things like ejabberd refusing to hash passwords
That sounds creepy. However, prosody does that very well though. And it seems ejabberd supports SCRAM authentication since 2007?
> Matrix, with Element (...) If XMPP has anything like that
ConverseJS is a web-based Jabber/XMPP client that does encrypted groupchat. It's supported by other clients as well (such as Conversations on Android). Movim, the more popular Jabber web client (because it has social features) does not support OMEMO yet unfortunately.
ConverseJS may not be as user-friendly as Element though because they don't have (yet?) the $$$$$$ of VC/government money matrix has.
> still working on getting a committee together to form the standards
There is a bureaucratic tendency around the XMPP Standards Foundation, because standardization is very important to avoid lock-in. However client devs have pushed features before/meanwhile publishing specifications and bureaucracy does not seem to be a concern for (some?) devs in practice.
It's basically the same encryption scheme as Jabber/XMPP uses with OMEMO. The two were developed around the same time. On Jabber existing rooms need to be set to "members only" and "non-anonymous" for encrypted groupchat to take place because Jabber multi-user chats enable using nicknames (only the MUC operators know your address) which prevents clients from querying each other's key.
> I had to bundle something like 30 megs of jar files for a simple hello world app.
That sounds horrible. There's pretty good XMPP libraries around nowadays, like slixmpp if python is your thing. There's also a WIP Rust xmpp library if you'd rather.
> Also some silly things like ejabberd refusing to hash passwords
That sounds creepy. However, prosody does that very well though. And it seems ejabberd supports SCRAM authentication since 2007?
> Matrix, with Element (...) If XMPP has anything like that
ConverseJS is a web-based Jabber/XMPP client that does encrypted groupchat. It's supported by other clients as well (such as Conversations on Android). Movim, the more popular Jabber web client (because it has social features) does not support OMEMO yet unfortunately.
ConverseJS may not be as user-friendly as Element though because they don't have (yet?) the $$$$$$ of VC/government money matrix has.
> still working on getting a committee together to form the standards
There is a bureaucratic tendency around the XMPP Standards Foundation, because standardization is very important to avoid lock-in. However client devs have pushed features before/meanwhile publishing specifications and bureaucracy does not seem to be a concern for (some?) devs in practice.