this post was submitted on 02 Nov 2023
0 points (NaN% liked)

Privacy

32004 readers
932 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
0
Matrix vs. XMPP, Security, Privacy, Apps, Efficiency ? (www.youtube.com)
submitted 1 year ago by [email protected] to c/[email protected]
9 comments fedilink hide all child comments
 

I recently saw Alex's video about XMPP and I got curious.

I am using Element and Schildichat a bit, trying Element X and curious about the new Development here. It seems vibrant, they rewrite stuff in rust, the Apps are fancy and all.

But I tried Conversations and it seems based too, has transparent encryption, it is damn fast, usable, supports groups and files and all. Probably doesnt use the latest fancy Android SDKs but it seems solid.

I was surprised about how fast it was, as Matrix drastically varies per server. But also I found many dead communities, and in general I dont see XMPP at all, while many Projects (if not using Discord, bruh...) have a Matrix room.

How secure is OMEMO in todays standards? Or OpenPGP, compared to Matrix or Signal Encryption? I heard it also has rotating keys and all.

There are other things, like permission systems, chosen federation, privacy, bridge support and more, that are interesting. Are there advanced modern WebUIs for XMPP you like?

I saw that it uses up waaay less resources, why is that? Really, is "simply encrypted mail" somehow worse in an important way?

Similar to IRC, where I never found nice usable apps for my taste, I thought XMPP was deprecated, but that doesnt seem so?

What can you tell me about XMPP, is it modern, secure, privacy friendly?

top 9 comments
sorted by: hot top controversial new old
[–] [email protected] 0 points 1 year ago* (last edited 1 year ago) (1 children)

XMPP is like email, a very open standard that was designed for interoperability even with more closed servers that included proprietary features and extensions. It can be configured to be secure and private. Matrix is another attempt at a more closed protocol / ecosystem with the difference that you can self host it. There have been also multiple complaints about the amounts of metadata that Matrix scatters across servers.

The only thing I dislike about XMPP is that stuff like push notifications and proper mobile clients aren't as easy to get as they are with Matrix. Privacy and protocol-wise I would pick it any day - even if the only advantage is that is is considerably simpler than Matrix.

https://hackea.org/notas/matrix.html

[–] [email protected] 0 points 1 year ago (1 children)

Can you elaborate on what you mean that Matrix is a closed protocol? The spec is open and there are several server and clients to choose from.

[–] [email protected] 0 points 1 year ago (1 children)

Matrix is developed by a for profit entity, a group of venture capitalists and having a spec doesn't mean everything. XMPP is an open standard, truly open and if you notice you've had a lot of implementations of it all able to properly integrate with each other without effort.

The way Matrix is designed is to force into jumping through hoops and kind of draw all attention to Matrix itself instead of the end result. The kind of open collaboration where the protocol becomes mostly invisible for the end user isn't just the objective of Matrix.

[–] [email protected] 1 points 11 months ago

Matrix is developed by a for profit entity, a group of venture capitalists and having a spec doesn’t mean everything (...) The way Matrix is designed is to force into jumping through hoops and kind of draw all attention to Matrix itself instead of the end result

For all the people downvoting my original comment this was just out. Oh well what do I know...

Decentralized communication protocol Matrix shifts to less-permissive AGPL open source license

Element, the company and core developer behind the decentralized communication protocol known as Matrix, has announced a notable license change that will make the open source project just that little bit less appealing for companies looking to build on top of it.

https://techcrunch.com/2023/11/06/decentralized-communication-protocol-matrix-shifts-to-less-permissive-agpl-open-source-license/

[–] [email protected] 0 points 1 year ago* (last edited 1 year ago) (1 children)

This is good reading on XMPP

https://privacy.awiki.org/im.html#XMPP

And one about matrix

https://hackea.org/notas/matrix.html

I think that XMPP is obviously the superior choice here. Matrix is funded by venture capitalists that need to make money some way and they are actually recollecting users' data for that.

[–] [email protected] 0 points 1 year ago (1 children)

Do you have a source for the claim that collecting userdata is ultimately what funds Matrix?

[–] [email protected] 0 points 1 year ago* (last edited 1 year ago) (1 children)

have you read the article I linked?

I didn't say it was ultimately what funds matrix, they sell servers too, but they recollect data that's for sure.

Quoting the article here:

matrix.org and vector.im receive a lot of private, personal and identifiable data on a regular basis, or metadata that can be used to precisely identify and/or track users/server, their social graph, usage pattern and potential location. This is possible both by the default configuration values in synapse/Riot that do not promote privacy, and by specific choices made by their developers to not disclose, inform users or resolve in a timely manner several known behaviors of the software.

Data sent on a potential regular basis based on a common web/desktop+smartphone usage even with a self-hosted client and Homeserver:

The Matrix ID of users, usually including their username.

Email addresses, phone numbers of the user and their contacts.

Associations of Email, phone numbers with Matrix IDs.

Usage patterns of the user.

IP address of the user, which can give more or less precise geographical location information.

The user’s devices and system information.

The other servers that users talks to.

Room IDs, potentially identifying the Direct chat ones and the other user/server.

With default settings, they allow unrestricted, non-obfuscated public access to the following potentially personal data/info:

Matrix IDs mapped to Email addresses/phone numbers added to a user’s settings.

Every file, image, video, audio that is uploaded to the Homeserver.

Profile name and avatar of users.
[–] [email protected] 0 points 1 year ago

I did, yes. TBH it is very anti-Matrix right out of the gate, makes a mountain out of a molehill and it even admits that it contains FUD.

There's a couple of things that are misleading in it (for example the section on bridges) and the critique basically boils down to "if you use the identity servers that are run by Matrix.org with your self-hosted homeserver they can see the info you send to them" and "Google Analytics in Element is bad".

All in all I didn't find it very convincing, and very lacking in nuance.

[–] [email protected] 0 points 1 year ago* (last edited 1 year ago)

XMPP is much more popular for private messaging, so you don't have many large public group chats like on Discord (and lesser extend Matrix). It can do it, but clients are not really optimized for that to be honest.

You can btw learn more on https://joinjabber.org

As for the specific questions on e2ee: OMEMO as it is currently implemented in most clients is very similar to Signal in security, but like Signal it does not encrypt metadata. There is an updated OMEMO standard that does encrypt metadata as well, but it hasn't been adopted by any popular XMPP clients yet. However both versions are significantly more secure than Matrix's MegOLM, which has chosen to sacrifice a lot of security for user convenience IMHO.

XMPP is actively developed, but it doesn't have much funding for the open-source efforts, so it lacks PR and some things don't develop as quickly as what you might be used from VC funded for-profit companies like Element/matrix.

I like the Movim webclient, but most current users seem to prefer the native clients for XMPP.

XMPP uses way less resources because it was designed to scale to billions of users for chat, instead of being some over-engineered failed experiment to use a DACS for chat, which really isn't a good idea and never was.