Nostr Web Client

Why is XMPP More Secure than Signal?

Trump's Signal leak is a great time to educate you on XMPP. Why is it better?

a) Server Control

Signal is hosted on an external power (Amazon) that you have no control over. And the metadata protection, (for who is talking to who), has been proven to be vulnerable to attackers. [1] This alone could be how the CIA knows if Tucker Carlson is talking to Putin, without reading the message contents.

b) Server-side Identity

Any end-to-end encrypted messenger has two "identities". The first is the account that the server has the password and access to. And second identity is the encryption keys on your device.

Signal uses phone numbers for server-side accounts, which is an external source of identity and truth. This is outside the control of even Amazon (the server). Even if you don't have the pin passcode, the phone number can still be re-assigned. And although this would close current conversations, a hacker can then use the same identity for phising attacks.

On the other hand, XMPP server-side identities are on a server you control and pick. And if done on a Tor Onion, then even a poor civilian with low resources can self-host it on a Rasberry Pi in their home.

c) Client-side Encryption

When Signal users change devices or encryption keys, it only gives a warning that's easily ignored. While as with XMPP, it can't function without drawing attention. Further, XMPP gives much more fine-grained control over which OMEMO encryption keys the users will trust or not (seeing all of the different choices). This is unlike Signal, which forces a binary decision.

d) Group Entry

XMPP allows the server operator to configure groups to only allow entry from users ON THE SAME SERVER. It is possible to "de-federate". This provides massive security benefits, to properly administer who has authorized accounts to even be using the server-side identity to begin with.

In sharp contrast, Signal accounts have no distinction between members of your organization and foreign phising attackers. And SimpleX would be horrible for figuring out who is part of your group.

e) Stronger than Matrix

Matrix is far weaker than XMPP for metadata protection, because Matrix chats go to each of the member's homeservers. This leaks to Matrix-org, (which is on Cloudflare), all metadata if even 1 person from that server is in your group.

In sharp contrast, XMPP has group chats stay on your server itself. And members have to connect directly to your server to get precious metadata.

Conclusion

Given XMPP's powerful security, metadata protection, low cost, and decentralized nature,

You can see why we include XMPP with Email (and potentially your own website), in our Cloud Combo package...

Under this plan, you get a year of friendly support from our dedicated team. But zero external rules (or control over you), because of our decentralized server administration. Because it’s fully decentralized, it avoids us being on the legal hook for dispersed servers around the world, that you alone control. In fact, it’s unclear who is even our customer.

You can get started for just $100 for a complete setup and a full year of support,

https://simplifiedprivacy.com/email-cloud-combo/index.html

Sources on Signal’s metadata vulnerabilities:

[1] https://simplifiedprivacy.com/signal/index.html

And if you like my articles, consider reposting. As we don't use Twitter or Youtube.

Reply to this note

Please Login to reply.

Discussion

Anon 9mo ago

It’s always been perplexing to me why XMPP never gained huge momentum. My phone (JMP) actually runs over XMPP. It works brilliantly, and can be paid for in Bitcoin. And you can even self-host your XMPP sever if you want to.

In my case, the XMPP client I use to make and receive calls on my phone runs on top of silent.link eSIM service, also paid for in Bitcoin.

It’s not perfect but it’s a pretty sweet setup. The only thing JMP sees is my anonymized IP address.

acronym 9mo ago

JMP takes Monero also, awesome company. XMPP is easy and flexible.

Islamic Audiobooks Central 9mo ago

Part of the reason is probably that unlike #Matrix, #XMPP still has no cross-platform fully-featured client.

Ryu Santiago 9mo ago

You are one of a few JMP users in the wild, and I wonder how well you feel it'd pair with something like Silent Link.

Anon 9mo ago

My experience has been super positive so far. I like the whole idea of buying data and phone number from two different entities.

Silent Link is pretty sweet. None of this fixed monthly fee nonsense. You pay some small amount per gigabyte and when you’re running low on data, you just send them a Lightning payment. I bet I’m paying less than $5/month, versus Verizon which was charging me around $50.

You’ll end up with a third world IP address — in my case I got one from Warsaw Poland. Doesn’t matter though, because I run a VPN on top of it so that IP is never seen by anyone but the VPN provider. Speed and latency isn’t world class but it’s acceptable.

I do most of my conversations (including voice) over Signal, Telegram, and WhatsApp so in theory, I could stop there. But for the cases where I need a phone number, like to get SMS notifications for doctors appointments, etc. I ended up getting a number from JMP. They’re pretty solid. I think I’m paying $5/mo (in Bitcoin) for the phone number and it just runs over an XMPP. It’s solid.

Ryu Santiago 9mo ago

So you're telling me that if I don't go with a non-recycled carrier number plan, to do this instead... fucking SOLD.

Anon 9mo ago

Yeah, it’s a great combo for someone who’s technically inclined and privacy-minded. It’s not for everyone though.

Some cons are:

For people who spend a lot of time chatting remotely over legacy phone service, like say a field worker who has to be on call, there’s just enough latency to make the conservation difficult at times. For me, I rarely make legacy-style voice calls, and when I do, I’m almost always on WiFi so everything is fine. But for those that don’t fit that profile, it might be a problem.

Also note that since JMP is a VoIP service, some institutions (typically banks) won’t send a TFA code to you. This isn’t a JMP-specific issue. It applies to all VoIP services. Again, not a huge issue for me but it could be for some. Some people choose to have a $5 flip phone or other SMS services for such situations. Others choose to have the TFA code sent via email. For others it’s a non issue. Just depends who you do business with.

EspañolLuchador 9mo ago

Is there a tutorial? And what do you think about Session messenger ?

SimplifiedPrivacy.com 9mo ago

Please see this on XMPP overview:

https://video.simplifiedprivacy.com/xmppclients/

Yes Session is cool, we use it for an uncensored email list:

https://simplifiedprivacy.com/uncensored/index.html

Bill Cypher 9mo ago

You can cut down the risks of Signal by using a Google Voice number as your Signal number and using hardware 2fa on that Google account. Then enable registration lock in Signal to force a 7 day hold for moving the Signal account if the pin is unknown.

MAHDOOD 9mo ago

I thought it wasn’t a leak and that they just added the wrong person to the group

SimplifiedPrivacy.com 9mo ago

yes please see point "d" on group entry

Tubii 9mo ago

A bit off-topic, but your nostr profile's NIP-05 identified is not verified and instantly rendering your site as a spoofed one. Please check.

SimplifiedPrivacy.com 9mo ago

Hey thanks, I removed it, is it still showing it? Rather just leave it blank given the issues with it

Tubii 9mo ago

Yes, it is not there. If you need help with the correct setup, just dm me.

69b59ba8... 9mo ago

🧐

goatmeal 9mo ago

I self-host XMPP for years but I would echo the sentiment of the late cock.li FAQ section where it said that XMPP clients are all garbage

what is the best XMPP client for windows, mac OS, linux, iOS, and android? the only one I "like" is Conversations for android. I want to like gajim for linux but it doesn't have the same functionality as Gajim for windows...

Saberhagen The Nameless 9mo ago

Curious to know what you guys think about these criticisms of the current state of OMEMO+XMPP in this article. Valid? FUD?

Conversations and Gajim are mentioned in it as being one of the most popular clients yet it's crypto libraries are way out of date supposedly.

https://soatok.blog/2024/08/04/against-xmppomemo/

SimplifiedPrivacy.com 9mo ago

Imagine I say to you, "Monero is crap. The sky is blue"

Yes the sky is blue, but why is monero crappy? The cryptography in the implimentation he's criticizing, is just as good as the ones in the next spec he's criticizing it has not advanced to yet. So he makes a long ass ramble about cryptography, but these points are not directly related to any kind of meaningful criticism of XMPP or the cryptography used. Merely that it hasn't changed yet.

Further, his bitching about not having encryption by default is a minor point. Flip it on and move on with life. XMPP gives the user the freedom to decide which crypto to use.

He's completely ignoring all the issues mentioned in my post. The cool thing about XMPP is that the end-user does not have to listen or obey external rules. While as this author is a bitch slave to Signal's board. By the way bro, the sky is blue.

SimplifiedPrivacy.com 9mo ago

What XMPP Client do you recommend?

If you’re using Linux,

Then Dino. But Gajim is a 2nd option.

Gajim audio calls work for Linux only, and NOT on Windows.

If you’re using Android,

Monocles has good texting sync with Linux Dino.

But Cheogram is excellent on it’s own.

If you’re using Windows,

Gajim is great for texts, but can’t do audio call for Windows. You have two audio call options:

Option 1) Mov.im in a Web browser, the pro is this is easy. The con is they see your password because it’s in a browser.

Option 2) Unofficial release of Dino for Windows, which I haven’t personally tried and may have problems:

https://github.com/LAGonauta/dino/releases

If you’re using iPhone,

You have two choices

Option 1) Snikket’s iOS app,

https://snikket.org/app/ios/

Option 2) Siskin, which Snikket is based on,

https://siskin.im/

If you’re using Apple/Mac computers,

Your 2 choices are:

Option 1) the same mov.im in a browser as Windows

Option 2) Beagle.im

Source: https://simplifiedprivacy.com/voip/

goatmeal 9mo ago

I'm still disappointed. on Android, both clients you mentioned plus Conversations cost money via Google play store. I'd have to teach the user to get the unpaid version from F-Droid. The iOS clients are all garbage, and there's nothing for Windows that works well and supports calling. For now I've written off the possibility that normies would use XMPP at all and I just ask them to use Signal instead since it just werks.

SimplifiedPrivacy.com 9mo ago

WHAT?! you're saying a person with a completely compromised device, getting software from Google is the standard?!

We're talking about what is the most private and secure thing. Not what is the easiest to get a normie with a compromised OS and zero knowledge on. In fact, Signal or XMPP is irrelevant then, the whole OS is compromised

goatmeal 9mo ago

if we are talking about the "most secure thing," then our threat model stretches to infinity. who cares if you use omemo on your graphene device. the camera pointed at your bedroom window is calculating your key presses from the vibrations on a nearby bag of potato chips. we should just astral project into the western pure land so that the psychic kids in a government facility can't use their remote viewing powers on us.

tulsi gabbard probably doesn't know how to astral project into the western pure land, and she probably has an iphone. XMPP is nice and all, but the iOS clients tend to be trash.

SimplifiedPrivacy.com 9mo ago

Then by your own logic, why use Monero if Bitcoin can be private enough against the infinity?

It's what is reasonable trade-offs for what you get. There is not a right answer for everyone, but there is a wrong answer for Trump. And that was adding the random person to the chat group, which could have been prevented with XMPP as point d argues.

x92vbb 9mo ago

There's no 100% security.

Even GrapheneOS runs as a VM client and can be compromised by gov/fone service providers by attacking your closed source hardware driver of your GSM/Wifi module.

SimplifiedPrivacy.com 9mo ago

yes true

. 9mo ago

Its on fdroid for free.

x92vbb 9mo ago

I LOVE you for mentioning #XMPP... 🧡🧡

Though it really depends. For normies Signal might me the better choice still.

SimplifiedPrivacy.com 9mo ago

come on down join the xmpp

x92vbb 9mo ago

I use it daily already.

SimplifiedPrivacy.com 9mo ago

I meant join the xmpp group chat for us

x92vbb 9mo ago

I would need some info and an XMPP address/room for that

SimplifiedPrivacy.com 9mo ago

simplified-privacy@groups.simplifiedprivacy.is