We've enabled SASL2 and XEP-0474: SASL SCRAM Downgrade Protection on http://XMPP.is via https://github.com/unredacted/xmpp.is/commit/ed656a71d112b3a8eb3b54427c164f483cce4b54
This solves one of the most important issues mentioned in our blog post https://unredacted.org/blog/2023/11/what-were-doing-in-response-to-the-jabber-ru-mitm-attack/
We've enabled SASL2 and XEP-0474: SASL SCRAM Downgrade Protection on http://XMPP.is via https://github.com/unredacted/xmpp.is/commit/ed656a71d112b3a8eb3b54427c164f483cce4b54
This solves one of the most important issues mentioned in our blog post https://unredacted.org/blog/2023/11/what-were-doing-in-response-to-the-jabber-ru-mitm-attack/
What's the current state of XMPP and OpenID Connect? My web search returned that ejabberd is still considering if and how to implement and Prosody has experimental alpha-stage support via a module. I couldn't find anything conclusive in regards to XMPP clients. What's with Gajim(?) and Conversations? Or other clients? Are there any web clients supporting OIDC?
@jwildeboer Same with Signal. I can't write anything remotely viral on #XMPP without some self proclaimed security expert stepping up to explain to me how much better Signal is.
I'm afraid that's just how the Fediverse works.
And since you seem to be advocating primarily for Signal you get to experience the XMPP fan boys and I get to enjoy the 'security experts'.
Ich habe den Eindruck, dass Matrix weitaus problemloser läuft als XMPP.
Bei XMPP kann sich nicht jeder Client an jedem Server anmelden (ich habe diverse Clients und Server, nicht nur meinen eigenen mit ejabberd, getestet). Und auch die Kommunikation zwischen zwei Accounts funktioniert manchmal gar nicht, manchmal nur in eine Richtung und irgendwie nur selten problemlos. Auch da wieder stark abhängig vom Client.
Ein Problem mit meinem Server mag sein, dass er unter einer Subdomain (xmpp.example.com) läuft. Ich mutmaße, dass nicht jeder Server bzw. Client damit zurechtkommt. Zwischen meinem Server und dem von Mailbox.org klappt jedenfalls gar nichts. Aber ich habe noch nicht einmal eine Möglichkeit gefunden, für Mailbox.org einen andeten Client als deren Web-Client zu verwenden. Ich glaube fast, die sind nur zu sich selbst kompatibel.
Manche sagen freilich auch, dass ejabberd recht eigenwillig sei.
Mit Matrix hingegen hatte ich bisher keine Probleme (auch da habe ich einen eigenen Server am Start).
So, I have a long-term vision. I want to marry my mobilizon instance (AP) with XMPP.
Each account should also be an XMPP account under the same domain. For this authentication needs to be changed to the style the Fediverse does it. Plus support for 2FA. (XEPs might exist but clients don’t support it that way - maybe oAuth, not widely supported either).
1/2
I’m happy to announce the 12th annual Holiday season Conversations giveaway. 🎄☃️
The federated instant messaging client is now available for free on Google Play until New Year’s Eve. 🧨🎆
Merry Christmas, Happy Holidays. Enjoy #39C3.
https://play.google.com/store/apps/details?id=eu.siacs.conversations
#XMPP #Jabber #Conversations_im #DigitalSovereignty #Fediverse
I consider this a failure on our part but I don’t really know what to do about it. Most arguments against #XMPP don’t hold if you’re building from scratch anyway:
• #Conversations_im looks very outdated: OK, but you are developing your own clients anyway.
• XMPP doesn’t have an SDK: Neither does your #ActivityPub or email stack
• OMEMO is insecure and I would prefer #MLS: Yes, let’s work on that together and you’ll still benefit from XMPP’s 100+ solved IM problems.
As a community, we often ask ourselves how to attract more users to #XMPP. Yet the real tragedy is that people would rather build something entirely new (loosely based on email or #ActivityPub) than consider XMPP. Need end-to-end encryption by default? If compatibility with existing XMPP clients is a secondary concern, you can implement it in your own solution while still benefiting from our two decades of experience in instant messaging.
It's not me: it's you!
No, I'm not giving you my phone number nor my email. Your mobile is chock full of apps that harvest every bit of personal data they find in it and keep them to themselves to do who knows what, sell it to the best bidder and even do things I can't imagine. You may not care about your #privacy but I do care about mine. So, you are not getting my phone number even if you want to have my contact on #Signal.
Want to stay in touch? I can give you my #XMPP address though.
