There appears to be no way to clear chat history from an #XMPP server through the protocol itself. What the fuck? Why would anyone recommend such a privacy nightmare of a protocol?
10
Replies
·
0
Boosts
Ah yes, the expected "but OTHER protocols!!1" and "Just use e2ee!!!!1" responses.
And this is why most people just tune out all our screaming about surveillance. Even the people who are in a position to do something about it can't be bothered to take the time to do it right and make excuses when they fuck it up.
The problem with open source is that it's mostly built by programmers who think programming is the only skill that matters. They rarely get product managers, security and privacy experts, or even community managers involved in their projects, because they think they're smart and can just do all that stuff themselves.
Coding itself is probably the least important skill in making software. It doesn't matter how well you've programmed something if it doesn't actually do the right thing.
I worked at Facebook when they implemented Project Clementine, so I know how much work they put into making sure everything actually gets deleted within the deadline when people request to have their information deleted. And it was a lot of work: Haystack and other log-structured lazily-compacted stores, soft-deleted database rows, backups, indexes, etc.
Obviously I don't know for sure they didn't build some secret system to retain deleted data. But I'm also not sure what motive there could be to have such a system which would outweigh the consequences of its being discovered.
To be clear, Matrix gets this wrong, too. Matrix spreads history across multiple servers, and you can't even delete individual messages in a way that the server admin and even room moderators can't retrieve them.
Signal is pretty much all there is, and it probably won't be around much longer thanks to the fascist EU.
Went ahead and blocked the most techbroey reply guy on this one. JFC I hate techbros.
@freakazoid
We do have message retraction and message moderation that clear the server-side history for a specific message, replacing it with a "tombstone". I agree that a protocol to destroy all chat history would be nice to have, I suspect it happens on room deletion even if it is not specified. More importantly, note that the default history retention in prosody, the most widely used server implementation, is 1 week.
https://prosody.im/doc/modules/mod_mam#archive_expiry
What protocol isn't a privacy nightmare for you?
@freakazoid no expert, but imho/AFAIK the messages are stored encrypted if you use encryption - which you should do. And we don't know if messages (even if encrypted) are deleted on other messenger apps servers if the client requests this 🤔
Also: even if the protocol allowed this, how would you make sure all involved servers would comply? We always have to trust e2ee somehow right? (Open to hear anyone with more insights correct me)
@aslmx I'm using jmp.chat, which is an SMS gateway and doesn't support encryption. And it's also irrelevant; I should be able to control server-side retention no matter what.
If I didn't trust the server to comply with a "delete history" command, I wouldn't use it at all. The problem isn't trust of the server, it's the fact that if the server retains history it can be compromised, seized, or subpoenaed.
Yes, if I can't trust the server, I have to assume, that it copied all messages anyway before I read them.
For #dataHygiene a simple way to flush the #MAM would be nice, though. Needs a new #XEP or an addition to "XEP-0313: Message Archive Management", I guess.
