Hacker News Reader

Comment by edhelas | Hacker News Reader

Hi! Glad to see XMPP on the HN first page this morning :)

I'm working on a social-network and IM web platform (for 12 years already!), fully built on XMPP https://movim.eu/.

Thanks to its extensibility and the PubSub XMPP standard (see https://xmpp.org/extensions/xep-0060.html) you can easily build social-network like features. The standard is pretty simple, it's Atom 1.0 transport within PubSub (see https://xmpp.org/extensions/xep-0277.html).

For those that likes RSS/Atom you can also easily publish Atom newsfeed to PubSub (see https://github.com/edhelas/atomtopubsub) and follow your favorite website using your XMPP account and with real-time pushed articles. Here is ArsTechnica as an example https://mov.im/?node/news.movim.eu/ArsTechnica

XMPP is not only for IM, but way more than that ;)

View on HN

I wanted to try it out, but this is annoying:

- registration happens on https://api.movim.eu/register and firefox provides me a way to generate a password and save it linked to that domain.

- now I want to log in at https://mov.im/?login but firefox has no idea that it should use my api.movim.eu account for that.

Yes this is perfectly normal.

The XMPP account (so movim.eu) is decorelated from the mov.im pod we deployed as a public instance to show up the project.

You can connect on Movim (and mov.im, the official pod/instance) using any XMPP account. movim.eu is just one amongs all the others.

You have to differenciate Movim as a project that particular instance deployed as mov.im and the Movim XMPP server that we deployed from the project. I know it might be a bit confusing so if you have some ideas to clarify things up do not hesitate :)

I think this is the same problem matrix has: you end up entering your login details on foreign domains. There's really nothing stopping them from capturing that login via malicious javascript and using it for some malicious mitm, or just saving it to try on other services (you can't expect everyone to use a randomly-generated password). I don't see why you couldn't just enter 'server.com' (your xmpp server) and have an OIDC flow performed (the same complaint goes for matrix).

Login should happen on a single domain (same one that was used for sign up). Just redirect from mov.im to movim.eu and back, same as Oauth.

I have my own XMPP server ;-) and I understand the underlying problem here. I mostly wanted to point out that for a new person to quickly try out Movim this might be a stumbling block. As another comment suggested using something like OAuth to smooth this out might help.

I've seen movim around but I have never actually tried it. This post gave me the push. So thank you for that. I do have a question though:

On https://mov.im/?login it says:

"Login using any XMPP account or create a new one"

But it only shows me a login form where I can enter my xmpp address and a password. This signals to me that I can log into my existing non-movim-xmpp account, but I have to enter my password on there? That can't be right. What am I misunderstanding ?

Movim is a social-oriented XMPP client, so yes, it needs to log in to your account. You don't have to use the mov.im instance - in an ideal world your own server can run a copy of Movim, but you can also self-host, or even run it locally on your system.

This year I'm also going to be working on account access delegation for XMPP as part of a funded project, resulting in implementation in Prosody (server software) and publishing/updating related standards. That's the kind of thing Movim would be able to take advantage of so you can grant (restricted) account access to a remote Movim instance without sharing your password.

> This year I'm also going to be working on account access delegation for XMPP as part of a funded project, resulting in implementation in Prosody (server software) and publishing/updating related standards.

So that I can do something along the lines of "Log in with XMPP" and then my client asks me "hey do you wanna allow movim.eu to access foo/do bar on your behalf" ?

That sounds very useful. Sharing my password like this does not seem a great idea.

This is already possible! https://xmpp.org/extensions/xep-0070.html

That's slightly different. XEP-0070 is about allowing someone to verify that you own a given XMPP address. That is indeed often all you need for a "Log in with XMPP" functionality. Just how many sites allow you to log in with an email + verification link today.

However it does not grant someone the ability to connect to your account and perform any actions. Movim is an XMPP client. It interacts with the XMPP network as you, not as a third-party. That's very different to what XEP-0070 is for.

Currently the only practical way to allow someone access to your XMPP account is to give them your credentials. But if you do that, there's no way to restrict, monitor or revoke their access (apart from changing your password - something they would also be able to do!).

Many XMPP server implementations already implement some of the building blocks for something better (e.g. Prosody and ejabberd both support OAuth in some form already). But there are a number of important missing pieces before we can get it usable and adopted, and that's what I will be focusing on this year.

Again, in Movim's case it's fully open-source. You can self-host it or run it on your laptop, so you're never forced to hand over your credentials to any third party today. But many people would find a mechanism to grant a third-party limited access to their account an acceptable solution, so they can use Movim instances hosted by others.

Oh i was not aware you're working on proper authorization/delegation for XMPP. That's really cool! Can't wait to see your blogpost on this topic on HN front page :)

Reply on news.ycombinator.com