Comment by infosechandbook | Hacker News Reader

Comment by infosechandbook | Hacker News Reader

Parent Full thread

infosechandbook

Just one question as the rest was discussed numerous times before:

> At least with XMPP, I can point the same client to some other server and potentially continue a conversation with someone somewhere else, with the exact same OMEMO/PGP encryption.

How do you just "continue a conversation with someone somewhere else" when your XMPP server goes down?

Typically, you register an XMPP account on an XMPP server. If this server is offline, your account is unreachable as the account is managed by the XMPP server not by your client. Therefore, you can't use this account anymore. So you need to go to another XMPP server, register a new XMPP account, and then try to find your contacts again (which may be cached by your client or not). Finally, you have to convince "someone" that this is just you with another account on another server. There is also no verified E2EE anymore. If "someone" uses the same now-offline XMPP server, "someone" also needs to find another XMPP server.

How is this different from "when Signal goes down one uses a completely different instant messaging system", apart from using another client?

> That is why decentralized/federated is better

And we already explained (also several times) that XMPP is de-facto centralized as the vast majority of users only use a tiny number of XMPP servers hosted by an even smaller number of hosting companies. Which means: If one of these hosting companies blocks XMPP traffic (e.g., if a rogue state starts censoring) or one of these XMPP servers goes down, a huge part of XMPP users is affected.

> then try to find your contacts again (which may be cached by your client or not)

You can save XMPP account IDs in any mobile address book.

> Finally, you have to convince "someone" that this is just you with another account on another server. There is also no verified E2EE anymore.

I'd pretty much just do a video call at that point.

> How is this different from "when Signal goes down one uses a completely different instant messaging system", apart from using another client?

You don't have to use another client software.

> Which means: If one of these hosting companies blocks XMPP traffic (e.g., if a rogue state starts censoring) or one of these XMPP servers goes down, a huge part of XMPP users is affected.

Equally applies to most messaging apps out there. Some XMPP apps have the benefit of also supporting using Tor and hidden services - Signal/WhatsApp/etc, don't.

Don't want to use the Internet at all and your friends live close by? You can even go wild and do something like:

- https://github.com/ddamianus/Lora-Chat-Device

- https://github.com/jgoerzen/ax25xmpp

I realize this is something most people would not do, but XMPP's _flexibility_ allows this to be an option if it was something people wanted. Can't do Signal over LoRa.

> You can save XMPP account IDs in any mobile address book.

... while the rest of the XMPP account remains on the XMPP server, inaccessible. There is no benefit as you can also store other primary IDs like phone numbers in your address book.

And the rest comes down to "continue a conversation with someone somewhere else" isn't so easy but the same pain as with any other messaging system, minus you may use the same XMPP client, plus you may need to search a while until you find an XMPP server that comes with the fitting XEPs for your use cases.

Reply on news.ycombinator.com