Yog-Sothoth

What metadata does XMPP leak?

• Sender’s Full Jabber ID (JID): This is typically in the format user@domain.com/resource. The user@domain.com part identifies the user and their home server, and the /resource identifies the specific client device they are using (e.g., alice@example.com/mobile or alice@example.com/laptop).
• Recipient’s Full Jabber ID (JID): Similar to the sender’s, this specifies who the message is intended for, including their user, home server, and often the specific resource.
• Sender’s Server: The domain of the sender’s JID reveals which XMPP server the sender is connected to.
• Recipient’s Server: The domain of the recipient’s JID reveals which XMPP server the message is being routed to.
• Timestamp of Message Transmission: Servers record when a message was sent, which can be used to infer activity patterns.
• Approximate Message Size: While the exact content is encrypted, the size of the encrypted stanza can still be observed. This can sometimes give clues about the type of content (e.g., a small text message - versus a larger file transfer).
• Message Type (e.g., chat, group chat, presence, IQ): XMPP uses different stanza types for various purposes. Even with E2EE, the type of stanza (e.g., a “message” stanza vs. a “presence” stanza) is visible.
• Participation in Group Chats: If a user is part of a Multi-User Chat (MUC), the MUC service and the user’s participation in it are known to the MUC server and potentially other participants’ servers.
• Presence Information: XMPP inherently broadcasts presence (online/offline status, “away” messages, etc.) to contacts. This reveals when a user is active.
• Contact List (Roster) Information: While not “leaked” during every message, the XMPP server hosts and manages the user’s contact list, meaning the server knows who a user is communicating with.
• Device Information (Resource): As mentioned, the /resource part of the JID can reveal the type of client or device being used.

I find it strange that Signal somehow doesn’t know when a message was sent

Signal uses Sealed Sender (wired.com). Imagine if letters you sent didn’t require a “from” field - or it was inside the envelope and impossible for anyone to see it. The post office would only know who its going to and only the recipient can decrypt it (open the letter) to see who sent it. Now, you could say, well they have your IP and can correlate it to the account, but the easy way around this is to either use a VPN or Signal proxy (support.signal.org) if you’re that paranoid.

how would they ever make this possible?

Read more about it here: Technology preview: Sealed sender for Signal (signal.org)

How about most e-mail providers? Not Google and Microsoft of course, but most e-mail providers only need a name which can be made up as well

Most email providers suffer similar metadata leaks as XMPP because:

• 1. Email was created in the 70’s and we’ve learned a lot since then about privacy and security.
• 2. XMPP works off a similar concept where you inherently pass data along to another server.

You could host your own email, XMPP, or Matrix server - that’s definitely a win for privacy. But as soon as you interact with someone outside your ecosystem (server), metadata leakage is an issue again. It’s why making end-to-end encrypted email is a hard problem to solve. It’s not that it can’t be secure, its that it has to work with those that aren’t because that’s the expectation.

… host your own email server, then you are in control

Until you interact with others who aren’t using encryption or have it misconfigured.

Removed by mod

Removed by mod

devil’s avocado: this move has saved many people’s cherished photos from disappearing by having them auto save. before Google photos I’d run into cases (I used to do home IT support) where people had years of family photos disappear because they didn’t back them up properly. Having to communicate what happened was never fun.

is Google photos perfect? No, but it’s a great solution for people who don’t want to manage their data.

fully aware! just don’t care much since its so cheap ($270 for 20 TB!) and my last externals (two 10 TBs) served without issue for ~5 years. Just gotta make sure you have backups and upgrade every few years.

I’ve been running my server on an old laptop and a 20TB external hard drive connected via USB. it’s not fast, there’s a multi-second delay when the drive goes to “sleep” if nobody has used jellyfin in a while, which makes it appear to not work, but once it spins up it works like normal. this has let me keep things simple and cheap. I back up to another 20TB hard drive, which I recently bought as I could finally afford it. beefy hardware is great but not necessary, if you’re okay with some limits.

Americans have the right to bear arms just as much as they have the right to shout fire in a crowded theatre — it’s a right that can be regulated and both already are, one needs more regulation, but people don’t seem to understand.

is this not domestic terrorism?

I’d be interested to hear what you think a made up job is

So I upgraded and tested not adding a trusted proxy (using Traefik in front of Jellyfin) and nothing broke. Was it supposed to break or is it just that its insecure? Am I less secure by not adding it as a trusted proxy?

everyone does their own thing, but semantic versioning is specifically:

• Major: Incompatible changes (breaks existing code).
• Minor: New, compatible features.
• Patch: Bug fixes, small improvements.

it’s only gotten better. now you can run it in your browser and play local files

https://webamp.org/

to add even more to what’s already been said, even if Signal’s infrastructure was compromised and they could see messages traveling through their servers, each one is encrypted, the keys are rotated with every message (cracking one, which is nearly impossible, doesn’t give you access to previous or future messages), and thanks to Sealed Sender, only the recipient knows who a message came from. There are many other layers that they’ve engineered to ensure they can’t know anything about you, like private contact discovery, using secure enclaves, remote attestation, etc.

Removed by mod

Removed by mod

Signal is a publicly available app that provides encrypted communications, but it can be hacked.

This is misleading statement that will only confuse people who want to use a secure messenger.

To clear things up with anyone who’s not technically inclined: Anything can be theoretically hacked. Signal has not been hacked and has no history of being compromised.

The Signal “hacks” that linked people’s Signal client to devices that aren’t theirs were sophisticated phishing/spoofing attacks. The equivalent of getting someone to click a malicious link via email because it looked like the real thing.

A reminder that you still need to do your due diligence even when using a secure service. Technology alone cannot completely protect you.

asked this somewhere else, but does anyone know how it compares to Cryptpad which is also developed in France, open source, self hostable, collaborative, and end-to-end encrypted?

anyone know how this compares to Cryptpad? I think it’s developed out of France, also open source, self-host-able, collaborative and end-to-end encrypted!

H.265 is patent encumbered. Blame the 2 or 3(?) patent pool holders (for-profit corporations, unlike non-profit -and-slowly-losing-market-share Mozilla) for not making it free to use for everyone.

This is why AV1 is preferred, it saves bandwidth and there’s no threat of being sued into oblivion.

But then you’re indirectly giving the enemy (Google) power by increasing their browser market share, which in turn lets them dictate the future of the web.