Hello. I am looking for an alternative to Telegram and I prefer an application that uses decentralised servers. My question is: why is the xmpp+omemo protocol not recommended on websites when it is open source and decentralised? The privacyguides.org website does not list xmpp+omemo as a recommended messaging service. Nor does this website include it in its comparison of private messaging services.
https://www.privacyguides.org/en/assets/img/cover/real-time-communication.webp
Why do you think xmpp and its messaging clients such as Conversations, Movim, Gajim, etc. do not appear in these guides?
Right now, the open source community has so many different ways to communicate.
The problem is what is the goal, privacy or security.
All seem to have benefits and problems.
I use conversations and delta chat. I don’t know what is best. But it is better that anything that is owned by big corps.
Prosody XMPP + Pidgin/(Monal|Xabber) has always worked for me. It is not hard to setup or manage, has E2E encryption too.
I’ve personally used 4 encrypted communication apps, here are my thoughts:
Signal: huge downside that it required a phone number (not sure if it still does), and the centralized nature of it makes me very wary of it. It worked reliably when I did use it, but I no longer use it.
Matrix with Element: As others mentioned, it leaks meta data. It wasn’t very reliable in my experience with encrypted group chats. Messages would constantly not be readable by other users in the chat, requiring frequent re-sending to finally get through. Overall I found it very frustrating to use.
XMPP: Experience can somewhat vary depending on the app used. With the Movim desktop front-end, I can sometimes have issues with encrypted messages not getting unencrypted (possibly just user error on my part), but with mobile apps like Conversations or Monocles, its been pretty much 100% reliable. Doesn’t drain my battery either. Would recommend.
Deltachat: I’ve used this the least, but I really like it. Super easy to connect to friends and join a group chat, its all encrypted by default so no real chance of encountering an unencrypted message, very nice UI, is available on all platforms as one app, and has been 100% reliable with low battery drain. Highly recommend if you don’t need to make voice calls (it can do texts, images, and supports voice/video files you can send and play within the app).
I know it’s not the most popular, but I’ve genuinely been happy with Matrix for the last few years. Obviously there are problems, but it really has gotten fairly stable. At least…for me…
+1 for matrix
Here is a blog post by a widely respected cryptographer on why XMPP+OMEMO is not secure: https://soatok.blog/2024/08/04/against-xmppomemo/
This post is 1.5 years old and outdated.
Do you know if there is a more up to date description of xmpp e2ee without having to read the spec. Specifically interested in stuff like how much metadata is leaked.
What has changed?
They updated OMEMO
Did that fix any of the underlining issues with OMEMO use across XMPP clients, such as odd/opaque choices by the OMEMO maintainer, or the fragmentation of OMEMO versions used by clients (most being very out-of-date)?
Let me be clear: I am NOT anti-XMPP (or even OMEMO). I would love to see it succeed because I much prefer it over Matrix and other alternatives. My problem isn’t with the technology, just the implementation.
This blog post has been debunked as fallacious (posing as evidence what’s unsubstantiated), and in bad faith (some comments, including by the protocol developers, were removed from the blog’s comments section). That aside, if you are left unimpressed by the crypto jargon, all you take away from it is that Soatok really likes Signal and this isn’t Signal. There have been several independent audits on OMEMO, it’s used today by serious institutions and governments, it’s been under more scrutiny than soatok gave it, and there’s nothing knowingly insecure about it.
OMEMO leaks plenty of metadata; most things other than message contents are left unencrypted. Many of the mature XMPP use different OMEMO versions (which can be hard to tell when the client doesn’t clearly state the XEP versions, like Snikket). I spent 40 min scouring Snikkets website and source repo without any clear way to determine what version of OMEMO they bundle. I said OMEMO+XMPP because no matter how secure your protocol is, the actual implementation by your largest userbases determine real-world security.
And lastly, just because “serious institutions and governments” use it doesn’t make it more secure. Many European governments use Matrix, and that has even worse security, breaks forward secrecy, doesn’t encrypt basically anything other than message content, etc. Many governments have critical systems that run unpatched Win 7 or older. My point is that security is independent of adoption.
OMEMO leaks plenty of metadata
Could you even cite an example of such leaked metadata? I’d like to also remind you that metadata leaking to your own server (which you can chose, which you can self-host) isn’t as big a deal in XMPP as it is with other services. Which is also why I can’t take Soatok’s opinion about and obsession for Signal seriously: when all accounts are hosted by a single actor, you have a much bigger metadata problem, and all obfuscation attempts (sealed senders being one) are ultimately defeated by simple timing and packet correlation attacks.
I spent 40 min scouring Snikkets website and source repo without any clear way to determine what version of OMEMO they bundle.
You were probably looking at a rebrand/spin of https://xmpp.org/software/conversations/ . All major XMPP clients and servers declare their compat via DOAP: https://xmpp.org/extensions/xep-0453.html
My point is that security is independent of adoption.
Correct, but in this case OMEMO is secure and is used in contexts where security actually matters. There have been multiple audits of it over the years:
From the OMEMO XEP specification under section 2.1 “Threat Model” https://xmpp.org/extensions/xep-0384.html#reqs-threat-model
The OMEMO protocol does not protect against attackers who rely on metadata and traffic analysis.
Off-topic, I would also like to add that the spec says " It has been demonstrated, that OMEMO provides only weak forward secrecy (it protects the session key only once both parties complete the key exchange).", citing https://www.cypherpunks.ca/~iang/pubs/dakez-popets18.pdf
The specification only seems to say that message content are encrypted, making no mention of encrypting any other data than message content. Look under sections 1.2 and 4.4 to see what I mean about there being no mention encrypting other data (eg. recipients and room names). This means that sender/receiver are (most likely) not encrypted. I don’t think (though I don’t know for sure) that room names are encrypted either.
What happens if you communicate/participate in an encrypted chat/user on another server? Could the server owner now see the other unencrypted data and metadata?
Also, just because you self host it doesn’t make the unencrypted (meta)data any less dangerous. That just makes your server the point of failure. By your logic, why encrypt at all? It all lives on your server, it is only a problem if someone has access to your server. Networking is encrypted with TLS anyways, so why bother. /s
I’ve hardly used it so far, but simpleX seems promising from my limited knowledge. I highly suggest checking it out.
Misleading title.
deleted by creator
If you don’t like Signal, SimpleX is also an option.
They specifically asked for decentralized
removed comment:)
Self host your matrix server, use Continuwuity not Synapse, and do not enable federation.
deleted by creator
I share your concerns with the matrix organization. Most of the other concerns on that article don’t apply to a private instance with only just less than a handful of users who anyway live together or share more than an online existence.
Then why bother with Matrix at all if that’s not for the federation? You give yourself the trouble and inefficiencies of an over-engineered protocol you won’t even use.
Because matrix has the bet bridges so I can centralize all other protocols on my matrix server (Continuwuity) and have whatsapp, telegram, Signal all accessible from one single app.
All those bridges rely on some community-made libraries developed by few individuals unrelated to Matrix, so, not only there isn’t much Matrix-specific to them, but it’s reproduced for other protocols, JFYI: https://slidge.im/
Good to know… Well I am on matrix now, so no need to switch, but will keep in mind.
At least you are on the continuwuity side of it, which is much more sane than hosting synapse (but you are missing out on many features I guess. If you get tired of this eventually, give ejabberd a shot, it’s self-contained with all features, including VoIP/AV calls.
Why not Synapse?
Super heavy, and overkill unless you need to run matrix.org itself.
It runs like shit, at least when I tried it. Never heard of Continuwuity, will looks into it thanks.
Its the rebirth of Conduit -> Conduwuit -> Continuwuity. Built with rust, it’s a community project that is pretty stable and finally free of drama.
Wait a sec, I run Conduit on my test machine and seems fine so far. What drama did I miss?
Conduit has been dead in development for years now. Conduwuit was the successor, then some drama got it shut down and reborn (new maintainers) as Continuwuity.
Conduit saw no up grades in years IIRC and its basically abandoned I guess.
Thanks for explaining. But unless I’m missing something, Conduit doesn’t seem to be quite dead just yet. I got upgrade notifications throughout 2025, the latest two being in December; one for v0.10.10 and the other for v0.10.11.
Good to know!
The freenet/futo devs are working something called river (https://freenet.org/). I don’t think it’s mobile yet and cannot attest to it’s call quality. It’s fully decentralized though, so it should work even if they abandon the project. Here’s a video on the protocol https://youtu.be/3SxNBz1VTE0 Mostly goes over the introductory docs that’re on the site.
reason for them not appearing is that xmpp is a largely relaxed platform, that is, all implementations are not equally strict. some may implement certain extensions, others may implement other. encryption (omemo) is a common one that most implement, but then client (the user apps like gajim) may or may not implement them correctly, or they may have a fallback (first communication between 2 clients maybe is not encrypted), and other different problems with encryption being flaky (firstly, it is not perfect forward secrecy, it is a bit prone to failure (messages unable to decrypt), etc.), hence it is not recommended much.
That’s the nature of any federated protocol, and also what makes them highly desirable: there’s no central authority to dictate what is a compliant client or change the deal overnight and enshitify your user experience. That said, XMPP+OMEMO is as universal as things get, so there’s no real concern there.
For the first communication not encrypted there’s an easy solution: force encryption on your side and block unencrypted communications.
Theres snikket as a solution to that
No idea. I use the app Conversations (XMPP+Omemo) and it works great. Only downside ist that you have to somewhat trust the server you are on, because of metadata. But thats basically every chat app.
Tox, where is TOX ? Why it’s not mentioned in the article ? It’s te most private messaging app, no other app can be more secure.
Didnt tox development stop a while ago?
It’s a very slow development but still active https://github.com/TokTok/qTox
A thats cool. I used it for a while as a skype(hah!) alternative, but call quality is very low and it has no noise cancelling. Chat works though.
You should check out “keet” or “Jami” for privacy message app.
Jami is nice in theory, but it was very buggy for me when I tried it and Jami calls had no noise cancelling at all. Other than that, it does work.
I cant find the “keet” git repo, I think its proprietary. So thats a no go for privacy.
https://github.com/holepunchto/keet-appling-next
Here is the github link, note that, this is the “shell” of the desktop. There is another repo specifically for android app.
https://keet.io/ is the official website
Developer is holepunch and uses “pear” peer-to-peer protocol.
Yeah, I saw that too, that not the full source code. I found another repository for the android releases: https://github.com/holepunchto/keet-mobile-releases
Again, no source code, just binaries. Rather shady I think…
Yes, that’s the real issue
Yeah Keet (and Pear in general) are doing some open washing, branding their apps as open source while using very restrictive licences, at least that’s how I feel about them. It’s closer to source available to my eyes.
What licenses are these? I only found apache licenses for the stuff they released. But yes, it kinda looks like open washing, since it looks like keet is open source, but its not.
Signal at #1 and #2 spots 😭 only 4 options 😭 100% of options funded by western governments 😭 yup it’s a .world user’s post
Not just .world. I saw people from all over recommending matrix by element, and element works with the police and nato
I’m not even a tech knower and found that connection
yeah it’s more about whether you’re capable of making connections yourself instead of google searching “how do i hide texts from government 🥺” than being a tech knower so you will go far #XMPP
Could you elaborate on why Signal is a bad choice?
Are SimpleX and Briar also poor choices? Delta Chat?
And maybe why being funded by western governments is a bad thing as opposed to other governments?
Thanks 🙇♂️
Kind of similar to how horrendous experiments in humans in the past have provided a lot of insight in the field of medicine, to benefit us all.
Is that the takeaway? Maybe I’m missing something big right on my nose.
It isn’t. But I see this same post over and over. Really feels like there is a campaign against signal. Also tor developed by US Naval Research, so I guess it’s bad too.
good to know leaking phone numbers and being the main Discord alternative used by congress and Jeff Bezos on a centralized server isn’t a problem on .world
TOR nodes are mostly run by the US government and independent cryptocurrency entrepreneurs (Jeffrey Epstein email chain inhabitants)
if you had half a brain you would use i2p
Cool strawmen; I didn’t say any of that. Signal protocol is awesome for privacy, not anonymity. Maybe I don’t have half a brain, but I happen to think the double ratchet implementation is an impressive piece of tech. Maybe I’m as dumb as your fever dream, but compromised exits doesn’t make tor any less of an achievement. Though i2p is also superb. I guess my brain is too weak to understand why those statements are mutually exclusive.
Signal protocol is awesome for privacy, not anonymity
The “privacy, not anonymity” dichotomy is some weird meme that I’ve seen spreading in privacy discourse in the last few years. Why would you not care about metadata privacy if you care about privacy?
Signal is not awesome for metadata privacy, and metadata is the most valuable data for governments and corporations alike. Why do you think Facebook enabled e2ee after they bought WhatsApp? They bought it for the metadata, not the message content.
Signal pretends to mitigate the problem it created by using phone numbers and centralizing everyone’s metadata on AWS, but if you think about it for just a moment (see linked comment) the cryptography they use for that doesn’t actually negate its users’ total reliance on the server being honest and following their stated policies.
Signal is a treasure-trove of metadata of activists and other privacy-seeking people, and the fact that they invented and advertise their “sealed-sender” nonsense to pretend to blind themselves to it is an indicator that this data is actually being exploited: Signal doth protest too much, so to speak.
They bought it for the metadata, not the message content.
I doubt that, the app very likely has a backdoor
In most countries, sharing your phone number is equivalent of sharing you full home address. It would be great to see how people would react if instead of providing their number for an account registration, they were asked to give their home address.
It isn’t a meme. It is a fact of modern cryptography in many settings. For example TLS, which is a huge bulk of the traffic, guarantees again privacy not anonymity. I’m not saying one shouldn’t care about metadata privacy. Every communication one engages in requires risk benefit analysis. If your threat modeling shows that for a given message, anonymity is required, then signal, and nearly every single other protocol out there is insufficient.
That doesn’t mean TLS or lib signal, or any other cryptographic tool is not useful, especially in conjunction with other tools.
There are many cases where I want my messages to be private and the cost of entry for the message receiver to be low. Signal is great for that. But I’m not saying no other tools should be considered, just that signal is good at what it does.
“Anonymity” is a vague term which you introduced to this discussion; I’m talking about metadata privacy which is a much clearer concept.
TLS cannot prevent an observer from seeing the source and destination IPs, but it does include some actually-useful metadata mitigations such as Encrypted Client Hello, which encrypts (among other things) the Server Name Indicator. ECH a very mild mitigation, since the source and destination IPs are intrinsically out of scope for protection by TLS, but unlike Sealed Sender it is not an entirely theatrical use of cryptography: it does actually prevent an on-path observer from learning the server hostname (at least, if used alongside some DNS privacy system).
The on path part is also an important detail here: the entire world’s encrypted TLS traffic is not observable from a single choke point the way that the entire world’s Signal traffic is.
I Facebook said they enabled E2EE, theres zero evidence and zero way to verify that. Facebook has been caught in lie after lie. They most likely lied about that too.
Many people have reverse-engineered and analyzed whatsapp; it’s clear that they are actually doing e2ee. It is not certain that they don’t have ways to bypass it for targeted users, and there is currently a lawsuit alleging that they do, but afaik no evidence has been presented yet.
Removed by mod
You’re the one making insults and I’m smug? Care to actually dispute anything said with reason?
Removed by mod
100% of options funded by western governments
One of their four, SimpleX, is not funded by western governments (…but it instead has some venture capital 🤡)
And no mention of threema even though it fulfills all their listed criteria
Interesting discussion, the opinions go both ways but the official ones seem to disregard some facts and base the decision on some arbitrary ones that were not listed in OPs linked article, which I find quite biased or at least untransparent.
the hell is threema
You could have guessed from the context that it is another privacy focused messenger app
