I read that XMPP is encrypted. E.g. Wikipedia says:
Strengths
Security
XMPP servers can be isolated (e.g., on a company intranet), and secure authentication (SASL) and encryption (TLS) have been built into the core XMPP specifications.
OTOH, there are some additional encryption protocols, which seem to work over XMPP – like OTR and OMEMO.
So I wonder, why do we actually need any of these additional protocols to enable privacy, if XMPP is already encrypted in the core specs?
TLS (Transport Layer Security) simply encrypts the data in transit between two endpoints. This is good for preventing casual observation, but doesn't protect the data from all vectors. And TLS is between two parties, so a group chat would need a number of TLS connections with the associated encryption overhead (direct chat); or would not be secure (relay server chat) as you are only encrypting to a relay server that could read the entire conversation (necessary in order for it to forward the conversation to the other parties).
OMEMO is actual message encryption. And, perhaps more importantly, it is a double-ratchet system designed for multi-party communications with the security maintained even if a client is offline and waiting for delayed delivery.
Think of TLS like an armoured car. You put your private message in the armoured car and it is secure from outside parties snooping in, but anyone involved in the armoured car company can look in the back of the truck and see what you put back there. And (a special case for messaging) if no one is at the destination when the armoured car gets there, the guards give up and burn the message.
OMEMO is like if you have a favorite book cypher that you use to write the message. Even if the armoured truck driver looks at the note, he still won't be able to read it. And since it is [payload] encrypted the truck driver can leave the message on the recipients door step, and it'll remain secured.
TLS - protects your data to the server.
OMEMO, OTR, PGP - protects your data to the device of your interlocutor
Only TLS - is preferred to use only on your home server or on corporate servers (where you need to track employee history). On public servers in important conversations, it is preferable to use e2e (OMEMO and etc)
