Questions tagged [xmpp]

Extensible Messaging and Presence Protocol is a communications protocol for message-oriented middleware based on XML.

Filter by
Sorted by
Tagged with
1 vote
0 answers
113 views

Encryption of calls and files in XMPP

I use Conversations, and my interlocutor is Monal (or another application for iOS (you can tell which is better)). I plan to use OMEMO for encryption. Are files and photos encrypted or not? Are calls ...
hhf's user avatar
  • 11
1 vote
0 answers
692 views

XMPP authentication bruteforce with hashcat

This question is about how efficient it is to bruteforce SASL authentication in the XMPP protocol. I read the XMPP SASL authentication steps (stackoverflow link in case the first one breaks), and ...
Redouane Red's user avatar
1 vote
1 answer
356 views

what makes xmpp a trustworthy way to communicate with others?

An Overview of XMPP Luke Smith recommends XMPP As Luke Smith said in his video, XMPP has been designed as an open communication protocol, which is similar to the email at an extent, I am wondering ...
user avatar
1 vote
0 answers
207 views

Forward secrecy (plausible deniability) and storing messages

How do messengers, like signal or XMPP-omemo messengers, store their messages? Since the session key is only valid for the current session, how can such extensions like MAM (message archiving on XMPP ...
user674907's user avatar
0 votes
1 answer
875 views

How do XMPP servers process messages?

I'm trying to understand how XMPP works and I'm much concerned about how do both the protocol and existing implementations ensure privacy. More specifically, I want to understand how do XMPP servers ...
user6039980's user avatar
4 votes
2 answers
4k views

Why do we need OMEMO if XMPP is already encrypted?

I read that XMPP is encrypted. E.g. Wikipedia says: Strengths Security XMPP servers can be isolated (e.g., on a company intranet), and secure authentication (SASL) and encryption (TLS) have been ...
Ruslan's user avatar
  • 247
6 votes
1 answer
1k views

How do end-to-end encrypted chat services ensure that the server admin doesn't add new members to a chat?

This question is about any chat service that supports end-to-end encrypted group chats, for instance Signal, XMPP + OMEMO (closed group chats in particular), WhatsApp, and the like. How do these ...
tao_oat's user avatar
  • 312
2 votes
0 answers
171 views

Does an SSL certificate have to cover the server hostnames returned by an SRV lookup on the domain?

I have XMPP service running on the domain xmpp.mydomain.com. The XMPP service runs on two back-end servers, im1.mydomain.com and im2.mydomain.com. Clients find out about these servers by an SRV DNS ...
Simon Hornbeam's user avatar
2 votes
0 answers
91 views

What are the security implications of using local-link XMPP on an untrusted network?

I'd like to setup XMPP local-link messaging (Bonjour) on my laptop for use at home. However, I'm concerned about ensuring this is not leaking any information when I connect to an untrusted network. ...
robingrindrod's user avatar
1 vote
0 answers
177 views

Solution for well-encrypted group messaging, on Android inside Knox [closed]

I am looking to setup a secure messaging system to be used among friends. Ideally it would be cross-platform (Android-phones using the Knox-container, laptops, Android-tablets with Knox) and support ...
SpindizZzy's user avatar
1 vote
0 answers
125 views

What information can be seen when I'm using SRTP via XMPP?

Just as the title goes, basically what data/information can be tracked when using SRTP via XMPP? As client I'm using Jitsi. If things works in some aspects similar to HTTPS, I guess that maybe it ...
Gruber's user avatar
  • 115
0 votes
2 answers
477 views

Is there any advantage on using OTR in a messaging app if the messages are first sent to a REST API server over HTTPS?

I don't have any kind of experience in security, but just on API and app development, and I'm developing an application for doctors and patients which has an added private messaging feature between ...
Willian Schneider's user avatar
4 votes
1 answer
3k views

How can I intercept XMPP traffic on Android? [closed]

I have been learning about security testing on Android apps, and to intercept traffic I was using Burp Suite. I know it works perfectly for HTTP/HTTPS traffic, but most of the messenger apps are using ...
Anandu M Das's user avatar
  • 2,047
3 votes
1 answer
226 views

What security layers of protection are available over XMPP?

I have been working on an application running over XMPP. I would like to know which all popular security layers are available over the XMPP protocol, similar to SSL over http.
Anonymous Platypus's user avatar
1 vote
3 answers
4k views

How secure is XMPP with self-signed SSL certificates?

I'm looking for an easy way to set up a simple IM infrastructure that protects messages in transit as well as avoids having logs in places that neither I nor someone I trust controls. I'm based in ...
Stegosaurus's user avatar
3 votes
1 answer
1k views

SSL/TLS in Jabber

Just wondering: is entire traffic between me and the Jabber server I use encrypted, or only login and password? Given that the server supports encryption, and my IM client is configured to ask for ...
MyName's user avatar
  • 31
1 vote
0 answers
709 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
Toby Pinder's user avatar
3 votes
1 answer
1k views

xmpp ssl cipher negotiation

Does anyone know how ssl ciphers are nogitiated via the xmpp protocol. When I capture packets, I see: <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/> There is no hello server/client or ...
marcoo's user avatar
  • 894