Hot answers tagged

6

TLS (Transport Layer Security) simply encrypts the data in transit between two endpoints. This is good for preventing casual observation, but doesn't protect the data from all vectors. And TLS is between two parties, so a group chat would need a number of TLS connections with the associated encryption overhead (direct chat); or would not be secure (relay ...


6

It is possible for a server admin to silently add an infiltrator to group chats. But without letting the group to be notified, It's not possible well atleast in Signal protocol. Signal is open-source so you can verify from the source that a message that someone has joined the group is shown on GUI. While what's app if pressurised by the government can choose ...


6

The core XMPP specification defines how it integrates with TLS for transport security, and SASL for authentication. There is also a standard end-to-end signing and encryption protocol that can be used to ensure protection of messages from sender to ultimate recipient, whereas TLS only protects up to the next relay host. This end-to-end protocol builds on S/...


5

As explained in RFC 3920 (section 5), a machine will send the "<starttls>" tag to indicate that it supports SSL/TLS, and then, when the final ">" of a subsequent "<proceed/>" XML element is sent and received, the underlying connection is immediately hijacked to begin a TLS handshake. The handshake consists in TLS messages (which are not XML at ...


4

TLS - protects your data to the server. OMEMO, OTR, PGP - protects your data to the device of your interlocutor Only TLS - is preferred to use only on your home server or on corporate servers (where you need to track employee history). On public servers in important conversations, it is preferable to use e2e (OMEMO and etc)


4

Self-signed certificates are just as good as certificates signed by another entity. The only thing that they're not is in the Public Key Infrastructure. Every modern computer comes with a list of known, trusted root certificates. Any certificate signed by one of these trusted roots is automatically trusted by your computer. Your self-signed certificates are ...


3

Integration of XMPP (the protocol) with SSL/TLS is described in section 5 of RFC 3920. Basically, client and server agree to switch to SSL on the already open connection, and then to SSL/TLS thereafter until the end of the connection. So everything is protected in SSL/TLS, not just the authentication part. All subsequent traffic gets encrypted. It is still ...


1

While it's possible for a particular implementation to do something different, in every XMPP server I've looked at: Messages are NOT end-to-end encrypted. Messages are stored on the server in clear text. Messages are mapped to both sender and recipient. Messages are generally stored permanently on disk, subject to only local house keeping cleanup. XMPP ...


1

OTR messages are encrypted end-to-end. This means that the clear-text of OTR messages cannot be accessed by an intermediary such as a server. This is useful to prevent messaging companies, governments, and any other MiTM from snooping on your conversation. If you are looking to implement your own messaging system using a REST API that records the data that ...


Only top voted, non community-wiki answers of a minimum length are eligible