Comment by ge0rg | Hacker News Reader

Comment by ge0rg | Hacker News Reader

Parent Full thread

Signal requires users' phone numbers.

True for Signal. XMPP is using JIDs which are functionally comparable to email addresses, and similarly anonymous (or not).

Is there a way to run your own Signal server?

The Signal client is open source, the server mostly so. You could create your own semi-Signal community, but it would not be able to talk to official-Signal users.

XMPP is designed for federation by default, and you can run your own server, akin to email. Though some server operators decide to disable or cripple the federation feature (Facebook, Gmail).

Would I need to trust Signal more than I would need to trust Jabber?

This is a complicated matter. You need to trust the server operators to handle metadata in both scenarios, but you can run your own server with XMPP. You need to trust the client developer, which is Signal in one case, or the developer of your choice (or yourself) in the other. You need to trust the device manufacturer/Google in both cases.

What is this constant rumor about that Google killed XMPP federation? I think they killed the XMPP support in their own clients, but in general they still provide the service. I've at least three active @gmail.com XMPP accounts in my roster on a private server. I've read some rumor that they do not do TLS for server2server traffic, but in the end if you use XMPP on your desktop you most likely use OTR.

I think it's more than a rumor. As far as I know, Google stopped allowing new XMPP servers to federate, because almost all of the new servers that were trying to were sending spam.

It's possible that they grandfathered you in, if you were already federated when they put on the breaks, and your server wasn't guilty of sending spam.

Or it's possible that I'm wrong and they just got really aggressive about banning new servers if anything even remotely spammy came out of them, and it's really the spammers complaining that "Google won't let anyone new federate."

In 2013, the xmpp community decided to enforce TLS on all server-to-server links [0]. Google still doesn't support this, essentially preventing non-gmail users to communicate with them.

While OTR is a possible solution, it has its own can of worms (multi-device, offline use).

Besides of this, Gmail xmpp silently fails if the other party upgraded to hangouts.

[0] https://github.com/stpeter/manifesto/blob/master/manifesto.t...

Apologies in advance for pedantry, but OTR and TLS aren't comparable security solutions. Unlike TLS, OTR is end-to-end. You can't trust the security of an XMPP conversation that occurs over TLS connections without also trusting all the servers in between.

It's not a rumor. Yes, TLS doesn't work, but that's not a big deal, because you can still allow unsecure connections.

The issue is that you see 3 people are online, you can also receive their messages, but they can't see anything you write[1]. This behavior is worse than outright blocking, because it creates confusion at first seems like everything works and why people are complaining, then makes you suspicious that perhaps Jabber is broken, and in order to talk to your friends you might start using gmail.com.

[1] Initially this happened to anyone who converted to hangouts. I don't think there's option anymore to opt out from hangouts and get back to GTalk.

Google is moving away from XMPP everything. They recently deprecated all XMPP related services in their cloud suite. [1] The XMPP API will be permanently disabled October 31, 2017. Previously they've deprecated their Google Talk windows client, and said that they plan to focus their efforts on Hangouts. [2]

[1] https://cloud.google.com/appengine/docs/deprecations/xmpp

[2] https://plus.google.com/+MayurKamat/posts/ETBvtp9VYav

Phone numbers are not always anonymous. In India and I am sure some other countries as well, you have to give a photograph and a government ID to get a SIM card. And that is why I am hesitant to use Signal: I want to talk to you but I am not sure if I should give you my number?

For a number of years in Norway it used to be the case that you didn't need to show any ID or similar when buying a prepaid sim. Thus it was popular among criminals, and the related scratch cards circulated as virtually as cash. The police raised a stink about this situation, and soon enough you need ID to get them.

Wow, really? I'm so used to just buying SIM cards on street corners, I didn't realise some people had to go through documentation to get them.

Also, in some countries like the US, you can buy 'burner' phones without any need for identification--no contract, no ID.

In Australia you need to show ID to get a SIM card, even just a $2 SIM from the grocery store.

Reply on news.ycombinator.com