Hacker News Reader

Comment by benjaminjackman | Hacker News Reader

Do you have a recommended guide for setting an XMPP server that supports end-to-end encryption?

Sadly I don't. I have mine running since a while, and some things might not be state-of-the-art anymore.

The server doesn't really have to support end-to-end encryption as that is part of the clients (in fact, there are some server-side extensions which have to be present, but those are mostly enabled by default).

Afaik, the default ejabberd configuration is very close to what you need, and there is just one part that you have to remove to enable OMEMO [1]. I don't understand why but recently the ejabberd devs introduced that part to their default configuration which makes it harder to use end-to-end encryption.

Nevertheless, if you are very interested in a detailed guide, I could write one as I am thinking about setting up a secondary server as a testing environment.

[1]: https://github.com/processone/ejabberd/blob/master/ejabberd....

Here is some discussion of how to easily use Let's Encrypt certificates with the prosody XMPP server. That gets you C2S and S2S encryption which is more or less mandatory these days. End to end (OMEMO) doesn't need the server to do anything special so there isn't any setup to do past just getting the server running.

* https://prosody.im/doc/letsencrypt

Why would you want E2E if you run the server, and so can be trusted?

If you run a federated server, not all contacts might use the same server. With end-to-end encryption that doesn't really matter.

EDIT: Moreover, trust is not binary. So while your family might trust you, maybe your dad doesn't want you to be able to read everything he writes your mom or so (you get the idea).

Reply on news.ycombinator.com