Hacker News Reader

Comment by im3w1l | Hacker News Reader

> if you are running your own XMPP server, this shouldn't be a lot less "secure" than anything else on your XMPP server.

It will terminate the encryption on a device you (for most values of you) don't physically control. Thus it's less secure than end-to-end encryption.

View on HN

Isn't OMEMO inspired by the Signal protocol? Could it even be compatible to an extent allowing true e2ee?

I believe it is inspired by the signal protocol indeed. However, I completely lack the skills to do that, and this would undoubtedly require not using signald that already handle the encryption part. I believe that more hackers would be willing to work on that if the Signal people weren't so hostile to alternative clients…

Yeah, that is the cost of gatewaying any of these things. Nothing works with anything. Doing the conversion on a server you control is the best you can do and is good enough for all practical cases and gives you convenient access to siloed systems like Signal.

(author here) You are right, I should mention this in the README. However, nothing prevents you from hosting your server at home. I tried to be clear about it in the README, this is not as secure as the official client.

What about OTR?

OTR is safer than this gateway. It is end-to-end encrypted (i.e. client-to-client). With OTR, the server does not have access to messages in plaintext.

Right, would OTR work with the gateway?

No, the Signal client doesn't speak OTR.

Reply on news.ycombinator.com