Hacker News Reader

Comment by MattJ100 | Hacker News Reader

> There is one problem the author mentioned which applies to XMPP but not to email/ActivityPub: presence tracking. [...] clients and servers to advertise the presence status (online, away) to the entire world, and that's a huge metadata leak.

They don't advertise it to the entire world, but to authorized contacts (and typically groups that you join). With the rise of mobile clients, statuses other than 'online' are far less common than they used to be, because they are growing irrelevant.

Advertising online status to the whole world is what WhatsApp does ( https://news.ycombinator.com/item?id=26809770 ).

View on HN

> and typically groups that you join

So more or less to the entire world if you join public chats. Even if you use different nicknames, occupant-id (used for message edits) may be used to track your presence across rooms.

> Advertising online status to the whole world is what WhatsApp does

If we're pointing the finger, i'd recommend reading this document about what Signal does wrong in terms of privacy and security. It's overall a good read of what not to do in private messenger UX:

https://north-shore.info/wp-content/uploads/2019/06/signalfa...

>They don't advertise it to the entire world, but to authorized contacts (and typically groups that you join)

But in the article they showed how the server administrator can easily add contacts to a user's contact list. So my understanding is that the user isn't really in control of who can see this information, as the server admin could add a new contact that can then see the presence status. Correct?

Edit: formatting

Valid question, not sure why the downvotes. You're right, the server can modify the contact list (and this is used extensively within organizations, and in Snikket to ensure family members can see each other by default).

But this isn't the cause for concern here - if the server is malicious it can broadcast this info without the need to modify your contact list. This again is independent of protocol - if someone wants to log or share the times and durations you are actively connected to their server, they can do so quite easily. It doesn't require XMPP.

> the user isn't really in control of who can see this information

Server-side parties (e.g., the admin) can see the status information without adding somebody to the group. It is in cleartext, passing the server.

Reply on news.ycombinator.com