this post was submitted on 18 Nov 2021
29 points (100.0% liked)
Privacy
33462 readers
555 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
That is technically true, but all servers from which users connect to the chatroom effectively get their hands on that traffic anyway to deliver it to the user (and could log it), which why end-to-end encryption is encouraged in chatrooms. [1]
It's a tradeoff of XMPP that clients usually only interact with their own server (this is also true for Matrix). , This is done for scalability, reliability, and privacy. This way remote servers cannot for example record your IP address.
However, it's very possible to negociate out-of-band access to some resources from your XMPP account (where leaks could occur, eg. for downloading on the web an image another user uploaded in a groupchat). For example, XEP-0070: Verifying HTTP Requests via XMPP defines a protocol for authenticating Jabber/XMPP users on the web.
[1] OMEMO encryption works rather reliably on "modern" clients in private messages and private groupchats, but is not yet supported in public chatrooms because encryption for so many recipients is resource-expensive and key verification in a public setting is a nightmare (do you really trust all those keys if anyone can join?) so there's arguably little benefit in that.
Yes, but only the data it needs to know to deliver what the client requests, not the full historic room state as in the case of Matrix.