XSF Discussion - 2021-07-16

https://mtpsym.github.io/ – Security Analysis of Telegram (Symmetric Part)

Seve: that's nothing new. People join telegram for two reasons 1) cheap space 2) they don't delete your stuff if its is relative OK.

Nobody goes there for security.

Citation needed. Also it depends on the threat model. If you just want to get away from Facebook or the FSB, maybe Telegram is a reasonable choice.

> Seve: that's nothing new. People join telegram for two reasons 1) cheap space 2) they don't delete your stuff if its is relative OK. 3) UI/UX - there is very comfortable ui as for messenger

> Citation needed. Also it depends on the threat model. If you just want to get away from Facebook or the FSB, maybe Telegram is a reasonable choice. haha, there are rumors that Telegram works with FSB

And Telegram provided data in the Hongkong demonstrations ✏

> 3) UI/UX - there is very comfortable ui as for messenger Agree. I wish more people help Daniel to make conversations more sexy. This will bring more people to xmpp.

Here's the pad with potential policies if any board member wants to weigh in on it: https://pad.disroot.org/p/XSF_Fiscal_Host_Rules

The stuff that's here now were just my thoughts about where we could start.

If you get time arc, we can collaborate on that pad to figure out what we want to rubber stamp and I can update the PR with whatever we come up with.

> https://mtpsym.github.io/ – Security Analysis of Telegram (Symmetric Part) Can we be sure that XMPP protocol and its encryption method (OMEMO) doesn't have the same kind of weaknesses or vulnerabilities?

If you read the link you'll see that it discusses Telegram's transport encryption

They created their own alternative to TLS, which everyone else (including XMPP) uses

Didn't Signal also invent their own transport encryption, Noise?

Zash: yes, which is used in Wireguard

WhatsApp used to have that insecure RC4 thing...

> If you read the link you'll see that it discusses Telegram's transport encryption You are right. But can we be sure that TLS and OMEMO are more secure than Telegram's encryption?

TLS has evidently had a lot of problems in the past, but it also has a lot of cryptographers looking at it.

Paganini, no we can't be sure. Only time will tell. And time usually tells us that all crypto is broken eventually.

Signal doesn't use TLS and uses Noise instead?

Noise over TLS 😀

Seriously? That would be quite ridiculous.

Not as ridiculous as OMEMO over TLS over Noise over WireGuard over IPSec ... over HTTP

...over TCP

No no, over XMPP https://xmpp.org/extensions/xep-0332.html

oh god

hello i see blabber.im in https://xmpp.org/software/clients.html maybe it should be removed now?