[infosechandbook]

> I can link a raspberry pi anywhere in the world to my XMPP server with a few lines of Python and some libraries.

Once again, "I, as a tech-savvy person, can operate my highly-customized XMPP setup everywhere", while ignoring that most people do not run their own servers.

> they discourage people from using other clients

This was discussed numerous times various platforms and proven wrong.

> I can verify that my server isn't tracking users

As discussed before on this page, most XMPP users don't run their own XMPP server but use a public XMPP server on the internet. Nobody can check whether this public XMPP server tracks its users without accessing the server itself.

> all of your eggs in a centralized basket, both in terms of privacy and reliability.

So, do you assume the Signal network infrastructure consists of a single server?

> Do not know of a single XMPP client that requires a phone number

At least Quicksy (from the Conversations developer who bragged in a public video about copying WhatsApp/Signal) and Kontalk require a phone number. They even market the phone number requirement as a benefit in comparison with other XMPP clients.

> most people will tell you

I could just claim the opposite. Without any sources, it remains an assumption.

> Signal doesn't

Signal does. You wrote, you use Signal. Did you ever join a Signal group? There is a dialog when entering a group the first time.

[topdancing]

> Once again, "I, as a tech-savvy person, can operate my highly-customized XMPP setup everywhere", while ignoring that most people do not run their own servers.

I said "my server", but the exact same code could be pointed at a different server by simply changing the username/password. Compare this to having to port a codebase from Signal to WhatsApp/Slack/whatever.

I'm also just using a standard ejabberd-based deployment, nothing highly-customized about it. Have you tried a Signal server deployment? I have, and THAT is the definition of highly-customized.

> This was discussed numerous times various platforms and proven wrong.

Alternative clients exist, but they are heavily frowned upon by the community - as a lot of the functionality they add (disappearing messages, view once media) depend on people using the official clients and not custom ones that could simply ignore this functionality.

> As discussed before on this page, most XMPP users don't run their own XMPP server but use a public XMPP server on the internet. Nobody can check whether this public XMPP server tracks its users without accessing the server itself.

That's fine, same thing applies to Matrix/Signal/WhatsApp/pretty much any messaging service out there.

> So, do you assume the Signal network infrastructure consists of a single server?

Functionally - although it is clustered - it is a single server, run by a single team - and it has gone down multiple times in the past few years.

And when it does go down: good luck using that Signal client to talk to anyone over it (SMS doesn't count as it has zero security on Signal and isn't even available on the iOS client). At least with XMPP, I can point the same client to some other server and potentially continue a conversation with someone somewhere else, with the exact same OMEMO/PGP encryption.

That is why decentralized/federated is better than "all your eggs in one basket" centralized. Centralization provides one with convenience, right up until it stops working and then it becomes a massive inconvenience.

> At least Quicksy (from the Conversations developer who bragged in a public video about copying WhatsApp/Signal) and Kontalk require a phone number.

The whole point of Quicksy is to allow people to try XMPP and find contacts easily with their number before they then move on to using actual JID-based accounts.

And he's more than free to brag about what he does - he's the one that spent the time; writing code and extensions and then released the thing to the public as free and open-source code.

> Signal does. You wrote, you use Signal. Did you ever join a Signal group? There is a dialog when entering a group the first time.

This is your Signal PROFILE name, not a username. You can quite clearly see this described in Settings -> tap the top bit with your number and read the text at the bottom.

People can still see your phone number by simply clicking on your user in the group member list. Signal, at the current time[0], has zero username functionality.

[0]: https://twitter.com/moxie/status/1480643863970816001

[infosechandbook]

Just one question as the rest was discussed numerous times before:

> At least with XMPP, I can point the same client to some other server and potentially continue a conversation with someone somewhere else, with the exact same OMEMO/PGP encryption.

How do you just "continue a conversation with someone somewhere else" when your XMPP server goes down?

Typically, you register an XMPP account on an XMPP server. If this server is offline, your account is unreachable as the account is managed by the XMPP server not by your client. Therefore, you can't use this account anymore. So you need to go to another XMPP server, register a new XMPP account, and then try to find your contacts again (which may be cached by your client or not). Finally, you have to convince "someone" that this is just you with another account on another server. There is also no verified E2EE anymore. If "someone" uses the same now-offline XMPP server, "someone" also needs to find another XMPP server.

How is this different from "when Signal goes down one uses a completely different instant messaging system", apart from using another client?

> That is why decentralized/federated is better

And we already explained (also several times) that XMPP is de-facto centralized as the vast majority of users only use a tiny number of XMPP servers hosted by an even smaller number of hosting companies. Which means: If one of these hosting companies blocks XMPP traffic (e.g., if a rogue state starts censoring) or one of these XMPP servers goes down, a huge part of XMPP users is affected.

[topdancing]

> then try to find your contacts again (which may be cached by your client or not)

You can save XMPP account IDs in any mobile address book.

> Finally, you have to convince "someone" that this is just you with another account on another server. There is also no verified E2EE anymore.

I'd pretty much just do a video call at that point.

> How is this different from "when Signal goes down one uses a completely different instant messaging system", apart from using another client?

You don't have to use another client software.

> Which means: If one of these hosting companies blocks XMPP traffic (e.g., if a rogue state starts censoring) or one of these XMPP servers goes down, a huge part of XMPP users is affected.

Equally applies to most messaging apps out there. Some XMPP apps have the benefit of also supporting using Tor and hidden services - Signal/WhatsApp/etc, don't.

Don't want to use the Internet at all and your friends live close by? You can even go wild and do something like:

- https://github.com/ddamianus/Lora-Chat-Device

- https://github.com/jgoerzen/ax25xmpp

I realize this is something most people would not do, but XMPP's _flexibility_ allows this to be an option if it was something people wanted. Can't do Signal over LoRa.

[infosechandbook]

> You can save XMPP account IDs in any mobile address book.

... while the rest of the XMPP account remains on the XMPP server, inaccessible. There is no benefit as you can also store other primary IDs like phone numbers in your address book.

And the rest comes down to "continue a conversation with someone somewhere else" isn't so easy but the same pain as with any other messaging system, minus you may use the same XMPP client, plus you may need to search a while until you find an XMPP server that comes with the fitting XEPs for your use cases.