Drafting a method for verifying new devices for #XMPP end to end encrypted chats.
This is a very early draft/brain dump, once a few people validates, it can be submitted to official review process.
#Matrix already implements cross signing and this makes encryption experience very smooth, but in XMPP using multiple devices in encrypted rooms is really a mess.
XMPP already have a concept of master key per identity defined in OpenPGP for XMPP. We can combine these two.
Rigel and the Witch Head Nebula
Image Credit & Copyright: Simone Curzi
apod.nasa.gov/apod/ap241031.ht… #APOD
Debbie Goldsmith 🏳️⚧️🏳️🌈⧖ reshared this.
A Map of the New Normal: How Inflation, War, and Sanctions Will Change Your World Forever by Jeff Rubin, 2024
Bestselling economist Jeff Rubin warns that the shock inflation of 2021 is the front of a perfect storm of war, supply-chain disruption, geopolitical realignment, domestic upheaval, and energy scarcity that will change everything.
@bookstodon
#books
#nonfiction
#economy
#inflation
#forecasts
bookstodon group reshared this.
HEY #DUTCH people‼️ Do something about this!
> He has always felt he was being treated unfairly, but this was something else. “We had a Dutch chief engineer, he suffered a heart attack as I suffered a stroke, he was immediately airlifted. A helicopter took him to the shore in Florida to get immediate medical attention. Because he’s Dutch.”
rappler.com/newsbreak/in-depth…
We treat foreigners as human beings and equals (even in job) here in the Philippines, and this is how our own people are treated abroad⁉️ Let me guess, you treat animals far better, right?
💢👿
#Netherlands #Philippines #Filipino #Pilipino #Pilipinas #Inhumane #Slavery #Maltreatment @pilipinas @philippines
Glyn Moody reshared this.
frater chaos likes this.
📢 New GStreamer 1.24.9 bug-fix release for our stable 1.24 series!
Includes bug fixes, a security fix, stability improvements, memory leak fixes, and performance improvements.
Details at gstreamer.freedesktop.org/rele…
📦 Binary packages for Windows, macOS, iOS and Android are now available at gstreamer.freedesktop.org/down…
#GStreamer #Release #opensource #FreeSoftware #Multimedia
Ogenomtänkta nya vänsterpartier. Personer som uteslutits ur Vänsterpartiet helt i onödan och helt utan att det funnits anledning till det bildar nya vänstergrupper på löpande band. Fast de kallar dem partier och de ska alltid samverka med andra vänstergrupper folkrörelser och aktivister på en massa olika sätt.
Ab sofort ist #Thunderbird offiziell für Android verfügbar. Die Telemetrieübermittlung an »incoming.telemetry.mozilla.org«, die in der Beta-Phase noch enthalten war, ist nicht mehr aktiv. 👇
kuketz-blog.de/thunderbird-fue…
bei Mozilla muss man ständig auf der Hut sein - keine Lust.
Pirate Praveen
in reply to Pirate Praveen • • •This is one of the high priority issues identified by @prav community and we hope to focus on this once we finish prav.app/donate/custom-usernam…
Once the XEP gets validated by XMPP community, we plan to run another crowd funding campaign to implement this (we submitted a proposal to NLNet for this, but was not accepted).
#Prav #XMPP #FreeSoftware
lbja
in reply to Pirate Praveen • • •Pirate Praveen
in reply to lbja • • •Julian Andres Klode 🏳️🌈
in reply to Pirate Praveen • • •Pirate Praveen
in reply to Julian Andres Klode 🏳️🌈 • • •Julian Andres Klode 🏳️🌈
in reply to Pirate Praveen • • •I found it always ended up having to import some sort of recovery export of the private key and pray stuff work, I could not get the automatic session key stuff to work at all.
Where encryption works seemlessly is whatsapp and signal. But there the keys aren't exchanged or anything; a backlog is pushed from the primary device to the new device and future messages are also encrypted to the new device by advertising that key (AFAIUI).
Pirate Praveen
in reply to Julian Andres Klode 🏳️🌈 • • •XMPP Brasil
in reply to Pirate Praveen • • •Pirate Praveen
in reply to XMPP Brasil • • •Kris
in reply to Pirate Praveen • • •Very IMHO, but I think this is a bad idea. Both for practical and security reasons.
For the practical reasons: The issue people have with device based keys in OMEMO are largely a result of power users with many changing devices/clients, and regular users with primary one or maximum two devices don't have much problems with it. In Matrix the reverse is somewhat true... if you are a power user in Matrix and know how to add new devices and such, you don't see the extreme pain this convoluted key-sharing system causes casual webclient users that only sometimes use Element to check some public channels.
As for security: That the other side of a conversation can tell when you add additional devices and that you have to explicitly trust them is a huge security plus for OMEMO. Sure, that can get a bit inconvenient sometimes, but convenience should never trump security (although all too often it does, case in point: Matrix).
Pirate Praveen
in reply to Kris • • •@kris Practical consideration: Only if you use public devices like a library you will have a problem. If it is only your personal device, you keep the device logged in, so you have to verify only once. I agree it is a different way from non end to end encrypted systems where you freely login and logout. But getting end to end encryption working by default justifies that inconvenience.
Security: You have a choice to verify the master key of a user or not. (1/2)
Pirate Praveen
in reply to Pirate Praveen • • •Râu Cao ⚡
in reply to Pirate Praveen • • •