Modern XMPP project discussion - 2025-03-20

Why isn't ATM (https://github.com/olomono/atm?tab=readme-ov-file) used in a lot more clients?

Pub Key verification is sooo annoying :/

I use four devices, my boyfriend uses three. Then he logs in to a fourth device. Suddenly start reading long hex numbers to each other for a couple minutes.

This is currently my biggest annoyance and the reason most people reject the idea of using XMPP: It's too annoying to verify keys.

So I'm really curious why this isn't in, like, every client?! :D

erebion, no, most people don’t ever verify keys.

Have you considered that my "most people" does not fully overlap with your "most people"?

I was talking about most people, not people around you that I don’t know.

Consider upvoting or filing feature requests in clients. Client devs may be more likely to implement it if they see that there is demand.

> Why isn't ATM (https://github.com/olomono/atm?tab=readme-ov-file) used in a lot more clients? because if you outsource device verification like that you might as well not do it at all. ↺

yeah .. its like, if your threat model is really that you believe that somebody intercepts your communication, why would you trust some automatic key verify thingy

and if thats not your threatmodel, why do you not simply use blind trust which most clients support.

Kris, I would disagreee, cross-signing/cross-approving keys is a useful feature that can significantly reduce the friction of using E2EE securely ✏

but it does only reduce the friction if someone decides for themself they want friction and disable blind trust

I said securely

I do agree with Link Mauve in that most users will never ever try to verify a key

but that does not mean we should give up any way to make the serious route less painful

like in some limited ways it is more secure than trust-on-first-use, and in some other ways it is less secure. And overall it just doesn't seem worth it IMHO

i think the problem is blind trust before verification

some users use blind trust, then they think at a later point, lets verify some device, scan some qr codes, hey fun

but now the device thinks you are serious about encryption, suddenly the next device will not be trusted blindly anymore because you verified manually before

lovetox, that is a case that some (client-side) automated device management could help with

yes, im not arguing its useless, it just mostly hits the nerds, and they can endure a bit of pain :D

nah im half joking, but thats kind of the cost/benefit thoughts i have on this

like on my list are always 10 more features that will have immense more impact

indeed, if someone wants to touch rather complex e2ee stuff, updating a client to support OMEMO 0.8.x would bring much more benefits than this convenience feature of dubious benefit.

or adding MLS for group chats

erebion: out of curiosity, you say "this is the reason most people reject the idea of using XMPP" - what do those people use instead?

I can only think of Signal or Matrix. Signal uses manual verification of keys (or rather, "safety numbers"), and Matrix... I'm always hearing complaints about their E2EE verification prompts and stuff (and it has introduced security issues for them)

So I'd love to hear more if I'm missing something

Matrix and Signal, yes

With exactly that as their reason

E2EE in Matrix is buggy, but cross signing is not really painful, at least not as much as having m * n key verifications done. 1 verification can in most cases be a lot less than m * n.

I can talk to my boyfriend using Matrix, Signal and XMPP. We disliked the first two, for various reasons, now we settled on thr latter. We had this many verifications: 1 - Matrix 1 - Signal 12 - XMPP I use every one of those on 4 device, my boyfriend uses them on 3 devices.

Matrix cross-signs keys, so that after verifying once, others know what keys to trust. Signal does something similar, coupled with the process of adding another device by scanning a QR code.

Oh and I forgot I even have to verify my own OMEMO keys. If my tired sleepy brain did not miscalculate, that's 37 key verifications, just so that I can talk to my boyfriend.

He even says we should not log in on more devices as that is too annoying.

I just tested Dino and Gajim with the Orca screen reader and the result is that both are almost completely unusable

I almost just want to write my own XMPP client. QXmpp looks really neat.

But I prefer Rust over C++, but xmpp-rs seems less mature. And I love the way Qt looks and feels. ✏

does Signal even support multiple real devices?

afaik they only do some hack for "linked" devices for the desktop app

Squeaky Latex Folf, you tried Kaidan?

Kind of. It looks too much WhatsApp-like

I prefer a more QtWidgets-like look

but does it work with a screenreader?

Haven't tried yet

afaik the Kirigami toolkit that Kaidan uses has gotten some specific efforts for accessibility

but I might misremember