Skip to main content

mastodon - Link to source

11 years into the development of #Conversations_im, I’m still working to enhance its security. Most recently, I’ve added support for XEP-0474: SASL SCRAM Downgrade Protection.

To take advantage of our continued commitment to security, make sure to:

· Use Conversations rather than a (soon-to-be-abandoned) fork

· Install Conversations through a source that provides automatic updates (F-Droid for Android 12+ or Google Play)

#XMPP

#xmpp #conversations_im
in reply to Daniel Gultsch

Mazhe
mastodon - Link to source
Mazhe
• •
Thanks! That's really impressive the stuff that went into #XMPP to improve usage and security, both by the spec people and those writing servers and cliens! Is this xep depending on using SASL2?
#xmpp
This entry was edited (2 weeks ago)
in reply to Mazhe

Daniel Gultsch
mastodon - Link to source
Daniel Gultsch
• •
@mazhe It works with both SASL and SASL2. However it does require server support and I believe that most if not all servers that support XEP-0474 have support for SASL2 anyway.
@Mazhe
in reply to Daniel Gultsch

Juanro
mastodon - Link to source
Juanro
• •

Are there any plans to upgrade to the latest version of OMEMO? XEP-0384

Since there is no compatibility between OMEMO1 and OMEMO2, would it be possible to implement the option to choose the OMEMO version to use in the chats while the different programs update it? codeberg.org/iNPUTmice/Convers…


Implement OMEMO 2

Kaidan recently had a [new release](https://www.kaidan.im/2023/05/05/kaidan-0.9.0), in which they implemented "OMEMO 2" (which is just a newer version of [XEP-0384](https://xmpp.org/extensions/xep-0384.html), which also encrypts metadata).
Codeberg.org
in reply to Juanro

Daniel Gultsch
mastodon - Link to source
Daniel Gultsch
• •

the blocker for upgrading to OMEMO 2 is a lack of a library that supports ODR (Omemo double Ratchet, a slightly modified version of libsignal). I'm not qualified to implement low level encryption stuff. However people that are more qualified than I in that regard are currently trying to get funding for that.

Migration will actually be relatively straight forward as one can use both omemo 1 and 2 in parallel.

This entry was edited (2 weeks ago)
in reply to Daniel Gultsch

BetaRays
akkoma - Link to source
BetaRays
• •
I don’t know a lot about Android development, but I thought you could use C libraries with the NDK (though that might not be practical enough).
in reply to BetaRays

Daniel Gultsch
mastodon - Link to source
Daniel Gultsch
• •
@BetaRays @juanro49 the amount of work in getting libsignal-java upgraded to ODR is probably comparable to creating Java bindings for Dino's fork of the C library. Either way someone has to do it. And that's what people are trying to get funding for.
@Juanro @BetaRays
in reply to Daniel Gultsch

Tommaso Gagliardoni
mastodon - Link to source
Tommaso Gagliardoni
• •

a big shoutout and thank you for #Conversations_im and #XMPP #Jabber in general. Personally, I love it, works super smoothly on my #grapheneos and by large I prefer it to #matrix

Also, may #discord burn in hell!

#xmpp #matrix #Jabber #discord #grapheneos #conversations_im
⇧