6 Jan
2025
6 Jan
'25
2:06 p.m.
Good day to one and all!
I have been contemplating the idea of utilizing PubSub as a platform to
synchronize browser bookmarks, history and tabs. See article "XMPP For
Browsers" at The XMPP Newsletter of November 2024.
I have received crucial criticism by the Pale Moon developers due to
neglegence of encryption. It is not in my intention to neglegence
encryption, yet I do not intend to add encryption before a working
prototype.
Schimon:
> There is no storage encryption yet. I do not know
whether it is
> necessary
Moonchild:
Unacceptable.
Nobody but the end user should be able to access the stored data.
Encryption is required, and encryption should be set up in such a way
that nobody aside from the end user (not even the server admin) has
access to this data. Storing everything in plaintext in an XMPP
service instance is ridiculous.
That said, the owner of the server must not have any access to the data.
However, I am thinking of encrypting the data, yet I do not how to
implement such system which will be possible to decrypt only by the
owner of the data, and I also do not know how to handle a situation in
which an encryption key was lost.
Links:
https://forum.palemoon.org/viewtopic.php?t=31900
https://portal.mozz.us/gemini/woodpeckersnest.space/~schapps/journal/2024-1…
gemini://woodpeckersnest.space/~schapps/journal/2024-11-28-xmpp-for-browsers.gmi
https://xmpp.org/2024/12/the-xmpp-newsletter-november-2024/
Happy new year!
Schimon
6 Jan
6 Jan
6:17 p.m.
Hi and Happy New Year Schimon.
Le lundi 6 janvier 2025, 14:06:28 heure normale d’Europe centrale Schimon
Jehudah a écrit :
However, I am thinking of encrypting the data, yet I
do not how to
implement such system which will be possible to decrypt only by the
owner of the data, and I also do not know how to handle a situation in
which an encryption key was lost.
There are currently 2 specified e2ee mechanisms for pubsub:
- XEP-0473: OpenPGP for XMPP Pubsub , this is probably what you want to use.
- XEP-0477: Pubsub Targeted Encryption, this is more for ad-hoc item
encryption, and can be used with OMEMO (so you can have PFS). But in your use
case, I thing that XEP-0473 is more adapted (and probably easier to
implement).
Note that Libervia implements both, if you wanna test your implementation.
Best,
Goffi
6:59 p.m.
Goffi. Good evening!
On Mon, 06 Jan 2025 18:17:23 +0100
Goffi <goffi(a)goffi.org> wrote:
Hi and Happy New Year Schimon.
Le lundi 6 janvier 2025, 14:06:28 heure normale d’Europe centrale
Schimon Jehudah a écrit :
Yes. I think that I will utilize XEP-0473: OpenPGP for XMPP Pubsub.
However, I am thinking of encrypting the data,
yet I do not how to
implement such system which will be possible to decrypt only by the
owner of the data, and I also do not know how to handle a situation
in which an encryption key was lost.
There are currently 2 specified e2ee mechanisms for pubsub:
- XEP-0473: OpenPGP for XMPP Pubsub , this is probably what you want
to use.
- XEP-0477: Pubsub Targeted Encryption, this is more for ad-hoc item
encryption, and can be used with OMEMO (so you can have PFS). But in
your use case, I thing that XEP-0473 is more adapted (and probably
easier to implement).
Note that Libervia implements both, if you wanna test
your
implementation.
Thank you very much for the advise! I will surely do so.
Best,
Goffi
Regards,
Schimon
20
days inactive
20
days old
2 comments
2 participants
participants (2)
-
Goffi -
Schimon Jehudah