Add support for OMEMO Encyrption

[Flowdalic]

The offspring of this years GSOC XSF projects is OMEMO. An axolotl and PEP based open standard for end-to-end encryption. Would be great to see support for it in Xabber.

XEP: XEP-0384: OMEMO
Related Smack issue: SMACK-743
ProtoXEP: http://conversations.im/xeps/multi-end.html
More info: http://conversations.im/omemo/

[TurkeyMan]

Finally, security has arrived in IM without compromise. Please add this protocol! I will switch back from Conversations when it comes.

[Buntbart]

+1

[falsefifth]

+10

[vanitasvitae]

I'm working on an OMEMO Smack module as part of my bachelors thesis, so Xabber might use this in the future.

[imp1sh]

yes, please support OMEMO in xabber.

[climf]

Thanks for all the fish, but the addition of this fish would be more better.

[vanitasvitae]

I'm considering to implement OMEMO in Xabber using smack-omemo and smack-omemo-signal. How can I get further in touch with you?

[tdemin]

Looks like smack-omemo has been implemented, any progress on it in Xabber?

[andrewnenakhov]

We have some other more immediate plans. We have 100% confirmation that at least 80-90% of Russian Xabber users use it for buying drugs. And since our crowdfunding campaign goes rather slow,we... Let's say, not too interested into stretching ourselves and give one more encryption method for this cathegory of users. In fact, we are considering removing Xabber from Russian play store at all,we have some very unwanted attention from authorities because of OTR, but to add yet more to it... No. Definitely not now.

If patreon campaign will reach certain milestones,maybe.

[Buntbart]

Can you explain how unwanted attention by authorities is affected by crowdfunding efforts?

[rugk]

Not good. Time to setup a warrant canary, is not it?
Also with this background the crowdfunding campaign will certainly not go faster… if we have to fear interference of some authorities.

Also, you hopefully know that this argumentation is definitively crap. And unless you track your users (which I don't think so) you cannot know what your users are doing with your messenger. So where did you got this number?

[andrewnenakhov]

@Buntbart that's easy. On one hand we have some difficulties with authorities who vaguely threat they can destroy my business in an instant (it's very easy in russia. police just storms the office, takes away all computers, returns it after 3 years, if ever, end of story). On the other we have an audience of users who constantly moan of a feature I don't personally need at all, and pay me nothing. If we put these two together, a clear solution is to screw Russian audience, I don't really care what client they will use.

@rugk this argumentation is based on facts. Over the years we have seen just so many help requests on our email support in so many languages, requests in Russian stands out in it by some very unusual metrics rarely present in other groups - phony names and inadequate requests, users clearly have no idea how XMPP works. Plus we've recently launched our own XMPP service that requires users to provide name and surname. And guess what, out of several thousands registrations Russian locale names and surnames once again look very... different from Germans.

So, since I have zero sympathy for junkies, and Russian audience is proving to be worthless to me, while giving me some headache. So, I think we'll be removing Xabber from Russian Google Play.

And once again on OMEMO: so far I'm the only one who paid for development of Xabber, I had some spare money to create an app that I like. I like current Xabber, and I have some plans to redesign it to make it even better looking. I have some plans to create several protocols to make XMPP work much better on mobile devices. I have some plans to bring Xabber for Web to many desktop platforms with Electron framework. I have some plans for all these versions of Xabber to work seamlessly with one another, so you can pick up your conversation on phone after chatting on desktop. That what I want and what I'm paying developers for.

What I don't want is OMEMO, it's worthless to me. And since I'm a bit out of spare money, I have to make Xabber a viable source of income, I have some Ideas how to do that, and OMEMO does not play into any of these ideas. If some of you want this feature badly, pay me a for development of it (we charge $3500 per developer man/month). If you are not willing - well, sorry, we serve only customers, not freeriders.

I actually don't understand this desire for encryption. Some ejabberd developer recently said in email group that XMPP community is affected by severe crypto-cancer, and I fully agree with him. For most uses, OTR or OMEMO just gives user an illusion of safety, not really meaningful increase in it. If you want your messages to be safe, you can just run your own server, that's easy and rather cheap. Just be wary of certificate errors.

TL,DR: OMEMO is for junkies and crypto-nerds who pay us nothing, get lost, or pay.

[imp1sh]

It's sad to hear that you have problems with the authorities. Don't let them oppress you if you didn't do anything wrong.
On the other hand there are normal people - who don't use this to deal drugs - who just want their privacy to be protected and also have some convenience. That what's OMEMO is all about.