Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm not sure I follow this line of reasoning, there appears to be different, unrelated claims here: 1) xmpp, when encrypted and compressed, is inherently chatty and leads to battery drain on mobile. I don't think this is true.

2) Managed services are easier to use, and can deliver a better user experience than having to learn how to do everything yourself. I don't think anyone disagrees with that.

I don't think it follows that picking a subset of xmpp and building on that makes for a poor chat experience. Apart from "actual" xmpp/jabber services working just fine, Google talk and Facebook chat both worked fine with open xmpp clients.



This is a fascinating response, for a couple of reasons. The primary reason is that I never mentioned power consumption at all. I'm not sure what claim you think I'm making in that regard.

The secondary reason is that I never said anything about easier to use or even better experience -- I talked about the fact that WhatsApp worked at all on j2me devices. And for the record, I only even mentioned WhatsApp because the original article in question brought it up in the very first paragraph.

As for gchat and facebook chat, I'm not sure 'arbitrarily yanked out from under users' is "worked fine." See my other comment for the classes of problems I found with "actual" xmpp/jabber...


XMPP "when encrypted and compressed" seems fairly pointless; it's insecure.

The CRIME attack demonstrated that compress-then-encrypt fails to provide confidentiality if it mixes confidential data with attacker-controlled data.


CRIME allows for the recovery of certain parts of the cipher text, by sending many requests. I don't see an easy way to use it to apply it to xmpp (or imap).

In https, it is possible to enumerate certain headers, or other predictable data - session cookies in particular. How would you leverage the use of compression to attack xmpp?



Interesting. Perhaps digest auth should make a comeback with tls.

[and rate-limiting logins, obviously, as well as 2fa etc]




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: