I see almost everywhere XMPP is good, secure, etc. And I personally love how it works. But it’s not recommended on PrivacyGuides. Is it because it’s not easy for beginners or is there a security flaw I missed ?

The main reason is there is a massive differing in quality of clients, and what XEPs they support. Many actions are not E2EE, and it really depends on what client you’d be using. The protocol itself was never really designed for privacy, and a lot of those features have been shoehorned in afterward…

To be honest, I don’t quite understand why Matrix passes this hurdle and XMPP does not. Matrix is just as little designed for privacy as XMPP. Metadata is also generated, is also not E2EE (as far as I know) and is also distributed further by federation than in XMPP. The quality of the clients is al…

[image] Used0259: not E2EE (as far as I know) It is, maybe it depends on the client though, but Element does have E2EE : [image] End-to-end encryption (E2EE) | Collaboration and messaging Element is secure collaboration and messaging app designed to protect users and their privac…

I know that Element and many other Matrix clients support E2EE for messages, but not for metadata as far as I know. XMPP also has many clients that support E2EE for messages, but the criticism here was that metadata is not E2EE.

Profile pictures, reactions, and nicknames are not encrypted. Group voice and video calls are not E2EE, and use Jitsi […] This is from the PrivacyGuides recommendations. I run a Synapse server myself and can retrieve a large amount of unencrypted metadata about users.

The call thing is correct for the time being, native Matrix E2EE calls are coming very soon (i think it’s implemented in Element X currently…). Regarding the metadata, that is true, hence why people should use trusted homeservers.

coming very soon The same could be said about features for XMPP, many things are being developed (i think “coming soon” is an XMPP trademark since 2000). However, in my opinion, the current state of these two protocols is assessed differently here. trusted homeservers With XMPP, a trusted ser…

The main reason with XMPP is that direct messages aren’t necessarily encrypted, it depends on the client. In regard to metadata they’re both in terms of federated data. There is also quite a variety of XEPs that implement encryption in some places and not in others, and it’s really a mixed bag of …

There is also quite a variety of XEPs that implement encryption in some places and not in others, and it’s really a mixed bag of what your client actually is. Why not recommend just a client like Conversations then? I think it ticks all the boxes, except for an audit

@anonymous159 Conversations can do OMEMO for message content, sent images/files, and can negotiate the DTLS-SRTP encryption for calls over that same OMEMO channel, but everything else is not encrypted. The only client right now doing additional encryption for things like typing state and read mark…

Privacy Guides Community

Why not XMPP?

Questions

exaCORE February 29, 2024, 8:33pm 6

It is E2EE as long as you enable encryption on the room. With regards to the PFS issue see this: So... can PFS be enabled in Matrix at all? - #4 by exaCORE

Topic		Replies	Views
Matrix, SimpleX, or IRC with OTR for PFS? Questions	10	1444	October 20, 2024
XMPP Questions - please help me out! Questions	8	1089	April 17, 2025
Conversations (Android Client for XMPP) Tool Suggestions	4	732	May 4, 2025
E2EE messengers + Tails Questions	4	338	August 20, 2025
Why I Don't Trust Matrix Developers to Produce a Secure Protocol General article	1	1332	July 11, 2024

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

Why not XMPP?

Related topics