this post was submitted on 03 Mar 2025
392 points (97.1% liked)

Buy European

6227 readers
440 users here now

Overview:

The community to discuss buying European goods and services.

Matrix Chat of this community

Rules:

  • Be kind to each other, and argue in good faith. No direct insults nor disrespectful and condescending comments.

  • Do not use this community to promote Nationalism/Euronationalism. This community is for discussing European products/services and news related to that. For other topics the following might be of interest:

  • Include a disclaimer at the bottom of the post if you're affiliated with the recommendation.

  • No russian suggestions.

Feddit.uk's instance rules apply:

  • No racism, sexism, homophobia, transphobia or xenophobia
  • No incitement of violence or promotion of violent ideologies
  • No harassment, dogpiling or doxxing of other users
  • Do not share intentionally false or misleading information
  • Do not spam or abuse network features.
  • Alt accounts are permitted, but all accounts must list each other in their bios.
  • No generative AI content

Useful Websites

Benefits of Buying Local:

local investment, job creation, innovation, increased competition, more redundancy.

European Instances

Lemmy:

Friendica:

Matrix:

Related Communities:

Buy Local:

Continents:

European:

Buying and Selling:

Boycott:

Countries:

Companies:

Stop Publisher Kill Switch in Games Practice:

Banner credits: BYTEAlliance

founded 4 months ago
MODERATORS
maam@feddit.uk
alex@jlai.lu
circledot@feddit.org
Argyle13@lemmy.world
Sunshine@feddit.is
Sunshine@lemmy.ca
buyeuropean@lemmy.ca
buyeuropean@feddit.org
lazycog@feddit.uk
Sunshine@piefed.social
392
Poster found on /r/BuyFromEU (i.postimg.cc)
submitted 3 months ago* (last edited 3 months ago) by Blaze@lemmy.dbzer0.com to c/buyeuropean@feddit.uk
82 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[โ€“] lord_ryvan@ttrpg.network 2 points 3 months ago* (last edited 3 months ago) (3 children)

XMPP is more comparable to Signal, yes.

Signal does need (yes, need) a phone number, and most people only have one so that is identifiable info.

This puts it at mostly the same level as some competitors, including WhatsApp which is often advised against.

[โ€“] Supernova1051@sh.itjust.works 1 points 3 months ago (2 children)

XMPP is more comparable to Signal, yes.

XMPP allows unencrypted messages and leaks metadata - Signal does neither.

Signal does need (yes, need) a phone number, and most people only have one so that is identifiable info.

Signal is basically a privacy enhanced text/SMS/phone replacement. I can give my phone to someone in person and they can immediately start "texting" me on Signal - this is a feature (as well as a con to some people).

This puts it at mostly the same level as some competitors, including WhatsApp which is often advised against.

People advise against Whatsapp because while it uses Signal to encrypt message contents, they take no effort to minimize the collection of metadata - Signal's been compelled by court to present all data it has on its users various times and the only info they have is the day/time you signed up for their services and the last day (not time) one of your clients pinged their servers - Source: https://signal.org/bigbrother/

I have yet to find any other free service that collects this little information and works just as well as a normal non-encrypted messenger. Even Signals sticker packs are end-to-end encrypted - Source: https://signal.org/blog/make-privacy-stick/

[โ€“] lord_ryvan@ttrpg.network 1 points 3 months ago (1 children)

What metadata does XMPP leak? AFAIK only when a message was sent, roughly (in large increments) how large the message was, the server of the sender knows from who to which server, the server of the recipient knows from which server to who.
I find it strange that Signal somehow doesn't know when a message was sent, and from who to who; how would they ever make this possible?

Also, you say you have yet to find any other free service that collects as little data... How about most e-mail providers? Not Google and Microsoft of course, but most e-mail providers only need a name which can be made up as well. You hm also host your own email server, then you are in control. All of this is true for XMPP and Matrix, as well.

[โ€“] Supernova1051@sh.itjust.works 1 points 1 day ago

What metadata does XMPP leak?

  • Sender's Full Jabber ID (JID): This is typically in the format user@domain.com/resource. The user@domain.com part identifies the user and their home server, and the /resource identifies the specific client device they are using (e.g., alice@example.com/mobile or alice@example.com/laptop).
  • Recipient's Full Jabber ID (JID): Similar to the sender's, this specifies who the message is intended for, including their user, home server, and often the specific resource.
  • Sender's Server: The domain of the sender's JID reveals which XMPP server the sender is connected to.
  • Recipient's Server: The domain of the recipient's JID reveals which XMPP server the message is being routed to.
  • Timestamp of Message Transmission: Servers record when a message was sent, which can be used to infer activity patterns.
  • Approximate Message Size: While the exact content is encrypted, the size of the encrypted stanza can still be observed. This can sometimes give clues about the type of content (e.g., a small text message - versus a larger file transfer).
  • Message Type (e.g., chat, group chat, presence, IQ): XMPP uses different stanza types for various purposes. Even with E2EE, the type of stanza (e.g., a "message" stanza vs. a "presence" stanza) is visible.
  • Participation in Group Chats: If a user is part of a Multi-User Chat (MUC), the MUC service and the user's participation in it are known to the MUC server and potentially other participants' servers.
  • Presence Information: XMPP inherently broadcasts presence (online/offline status, "away" messages, etc.) to contacts. This reveals when a user is active.
  • Contact List (Roster) Information: While not "leaked" during every message, the XMPP server hosts and manages the user's contact list, meaning the server knows who a user is communicating with.
  • Device Information (Resource): As mentioned, the /resource part of the JID can reveal the type of client or device being used.

I find it strange that Signal somehow doesnโ€™t know when a message was sent

Signal uses Sealed Sender (wired.com). Imagine if letters you sent didn't require a "from" field - or it was inside the envelope and impossible for anyone to see it. The post office would only know who its going to and only the recipient can decrypt it (open the letter) to see who sent it. Now, you could say, well they have your IP and can correlate it to the account, but the easy way around this is to either use a VPN or Signal proxy (support.signal.org) if you're that paranoid.

how would they ever make this possible?

Read more about it here: Technology preview: Sealed sender for Signal (signal.org)

How about most e-mail providers? Not Google and Microsoft of course, but most e-mail providers only need a name which can be made up as well

Most email providers suffer similar metadata leaks as XMPP because:

    1. Email was created in the 70's and we've learned a lot since then about privacy and security.
    1. XMPP works off a similar concept where you inherently pass data along to another server.

You could host your own email, XMPP, or Matrix server - that's definitely a win for privacy. But as soon as you interact with someone outside your ecosystem (server), metadata leakage is an issue again. It's why making end-to-end encrypted email is a hard problem to solve. It's not that it can't be secure, its that it has to work with those that aren't because that's the expectation.

... host your own email server, then you are in control

Until you interact with others who aren't using encryption or have it misconfigured.