Against XMPP+omemo

XMPP, a long-established messaging protocol, has faced criticism for its lack of robust encryption, leading to the development of OMEMO (XEP-0384) as an attempt to provide end-to-end encryption. However, the author argues that OMEMO does not meet the necessary standards for secure messaging, particularly when compared to protocols like Signal. Key issues include the fact that OMEMO is not enabled by default and can be disabled, undermining its security. The author highlights a significant problem with the XMPP+OMEMO ecosystem: many implementations are outdated, often using older versions of the OMEMO specification that lack critical security features.

The article also points out that OMEMO's design lacks a clear rationale, leading to potential vulnerabilities. For instance, changes in encryption methods between versions have not been adequately justified, raising concerns about their security implications. Furthermore, the market penetration of XMPP+OMEMO is limited, as users can opt to use XMPP without encryption, which is not the case with Signal.

The most popular client, Conversations, is criticized for its complexity and reliance on outdated cryptographic libraries, which may expose users to security risks. The author concludes that while XMPP was a well-intentioned protocol, the integration of OMEMO has not sufficiently addressed the need for secure private messaging, leaving it vulnerable compared to more robust alternatives.