Most people know XMPP as "<i>Jabber</i>" and it's sometimes regarded and an old protocol once used by Google and Facebook but which is no longer relevant. However, it still works and if appropriately configured, as it is on Freedombone, can provide the best chat messaging security currently available.
With regard to chat apps you might have read a lot of stuff about <i>end-to-end security</i>. That's important, but to also protect the metadata of who sends messages to who the data needs to be onion routed (wrapped in multiple layers of routing encryption), and that's something which most popular chat apps don't provide. Also beware of chat apps which fundamentally rely upon Google's infrastructure. You can be sure that they extensively data mine everything and will be able to reconstruct your social graph if that's at all technically feasible, then pass that to whatever governments they're friendly with or trying to lobby.
</p>
<p>
A well written article on the state of XMPP and how it compares to other chat protocols <ahref="https://gultsch.de/xmpp_2016.html">can be found here</a>.
In mid 2016 <ahref="https://gajim.org/">Gajim</a> became the first desktop XMPP client to support the <ahref="https://en.wikipedia.org/wiki/OMEMO">OMEMO end-to-end security standard</a>, which is superior to the more traditional <ahref="https://en.wikipedia.org/wiki/Off-the-Record_Messaging">OTR</a> since it also includes multi-user chat and the ratcheting mechanism pioneered by Open Whisper Systems. To install it:
Open Gajim and enter your XMPP address and password.
</p>
<p>
Go to <b>Edit/Preferences</b> and select the <b>Advanced</b> tab. Under <b>Global Proxy</b> select <b>Tor</b> and the <b>Close</b> button. Then select <b>Edit/Plugins</b> and make sure that OMEMO is active (ticked), then select the <b>Close</b> button.
Go to <b>Edit/Accounts</b>, select your account then the <b>Connection</b> tab. Ensure that <b>Use custom hostname/port</b> is checked and enter your onion address there as the hostname (it can be found on the <i>About</i> screen of the administrator control panel). Using the onion address will give you better protection against correlation attacks within the Tor network. Also under <b>Proxy</b> select <b>Tor</b>.
When you start a conversation make sure that the OMEMO box is ticked. You can also click on the keys button and trust various fingerprints. Both sides will need to do that before an encrypted chat can start.
</p>
<p>
If you wish to make backups of the OMEMO keys then they can be found within:
</p>
<divclass="org-src-container">
<preclass="src src-bash">~/.local/share/gajim
</pre>
</div>
<p>
If you wish to use OpenPGP to encrypt your messages then go to <b>Edit/Accounts</b>, select your account and then the <b>Personal Information</b> tab. You can then choose your GPG key. When initiating a chat you can select the <b>Advanced</b> button and then select <b>Toggle OpenPGP Encryption</b>. OpenPGP is not as secure as OMEMO, but does allow you to use XMPP in a similar style to email in that the recipient of the message does not necessarily need to be online at the same time that you send it.
The <ahref="https://profanity.im">Profanity</a> shell based user interface and is perhaps the simplest way to use XMPP from a laptop. It's also a good way to ensure that your OTR keys are the same even when logging in from different laptops or devices, and it also means that if those devices later become compomised then there are no locally stored OTR keys to be found.
or if you're already in an insecure chat with someone just use:
</p>
<divclass="org-src-container">
<preclass="src src-bash">/otr start
</pre>
</div>
<p>
Set a security question and answer:
</p>
<divclass="org-src-container">
<preclass="src src-bash">/otr question <spanclass="org-string">"What is the name of your best friends rabbit?"</span> fiffi
</pre>
</div>
<p>
On the other side the user can enter:
</p>
<divclass="org-src-container">
<preclass="src src-bash">/otr answer fiffi
</pre>
</div>
<p>
For the most paranoid you can also obtain your fingerprint:
</p>
<divclass="org-src-container">
<preclass="src src-bash">/otr myfp
</pre>
</div>
<p>
and quote that. If they quote theirs back you can check it with:
</p>
<divclass="org-src-container">
<preclass="src src-bash">/otr theirfp
</pre>
</div>
<p>
If the fingerprints match then you can be pretty confident that unless you have been socially engineered via the question and answer you probably are talking to who you think you are, and that it will be difficult for mass surveillance systems to know the content of the conversation. For more details see <ahref="https://www.profanity.im/otr.html">this guide</a>
</p>
<p>
When accessed via the user control panel the client is automatically routed through Tor and so if you are also using OTR then this provides protection for both message content and metadata.
Jitsi can be downloaded from <ahref="https://jitsi.org">https://jitsi.org</a>
</p>
<p>
On your desktop/laptop open Jitsi and select <b>Options</b> from the <b>Tools</b> menu.
</p>
<p>
Click <b>Add</b> to add a new user, then enter the Jabber ID (yourusername@yourmaindomainname). Close and then you should notice that your status is "Online" (or if not then you should be able to set it to online).
</p>
<p>
From the <b>File</b> menu you can add contacts, then select the chat icon to begin a chat. Click on the lock icon on the right hand side and this will initiate an authentication procedure in which you can specify a question and answer to verify the identity of the person you're communicating with. Once authentication is complete then you'll be chating using OTR, which provides an additional layer of security.
</p>
<p>
When opening Jitsi initially you will get a certificate warning for your domain name (assuming that you're using a self-signed certificate). If this happens then select <b>View Certificate</b> and enable the checkbox to trust the certificate, then select <b>Continue Anyway</b>. Once you've done this then the certificate warning will not appear again unless you reinstall Jitsi or use a different computer.
</p>
<p>
You can also <ahref="https://www.youtube.com/watch?v=vgx7VSrDGjk">see this video</a> as an example of using OTR.
The default XMPP client in Ubuntu is Empathy. Using Empathy isn't as secure as using Jitsi, since it doesn't include the <i>off the record</i> feature, but since it's the default it's what many users will have easy access to.
</p>
<p>
Open <b>System Settings</b> and select <b>Online Accounts</b>, <b>Add account</b> and then <b>Jabber</b>.
</p>
<p>
Enter your username (username@domainname) and password.
</p>
<p>
Click on <b>Advanced</b> and make sure that <b>Encryption required</b> and <b>Ignore SSL certificate errors</b> are checked. Ignoring the certificate errors will allow you to use the self-signed certificate created earlier. Then click <b>Done</b> and set your Jabber account and Empathy to <b>On</b>.
Tor Messenger is a messaging client which supports XMPP, and its onion routing enables you to protect the metadata of chat interactions to some extent by making it difficult for an adversary to know which server is talking to which. You can download Tor Messenger from <ahref="https://torproject.org">torproject.org</a> and the setup is pretty simple.
Search for and install <b>Orbot</b> and <b>Conversations</b>.
</p>
<p>
Add an account and enter your Jabber/XMPP ID and password.
</p>
<p>
From the menu select <b>Settings</b> then <b>Expert Settings</b>. Select <b>Connect via Tor</b> and depending on your situation you might also want to select <b>Don't save encrypted messages</b>. Also within expert settings select <b>Keep in foreground</b>. This will enable you to still receive notifications when your device is in standby mode with the screen turned off.
</p>
<p>
From the menu select <b>Manage accounts</b> and add a new account.
Hostname: mydomain (preferably your xmpp onion address)
Port: 5222
</pre>
</div>
<p>
Then select <b>Next</b>. When chatting you can use the lock icon to encrypt your conversation. OMEMO is the recommended type of encryption. It's also going through Tor, so passive surveillance of the metadata should not be easy for an adversary.
</p>
</div>
</div>
</div>
<divid="postamble"class="status">
<styletype="text/css">
.back-to-top {
position: fixed;
bottom: 2em;
right: 0px;
text-decoration: none;
color: #000000;
background-color: rgba(235, 235, 235, 0.80);
font-size: 12px;
padding: 1em;
display: none;
}
.back-to-top:hover {
background-color: rgba(135, 135, 135, 0.50);
}
</style>
<divclass="back-to-top">
<ahref="#top">Back to top</a> | <ahref="mailto:bob@freedombone.net">E-mail me</a>
