On 01/16/2015 11:57 AM, stef wrote:

On Fri, Jan 16, 2015 at 11:31:58AM -0600, Cypher wrote:

...

Thoughts?

you want to avoid xml based "solutions". langsec should be considered from the beginning. also i'm unsure of the store-and-forward-properties of xmpp.

Agreed. From running an XMPP server, XMPP does (or can) have store and forward capabilities but that is something that would need to be addressed. For maximum security, there needs to be a way for the messages to be encrypted to a key controlled by only the recipient while it's sitting on the server. I suppose using PKI could accomplish that. Cypher

Anonymity is much easier and much stronger in a uni-directional store and forward environment. Real time is a killer and creates all kinds of attack paths. -Lance -- Lance Cottrell loki@obscura.com

On Jan 16, 2015, at 2:13 PM, StealthMonger wrote:

Cypher writes:

...

I've been reading a lot about the need to replace email and I'm not quite sure why we're not moving to an XMPP based model.

Because it's /connection based/ and therefore low latency, so cannot be used by an untraceable pseudonym (endpoint IP packet correlation).

Contrast with email, where the security is /message based/ and can use anonymizing remailers having deliberately long, random latency.

--

-- StealthMonger Long, random latency is part of the price of Internet anonymity.

Key: mailto:stealthsuite[..]nym.mixmin.net?subject=send%20stealthmonger-key