209
End-to-End Encrypted Chat that YOU Control: Hosting XMPP (Jabber) with Prosody
(roguesecurity.dev)
this post was submitted on 13 Oct 2025
209 points (98.2% liked)
Selfhosted
52426 readers
1190 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
When I see E2EE and XMPP mentioned, I think of this blog post by Soatok, outlining some very odd cryptographic choices in XMPP + OMEMO: https://soatok.blog/2024/08/04/against-xmppomemo/
I would very much like to see a richer playing field than just Signal for private messaging, but it's a tough nut to crack. For exactly which aspect that turns me away from XMPP for E2EE, I think this nails it down:
When the competition is Signal, these sorts of details matter a lot.
This is great, I have not seen this post before. Thank you for sharing.
You make an excellent point here, that the burden of security and privacy is put on the user, and that means that the other party in which you're engaged in conversation with can mess it up for the both of you. It's far from perfect, absolutely. Ideally you can educate those that are willing to chat with you on XMPP and kill two birds with one stone, good E2EE, and security and privacy training for a friend. XMPP doesn't tick the same box as Signal though, certainly. I still rely heavily on Signal, but that data resides on and transits a lot of things that I don't control. There's a time and a place for concerns with both, but I wanted to share my strategy for an internal chat server that also meets some of those privacy and security wickets.
Tbf, can't the other party mess it up with signal too? I have a friend with a Samsung running stock samsung android, bloatware and all; how can I trust there's no google or samsung keylogger, which I'm pretty sure at least one of those companies installs? With copilot existing now, how can I be sure that, when that makes it's way to stock android, it won't capture the signal convo? The man uses windows, how can I be sure he won't surrender our chats to current copilot?
If you need nation-state level secrecy, rule #1 is don't associate with idiots who can't be bothered with at least the most basic opsec. I shouldn't talk to this motherfucker at all were that my case, or at least not digitally. Thankfully at worst we talk about me middlemanning him some weed, and even local PD dgaf.
My main issue for signal is (mostly iPhone users) download it "just for protests" (ffs) and then delete it, but don't relinquish their acct, so when I text them using signal it dies in limbo as they either deleted the app or never check it and don't allow notifs. If they had relinquished their acct at least it would fall back on SMS and I could still contact them but the way it was I was literally cut off from texting at least three friends until I relinquished my acct. Now maybe somehow with the removal of SMS maybe that is fixed, but also removing SMS took my biggest selling point to "normals," so, fuck me.
Super true. I think this was best exemplified by SignalGate