Jul 6th, 2025 at 8:40 pm
#2729(Sorry to bump.)
I think I have an explanation for how this works, which now has context.
As long as users use 'OMEMO' encryption for the messages to other users, because that's E2E-encrypted, it's also 'secure', over the connection which exists between the client and the server. However, things like the password one uses to connect to the server are not secure - they're in plaintext.
So, because users have sought a solution to this a number of times, specific clients will try to secure their connection to the server as well. Psi+ offers this with 'OpenPGP'.
However, these added means of encryption are not part of XMPP in any standard way. So, their support may be spotty.
Further, if there is just 'an open client socket' across international boundaries, idling for 6 hours, and if that's fully encrypted, there's also the possibility that some of the infrastructure nodes will preferentially kill that socket.
-Dirk