Feedback and inputs on my experience with installing Conversations app, Disroot app, ElementsX app and opening accounts in mov.im, xmpp-social and disroot, for whoever it may help:
It appeared to me that in the XMPP open framework, based on the discussions above that I can readily be found by anyone by my username. That I have no real privacy in this framework. That the administrators could theoretically monitor my chats, messages and contents sent over the framework.
While in XMPP, privacy depends on server policies and my configuration.
Public Username: Others can find me using my Jabber ID (username@domain). It's not entirely private unless I configure visibility settings.
Administrator Access: Server admins can theoretically monitor unencrypted messages, but they cannot read end-to-end encrypted chats (e.g., OMEMO encryption).
To enhance privacy, one has to use servers with strong privacy policies, enable encryption, and avoid sharing identifiable information.
There are other factors that sort of unsettled me:
Visibility settings for my Jabber ID depends on my XMPP client. Generally:
Privacy Lists: Set rules to block or allow specific users or groups.
Status Updates: Limit visibility of my status or presence information.
Profile Info: Avoid sharing personal data in my account profile.
Encryption: Use OMEMO or PGP to secure messages.
I have to refer to my client’s privacy or account settings to configure these options.
My next set of questions was:
XMPP is a very public platform. Then what about privacy?For emails, even if someone finds my email-ID and spams me, I can choose to delete and overlook. Is the same possible in XMPP?
What I found was that XMPP can handle spam similarly. If someone spams me:
Block: Use my client to block specific users.
Ignore Requests: Reject contact requests from unknown users.
Report: Inform the server admin if harassment occurs.
Server Settings: Choose servers with anti-spam measures.
While XMPP is public, robust privacy tools are available to manage spam effectively.
There appears to be another problem: There is no emailbox/messagebox to store my emails/messages for future perusal.
XMPP’s confidentiality and privacy depend on server policies and encryption settings. Unlike Telegram or Signal, XMPP does not inherently provide centralized end-to-end encryption. OMEMO can secure chats, but metadata like my Jabber ID may remain visible.
Platforms like Signal offer mandatory E2EE and enhanced metadata protection, which XMPP lacks without careful configuration. Jami, as a fully decentralized platform, further eliminates server reliance, offering greater privacy by design.
So I have decided to be back to Telegram, altering the privacy settings to the max possible, as very few in my acquaintance circle use Signal. Anyway, Signal, as stated earlier, isn’t available simply via web-browser. So, while it remains in my smartphone, I don’t use it.
I deleted all my accounts with the XMPP platform. I am currently checking Jami and will continue to do so in the coming days.