starseerdrgn | XMPP vs. Telegram: My thoughts.

I am a rather strong fan of XMPP, the Extensible Messaging and Presence Protocol, and use it as my instant messaging system of choice. I have an account with Jappix.com, and a backup account with XMPP.jp. I use Gajim> for my client of choice on the desktop and laptop, Monal for iOS (and there is an OS X client that seems to be in beta), and recommend IM+ for Windows Phone, Xabber for Android, and Loqui for FirefoxOS. I also enjoy the Jingle extension for voice and video chat, and with WebRTC, that is even possible for web applications such as Jappix.

It is a solid standard for IM and presence, and is heavily extensible, to the point that very powerful platforms can be built on top of it. It can also be secured, with TLS-based encryption for exchanges, and client-side encryption support through PGP/GPG keys or the Off-The-Record encryption platform.

However, due to a few people I know, I have also been using Telegram, Telegram is a pseudo-"open source" IM platform, with open client applications and a proprietary server back-end, somewhat similar to what AOL Messenger, Yahoo! Messenger, ICQ, and MSN/Windows Live Messenger offered. However, Telegram's draw is its encrypted chat, which is only supported in certain desktop clients, and the official clients on iOS and Android. (I did not see the option on any Windows Phone 8.1 client, and the Firefox OS client is based on the web client, which has no encrypted chat support).

Now, I have never seen anyone really use the encrypted “Secret Chat” option myself, but from what I can tell, it works similar to typical encrypted chat clients. The two clients exchange encryption keys, and each client sends messages encrypted with the respective key. The only difference is that messages, photos, and other information can be set to “Self-destruct” after a period of time, if the sender wishes to do so. Additionally, Secret Chats are tied to the device, where as normal chats are encrypted in cloud storage and available from any client with access to the account.

So, what is the problem?

Well, Telegram requires you to use a phone number, where XMPP simply requires that you set up a username on an XMPP server, and have it accessible other clients who wish to connect with you. With XMPP, you can create as many accounts as you wish, on as many servers as you wish. If you need to suddenly remove yourself from a server, you can easily do so.

In my opinion, the most important aspect of XMPP is that you can make your own XMPP server to chat from, and other will be able to connect to you from their own. A vast majority of the servers are federated, with only a few well known servers acting as closed silos for their own users. Most notable of these closed servers are Google Talk (now Google Hangouts), LiveJournal Talk (LJTalk), and WhatsApp.

(As an aside, WhatsApp seems to be the most proprietary user of XMPP, with an iron grip on their servers that can be seen as almost a slap in the face for the open nature of the standard.)

Telegram also does something that can be considered a major security flaw. If someone has your telephone number in their phone’s Contacts book, they will be notified the moment you join, and anyone who is in your own Contacts book is automatically added if they have a Telegram account. Neither person is notified of this action at all. This can cause stalkers to find you, and while you can block them, it is still something that you cannot opt out of.

With XMPP, user “subscriptions” must be authorized, so another user must allow you to see their presence before they are added to your roster. Likewise, you must authorize someone’s request to see your own presence before they can see you. This is far more secure than automatically loading your contact list and adding everyone.

You can also set a status with XMPP, such as telling people that you are away or asleep. Most servers support these basic statuses, along with custom status messages: Available, Free to Chat, Away, Not Available/Do Not Disturb, Extended Away, and Offline. Some also support “Invisible”, allowing you to appear as offline while continuing to stay connected.

To Telegram’s slight advantage, you can add someone through either their phone number or a changeable user name, while XMPP requires a standard JID (Jabber ID) that is similar to an email (e.g. teradyne@xmpp.jp). This can be much easier for some people, though if you have an email address, a JID is not going to be much different.

Additionally, Telegram’s non-Secret chats are stored on Telegram’s servers, where as many XMPP servers do not even have “offline messaging”. Some do, but not all. Logs and past messages are not stored in the cloud unless the client does so, but Telegram does.

So, overall, what is my opinion of Telegram? Honestly, I would rather people use XMPP.

XMPP is much more trustworthy, as you can run your own server, and people cannot automatically add you to their contact roster without your permission or knowledge. You can also keep control of your own encryption keys, while Telegram’s applications are in charge of keys and key revocation. XMPP is also much more extensible, and new features are created quite often.

XMPP standards are also from trusted sources, who make their methods public: the Internet Engineering Task Force (IETF), and the XMPP Standards Foundation. With Telegram, the system is still much more closed, and I have honestly been given no reason to trust the group or their methods. They may be open source, but they are not an open standard.

They are slowly trying to become the next WhatsApp replacement, but with their methods, they are not earning any favour outside of the stray mainstream user who hears about their Secret Chat system, and never uses it. Much of their momentum is little more than hype from peers bringing in new members.

I will give them credit where it is due, though. They are making most of it open source, and they have stated that the server-side portion will eventually be open-sourced, but it is difficult to tell when that may happen. The fact that it requires a phone number is also not helping their case.

In the end, I still prefer XMPP, and I only use Telegram to keep in touch with people who refuse to use XMPP (or move away from Skype, but that is for another post).