@rune @sir As I already said, any not federative (to be honest, not f2f system) can not guarantee that it will not collect you metadata. Sad but true. Phone number reveal is not a big deal in that circumstances, as you still leave other fingerprints. You can reduce them, but not completely.

More over, in countries outside the NATO or do-not-remember-how-much-eyes, the threat of metadata leaks drops significantly, as it will be not easy to get to this data.

@peexea as soon as you have to argue with "only these few can get your metadata" it's over though. rubberhose some admin
at openwhisper (or his children). even the mob can do that. with how insecure the phone networks are, having the number is a pretty big deal.

anonymity and privacy aren't easy problems to solve, if they can be solved at all. telling people otherwise is dangerous and requiring their phone number for "convenience" borders on evil.

@bonifartius Again, it is a question of a threat model. Your scenario works for:
1) government agencies
2) gangs
who want to extract *your and just your* information (you are the main target of attack) *and* want it so much, that are willing to pay time and resources for such attack.

Sorry, but so far this scenario is outside my threat model.

@bonifartius
And, you know, such powerful threats are capable of extracting information from your ISP including active DPI in the whole net. p2p networks will be traced in such circumstances. With friend2friend it will be harder, but it is quite unpopular technology, so you will be the only one, who use it => side channel metadata leack. To prevent it, you need *perfect* traffic obfuscation and mimic to https sessions. AFAIK, there are no friend2friend IM with traffic obfuscation.

@peexea .. but signal is explicitly advertised for such threads, isn't it? _my_ opinion is that federalized protocols are better in this regard and that moxie spreads FUD regarding them.

@bonifartius to be honest, I haven't read their ads, I was only interested in the protocol itself. I have no idea, why Moxie does what he does.
Ofk, federated is always* better in this scenario.
*provided, that your trusted server have all security precations, as self-hosted solutions can, in general, be more vunerable to targeted attacks, because they can be runned not by professionals and not on enough secure systems.
So, security of your metadata will depend on your admin skills.

@bonifartius Looks like, that OMEMO is quite close to "federated signal", but I haven't read theirs papers yet.

I hope, that one day we will have a widely accepted federated protocol for IM. The need to have several accounts on different services to connect different people sucks.

@peexea i have previously used xmpp, but at that time it was suffering heavily from a lack of mobile apps _and_ a fractured ecosystem regarding XEPs, so i've kind-of given up on it. while i don't think that #matrix is perfect, they do many things right and have a modern feel, and are federated and e2e encrypted (seems to be the default now for new rooms).