XMPP Service Operators - 2026-01-11

  1. erebion

    > erebion: here's some other things to think about https://github.com/divestedcg/safeguarding-xmpp-2025 Some good points, thanks ↺

  2. erebion

    As those are so many things, I wish each point would link to examples on how to configure them.

  3. erebion

    For example: "Channel binding" must be enabled, but what is that even? In what context? Where can I find further info? What do I need to do?

  4. moparisthebest

    On modern servers channel binding is automatically enabled, nothing to do there. It can help prevent a specific MITM attack like https://snikket.org/blog/on-the-jabber-ru-mitm/ where the attacker can get a valid cert but not your disk except it doesn't actually protect against MITM with TLS 1.2 because of https://web.archive.org/web/20250329015540/https://www.mitls.org/pages/attacks/3SHAKE

  5. icebound.dev

    moparisthebest, it requires client support, which iirc, many clients still do not support.

  6. icebound.dev

    however I haven't looked into it since the jabber.ru mitm

  7. erebion

    Could anyone please help me out and tell me whether DANE on erebion.eu looks correct?

  8. erebion

    I haven't found any way of verifying I'm doing it right...

  9. erebion

    I have records for 5223 and 5270, but no idea how to make sure those are right

  10. MattJ

    erebion: https://certwatch.xmpp.net

  11. agh

    erebion: https://dnsviz.net/d/erebion.eu/dnssec/

  12. erebion

    Both do not seem to help me answer the question "Is DANE set up correctly?". The first one just shows the hash of my TLS public key, which is not of interest. The second one just shows general DNSSEC info.

  13. erebion

    monocles says "DANE failed", but for what reason? What is the issue?