XSF Discussion - 2018-11-05

lskdjf has joined 00:04:01
dedekin has left 00:06:10
Guus has left 00:08:23
Guus has joined 00:08:23
Guus has left 00:08:26
alexis has left 00:18:24
alexis has joined 00:25:59
js has joined 00:28:25
Zash has left 00:28:55
js has left 00:30:12
UsL has left 00:30:25
UsL has joined 00:30:25
j.r has joined 00:34:42
l has left 00:34:42
j.r has joined 00:35:28
thorsten has left 00:41:21
thorsten has joined 00:41:42
Zash has left 00:45:41
Lance has joined 00:48:39
vaulor has joined 00:50:06
Kev has left 00:51:08
l has joined 00:57:15
alexis has left 00:57:34
alexis has joined 00:58:28
alexis has left 01:00:21
alexis has joined 01:01:00
j.r has joined 01:03:18
j.r has joined 01:05:04
Lance has left 01:08:05
Guus has joined 01:10:40
waqas has left 01:10:47
Syndace has left 01:18:24
Syndace has joined 01:18:28
Guus has left 01:22:35
Guus has joined 01:22:35
Guus has left 01:23:26
alexis has left 01:42:32
lorddavidiii has left 01:46:49
alacer has joined 01:49:02
alacer has left 02:13:42
alacer has joined 02:16:14
alacer has left 02:28:21
alacer has joined 02:28:28
alacer has left 02:36:54
alacer has joined 02:36:59
mrdoctorwho has left 02:54:25
mrdoctorwho has joined 02:54:31
krauq has left 03:04:33
krauq has joined 03:04:36
SamWhited has left 03:05:42
sonny has joined 03:20:55
Guus has joined 03:40:37
lorddavidiii has joined 04:01:15
j.r has left 04:04:38
j.r has joined 04:04:57
blabla has joined 04:08:37
Guus has left 04:11:50
Guus has joined 04:11:50
Guus has left 04:14:26
Guus has joined 04:18:56
j.r has joined 04:19:08
j.r has joined 04:19:57
Guus has left 04:32:17
Guus has joined 04:32:17
j.r has left 04:33:48
j.r has joined 04:34:56
Guus has left 04:38:26
waqas has joined 04:39:32
Guus has joined 04:44:34
Yagiza has joined 04:50:04
ta has joined 04:50:19
lorddavidiii has left 04:55:59
Guus has left 04:56:32
Guus has joined 04:56:32
ta has left 05:00:30
sonny has joined 05:00:57
Guus has left 05:02:26
ta has left 05:05:23
ta has joined 05:05:26
ta has left 05:11:17
ta has joined 05:11:18
Nekit has joined 05:14:08
j.r has joined 05:14:35
j.r has joined 05:15:37
blabla has left 05:27:57
blabla has left 05:30:24
alacer has left 05:42:52
alacer has joined 05:44:18
moparisthebest has joined 05:50:07
Yagiza has left 05:51:34
lorddavidiii has joined 05:52:29
alacer has left 05:58:11
waqas has left 06:00:29
alacer has joined 06:04:13
j.r has joined 06:08:42
j.r has joined 06:08:55
moparisthebest has joined 06:13:43
moparisthebest has joined 06:14:17
blabla has left 06:15:35
goffi has joined 06:22:07
alacer has left 06:22:39
Nekit has left 06:23:54
Nekit has joined 06:23:54
alacer has joined 06:25:14
j.r has left 06:31:06
j.r has joined 06:31:31
lnj has joined 06:42:18
blabla has joined 06:43:30
labdsf has left 06:48:18
Guus has joined 06:50:22
ralphm has left 07:06:03
labdsf has joined 07:11:05
mimi89999 has joined 07:14:54
Zash has left 07:28:01
goffi has left 07:28:29
goffi has joined 07:31:29
blabla has joined 07:34:21
l has joined 07:38:27
andy has joined 07:40:15
lnj has left 07:47:27
Zash has left 07:47:30
Zash has left 07:47:45
Zash has left 07:51:22
alacer has left 07:54:17
alacer has joined 07:55:12
Zash has joined 07:55:16
Kev has left 07:57:17
UsL has joined 07:57:36
UsL has joined 07:58:34
lorddavidiii has left 07:59:39
lorddavidiii has joined 08:02:39
labdsf has left 08:07:27
labdsf has joined 08:07:28
labdsf has left 08:08:26
labdsf has joined 08:08:28
lskdjf has joined 08:10:30
blabla has left 08:13:54
Nekit has left 08:15:16
Nekit has joined 08:15:18
genofire has left 08:15:26
l has left 08:19:57
l has joined 08:20:00
lskdjf has joined 08:21:00
krauq has joined 08:21:08
krauq has joined 08:22:20
Alex has joined 08:22:36
lskdjf has joined 08:30:45
lorddavidiii has left 08:37:54
Steve Kille has left 08:39:55
Steve Kille has joined 08:43:47
goffi has left 08:55:49
vanitasvitae has left 08:56:21
Nekit has left 08:58:44
Nekit has joined 08:58:45
Steve Kille has left 08:59:45
Guus has left 09:05:22
Guus has joined 09:05:23
ralphm has joined 09:05:25
Guus has left 09:05:26
Tobias has left 09:09:35
Tobias has joined 09:09:36
dwd has joined 09:11:16
rion has left 09:11:46
alacer has left 09:17:55
alacer has joined 09:19:11
rion has left 09:19:52
matlag has left 09:34:52
labdsf has left 09:47:22
l has joined 09:52:56
krauq has left 09:56:28
krauq has joined 09:56:31
alacer has left 09:57:12
blabla has joined 10:00:56
alacer has joined 10:02:10
blabla has joined 10:03:53
ta has left 10:07:12
ThibG has joined 10:07:50
alacer has left 10:10:53
alacer has joined 10:14:12
Valerian has joined 10:17:50
krauq has joined 10:19:16
Valerian has left 10:20:22
Valerian has joined 10:20:22
alacer has left 10:22:28
Seve has left 10:22:37
lskdjf has joined 10:24:26
lskdjf has joined 10:24:32
alacer has joined 10:25:12
rago has joined 10:26:15
lnj has joined 10:27:13
dedekin has joined 10:36:47
daniel has left 10:38:15
daniel has joined 10:38:20
alacer has left 10:39:37
labdsf has joined 10:40:39
alacer has joined 10:40:51
Alex has left 10:46:45
dedekin has left 10:50:48
Valerian has left 10:52:45
Guus has joined 10:53:06
Valerian has joined 10:57:17
Valerian has left 11:00:10
l has left 11:01:12
lskdjf has joined 11:02:10
Yagiza has joined 11:03:43
alacer has left 11:04:13
alacer has joined 11:06:24
ThibG has left 11:09:14
ThibG has joined 11:09:21
alacer has left 11:12:29
alacer has joined 11:15:22
rago has left 11:16:48
Kev has left 11:17:42
rago has joined 11:21:16
mightyBroccoli has left 11:22:40
mightyBroccoli has joined 11:22:41
rion has left 11:29:47
Valerian has joined 11:32:59
Alex has left 11:36:15
dedekin has joined 11:36:27
Zash has left 11:37:21
Nekit has left 11:42:26
Nekit has joined 11:42:26
dwd has left 11:46:48
dwd has joined 11:55:53
Seve has left 11:56:17
ThibG has left 11:56:52
dwd has left 11:56:53
ThibG has joined 11:56:59
dwd has joined 11:58:51
alacer has left 12:03:35
blabla has joined 12:06:56
Syndace has joined 12:11:39
Syndace has joined 12:11:42
l has joined 12:15:03
l has left 12:15:08
alacer has joined 12:15:47
alacer has left 12:25:17
alacer has joined 12:27:22
matlag has left 12:31:19
Guus has left 12:34:04
Guus has joined 12:34:16
Seve has joined 12:39:28
alacer has left 12:40:07
alacer has joined 12:41:49
alacer has left 12:49:15
alacer has joined 12:52:11
j.r has joined 12:53:08
alacer has left 12:59:29
ta has joined 13:00:02
alacer has joined 13:00:06
Valerian has left 13:03:51
Valerian has joined 13:04:29
alacer has left 13:09:21
alacer has joined 13:09:23
Zash has left 13:10:44
rago has left 13:13:24
Zash has left 13:17:54
matlag has left 13:25:19
Valerian has left 13:25:54
Valerian has joined 13:26:27
Valerian has left 13:26:47
Valerian has joined 13:27:11
daniel has left 13:28:14
alacer has left 13:29:56
alacer has joined 13:30:04
alacer has left 13:30:16
alacer has joined 13:30:18
alacer has left 13:34:33
alacer has joined 13:34:35
alacer has left 13:37:44
alacer has joined 13:37:46
ta has left 13:45:10
ta has joined 13:45:13
Valerian has left 13:51:25
Zash has left 13:51:27
MattJ has left 13:57:59
ta has left 13:59:56
ta has joined 13:59:59
lorddavidiii has joined 14:00:40
alacer has left 14:02:12
lskdjf has joined 14:02:18
MattJ has joined 14:06:30
waqas has joined 14:08:44
alacer has joined 14:13:10
dwd has left 14:18:28
alacer has left 14:21:32
andy has left 14:22:21
andy has joined 14:22:22
Alex has left 14:25:02
Yagiza has left 14:26:39
j.r has joined 14:27:14
!xsf_martin has joined 14:27:21
Yagiza has joined 14:30:11
marc has joined 14:41:29
Alex has joined 14:42:43
Alex has left 14:52:46
Alex has joined 14:52:50
rago has left 14:53:06
andy has left 14:53:50
UsL has joined 15:01:26
efrit has joined 15:10:20
jjrh has left 15:18:50
jjrh has joined 15:18:51
lorddavidiii has left 15:18:58
jjrh has left 15:19:12
jjrh has joined 15:19:14
moparisthebest has left 15:21:35
jjrh has left 15:25:46
jjrh has joined 15:26:21
mrdoctorwho has left 15:27:16
mrdoctorwho has joined 15:27:38
ralphm 15:29:47
vanitasvitae: done, should be crawled somewhere in the next 30min
jjrh has left 15:34:01
jjrh has joined 15:34:01
moparisthebest has left 15:35:18
blabla has left 15:40:58
jjrh has left 15:44:21
matlag has left 15:49:26
lumi has joined 15:49:40
marc has left 15:50:56
marc has joined 15:51:06
UsL has joined 15:51:13
vanitasvitae 15:55:17
ralphm: nice. Thank you very much :)
Alex has left 15:58:16
alacer has joined 16:03:14
jonas’ 16:04:55
is there any reason to use a CSPRNG for stanza @id values?
jonas’ 16:05:38
(if one checks both @from and @id when associating replies)
SamWhited has left 16:07:49
j.r has left 16:07:56
j.r has joined 16:08:16
Neustradamus has joined 16:10:22
Zash 16:11:28
jonas’: Probably overkill, but why not?
jonas’ 16:11:43
Zash, takes double the time
jonas’ 16:11:53
(when sourced from getrandom())
Zash 16:13:40
because syscall?
jonas’ 16:13:49
yeah
jonas’ 16:13:54
(probably)
Zash 16:18:46
jonas’: compared to what? and is it a problem?
efrit has left 16:19:40
Yagiza has left 16:19:44
jonas’ 16:20:06
Zash, compared to the mersenne twister
jonas’ 16:20:15
we’re revisiting how aioxmpp generates stanza IDs
vanitasvitae has left 16:23:07
dedekin has left 16:27:52
Seve has joined 16:40:35
Ge0rG 16:45:22
I wonder what the possible attack vector is. Injecting IQ responses ahead of the actual response? By whom?
Ge0rG 16:45:52
Unless you have a smack3 level of stanza correlation, where you just run a packet listener based on the packet ID, ignoring the @from
jonas’ 16:47:41
that was my train of thought, too
jonas’ 16:47:54
anyone who would be able to inject a reply is on the path anyways and can observe the @from and the @id
jonas’ 16:48:03
assuming that s2s authentication and routing in servers works as intended
Ge0rG 16:48:17
a bold assumption.
jonas’ 16:48:59
so if you can off-path inject stanzas due to broken s2s authentication (but you cannot intercept them entirely), being able to predict stanza IDs would be useful
jonas’ 16:49:28
this could work with broken one-way s2s auth, some dialback stuff for example
Ge0rG 16:49:55
reminds me of the `Received[s2sout]` debug logs I saw today from my prosody.
jonas’ 16:49:57
but uh
Ge0rG 16:50:04
s2s directions make me dizzy.
Zash 16:50:26
don't look at dialback
lovetox has joined 16:50:30
Ge0rG 16:50:49
I won't. Dialback, PubSub and MIX are danger zones I avoid at all costs.
jonas’ 16:51:02
so, the attack is rather hard and unlikely (it is more likely that you’ll be able to intercept the sent stanza and send a reply without having to guess the @id) and requires fault in another component
jonas’ 16:51:16
huh, putting dialback into the same bucket as pubsub and mix is ... interesting
dedekin has joined 16:52:15
Zash 16:52:23
jonas’: having multiple PRNGs available might lead to accidentally using a weak one for something sensitive, and if it's something that can slowly leak state that might be bad
sonny has joined 16:52:38
jonas’ 16:52:59
Zash, that’s what sebi is saying
alexde has joined 16:56:12
dedekin has left 16:57:49
Lance has joined 17:00:47
dedekin has joined 17:01:34
matlag has left 17:01:44
sonny has joined 17:02:59
Neustradamus has left 17:05:46
Kev 17:09:15
Not reading everything, but predictable IDs are a privacy leak rather than a practical attack, for the most part.
jonas’ 17:09:43
how are they a privacy leak?
Kev 17:10:04
<message id='sessionstanza4234230498723408974'><body>Sorry, I've only just come online, I've not been ignoring you</...
jonas’ 17:10:18
right
jonas’ 17:10:25
that’s something different than just predictability though
jonas’ 17:10:29
that’s sequential
Kev 17:10:54
It's somewhere in between, I think.
jonas’ 17:10:58
a mersenne twister is predictable (with enough computing and enough samples), but by seeing a value, you don’t know whether that’s the first, tenth, or 1000th value
Kev 17:11:04
It doesn't have to be strictly sequential to have this property.
jonas’ 17:11:11
mmm
jonas’ 17:11:21
I see your point though
Kev 17:12:15
This was mostly a problem for two reasons: 1) People were using 1,2,3... 2) Some libraries are (were?) completely broken and ignored the sender of a stanza as long as the id was expected, so you could inject weird iq responses and they'd trust them.
Kev 17:12:21
(2) Is just brokenness
Kev 17:12:35
(1) has the unexpected privacy implications.
Ge0rG 17:12:45
yaxim is full of (2).
Kev 17:12:46
I don't think we need crypto-secure IDs.
Ge0rG 17:12:56
Now give me a CVE!
Zash 17:13:18
Ge0rG: Weren't there one or more for that already?
Ge0rG 17:13:43
Zash: not for that, no
Ge0rG 17:13:59
yaxim's got two CVEs so far IIRC.
Zash 17:14:33
Ge0rG: I distinctly remember CVE(s) for not checking 'from' on eg roster pushes that affected a *ton* of clients.
Ge0rG 17:16:54
Zash: yeah, I think smack wasn't affected or somesuch
Maranda has joined 17:19:44
APach has left 17:26:29
Guus has left 17:28:02
Guus has joined 17:28:05
j.r has left 17:29:48
APach has joined 17:35:08
j.r has joined 17:36:21
!xsf_martin has joined 17:37:48
Yagiza has joined 17:40:10
ralphm has left 17:40:36
valo has joined 17:45:44
guusdk has left 17:47:46
guusdk has joined 17:47:53
Kev has left 17:50:17
guusdk has left 17:52:16
guusdk has joined 17:52:36
dwd has left 18:03:43
Steve Kille has left 18:04:45
Steve Kille has left 18:04:45
lskdjf has joined 18:08:41
l has joined 18:09:04
genofire has joined 18:17:06
lorddavidiii has joined 18:18:38
lorddavidiii has left 18:20:42
ralphm has left 18:21:18
matlag has left 18:21:42
lorddavidiii has joined 18:22:53
!xsf_martin has joined 18:27:11
valo has joined 18:28:58
matlag has left 18:29:20
Alex has joined 18:35:25
Yagiza has left 18:36:18
Alex 18:39:44
memberbot is online for accepting your votes on the board & council election
Yagiza has joined 18:43:17
Seve 18:43:31
Great! Thank you Alex
Seve 18:43:36
And good luck everyone!
Yagiza has left 18:44:48
marc has left 18:46:02
lorddavidiii has left 18:48:16
jonas’ 18:52:09
thanks, Alex
lorddavidiii has joined 18:52:44
l has joined 18:59:13
peter has joined 18:59:17
matlag has left 19:02:10
peter has left 19:07:47
SamWhited has left 19:09:18
ralphm has left 19:12:02
404.city has joined 19:12:22
404.city has left 19:12:46
peter has joined 19:15:56
404.city has joined 19:19:00
404.city has left 19:23:08
sonny has left 19:24:20
Ge0rG 19:32:38
Last time I checked, one of the applications was still empty...
sonny has left 19:34:14
jonas’ 19:39:14
they’re all non-empty :)
Zash has left 19:48:54
rion has left 20:03:16
UsL has left 20:04:38
UsL has joined 20:04:57
Lance has left 20:08:37
mimi89999 has left 20:15:17
dwd has joined 20:23:08
blabla has joined 20:27:41
dwd has left 20:29:19
Alex 20:34:30
there was some hard last minute work happening ;-)
jonas’ 20:34:49
as usual..
goffi has left 20:36:34
rion has left 20:38:29
Neustradamus has joined 20:45:26
Valerian has joined 20:46:33
SamWhited has left 20:46:50
jjrh has left 20:47:51
blabla has joined 20:48:59
alexde has left 20:54:06
moparisthebest has joined 20:56:26
alacer has left 20:59:05
ThibG has left 21:01:18
ThibG has joined 21:01:25
Ge0rG has left 21:01:27
Alex has left 21:13:17
Valerian has left 21:13:25
Tobias has left 21:14:48
Tobias has joined 21:14:49
blabla has joined 21:24:17
Lance has joined 21:27:34
blabla has joined 21:31:00
lnj has left 21:31:45
efrit has joined 21:37:07
Steve Kille has joined 21:44:14
marc has joined 21:50:19
Valerian has joined 21:50:34
Alex has joined 21:51:26
tux has left 21:51:31
lumi has left 21:52:52
Alex has left 21:53:17
Alex has joined 21:53:18
Steve Kille has left 22:02:40
blabla has joined 22:04:19
matlag has left 22:08:30
Steve Kille has left 22:09:37
marc has left 22:13:13
Maranda has left 22:13:57
Valerian has left 22:20:53
Valerian has joined 22:23:16
moparisthebest has joined 22:26:37
Zash has left 22:27:08
ThibG has left 22:28:52
ThibG has joined 22:29:01
thorsten has left 22:30:49
thorsten has joined 22:31:07
marc has joined 22:36:18
Zash has left 22:39:35
Kev has left 22:41:47
Nekit has joined 22:42:07
Valerian has left 22:42:08
mightyBroccoli has left 22:42:42
mightyBroccoli has joined 22:42:44
j.r has joined 22:46:47
Kev has left 22:46:54
vanitasvitae has left 22:49:22
j.r has joined 22:49:34
efrit has left 22:53:57
dwd has joined 22:58:48
genofire has left 22:59:34
j.r has joined 22:59:55
thorsten has left 23:02:10
thorsten has joined 23:02:43
j.r has joined 23:04:25
dwd has left 23:04:59
matlag has left 23:05:19
lovetox 23:13:37
Gajim uses uuid as id, but i just checked and indeed it does not check the answer adress
lovetox 23:13:39
just the id
lovetox 23:13:46
how bad is this?
lovetox 23:15:28
i guess if someone is in the position to utilize that, then the id doesnt matter anyway because he is a man in the middle?
lovetox 23:16:28
hm yeah the chance that another contact guesses the uuid at the exact right time is impossible
j.r has joined 23:19:27
SamWhited has left 23:23:49
efrit has joined 23:25:16
thorsten has left 23:27:47
thorsten has joined 23:28:07
j.r has joined 23:29:59
dedekin has left 23:32:48
dedekin has joined 23:34:24
j.r has joined 23:34:31
dedekin has left 23:35:27
andrey.g has left 23:35:31
Lance has left 23:37:32
andrey.g has joined 23:39:19
Lance has joined 23:41:24
marc has left 23:42:12
lovetox has left 23:42:51
Alex has left 23:43:01
Lance has left 23:45:16
blabla has left 23:45:55
Zash has left 23:49:01
j.r has joined 23:49:12
j.r has joined 23:49:33
thorsten has left 23:56:59
thorsten has joined 23:57:13
Zash has left 23:57:34