XSF Discussion - 2021-07-26

https://xmpp.org/community/security-notices/vulnerability-in-xmpp-server-dialback-implementations.html Nothing every app is %100 secure

Ge0rG: if you give me some hints I can update this section ✏

emus: I'm sorry, I'm missing context

Ge0rG: once you said you planned to update the cve section on the xsf website

emus: I'm not sure. I think I was interested in some tooling for extracting the <cve/> items from XEPs into a central place, but didn't do anything about it

So otherwise all cve are listed in the xeps?

emus: that was the idea behind my PR

Okay, but my question was actually where is this information listed right now?

emus: a start has been done with https://github.com/xsf/xeps/pull/1055

So now people need to upgrade their xeps?

Ge0rG: And still, apart from your good work - where have the CVEs been listed before, also in the xeps but without automation? ✏

emus: I think there was only one or two CVEs mentioned in XEPs before. Some are listed on the wiki, others are just tribal knowledge

emus: with the new <cve/> element, somebody could open PRs against the different XEPs that were "hit" before

Like some of the CVEs I added to https://xmpp.org/extensions/xep-0280.html#security also affect XEP-0313

I find surprising to add client related CVE into XEPs no ?

like Monal and Dino for this PR

edhelas: yes, that point was also brought up.

ok :)

edhelas: I think the fact that over a dozen clients all made the same error when implementing a XEP warrants a mention in the XEP.

yup, i'm one of the faulty dev :p

"it was just a forgotten if case"

And given that XEPs are our major publishing mechanism, I thouht it wouldn't hurt too much to have it there.

> Ge0rG escribió: > edhelas: I think the fact that over a dozen clients all made the same error when implementing a XEP warrants a mention in the XEP. I would agree with this. I think its okay to make clear that it happened in a particular implementation where other can learn from and I think this is valuable already

BTW does OMEMO "just" do double-ratchet encryption or does it do the "Signal Protocol" (fair warning: I'm not entirely sure what the difference is)

it is an adaptation of the signal protocol, besides the double ratchet you also have the x3dh key protocol and also the xeddsa/vxeddsa signature schemes. alle three mentioned in the XEP

you may also find the audit insightful/informative https://conversations.im/omemo/audit.pdf

https://xmpp.org/extensions/attic/xep-0384-0.3.0.html (the version in use) talks about SignalProtocol a bunch.

Thanks. :)

phryk: Hello!

Ellenor Malik, Hello indeed. Do we already know each other? :)

No. I'd like to dm you however

Sure, go ahead. But if you have XMPP-specific questions you'll probably get more useful answers if you post in here. :)

https://upload.jabberfr.org/TLC9JXTlV_RaRgB5/Screenshot_20210726-202758.jpg

Do I need to enter my account password?

wuuko: why ask here?

Looks like they have a captcha you need to solve to proceed.

> Zash wrote: > Looks like they have a captcha you need to solve to proceed. İt says "Enter password"

> wgreenhouse wrote: > wuuko: why ask here? Where do I have to ask?

People from jabber.ru. but its not the job of the people here to find it out where that may be.

Do you understand "to unblock (the messages) visit <link>" ?

> İt says "Enter password" where it says "Enter password"?

The gray bar at the bottom

> Zash wrote: > The gray bar at the bottom Yes

so, why are you asking here?

Ok.

chronosx88, while I agree it's not the optimal place for user support like this, where else?

Hrm. When I try this with Conversations, I don't even see that captcha message.

> chronosx88, while I agree it's not the optimal place for user support like this, where else? I think community room on jabber.ru

That also seems to have a captcha

> chronosx88 wrote: > I think community room on jabber.ru jr

Yes yes ru

I switched new account

> Old messages disappear when you change passwords

Yes, this is true. I think bad.

"unauthorized"

Didn't you see all the people telling you not to ask here already? Find another chat. Like on https://search.jabber.network ✏

ISTR someone on the Board saying it's okay to ask XMPP-related questions here.

All that seems to be misunderstandings about the captcha used. Switching account will not help with that.

> Zash wrote: > All that seems to be misunderstandings about the captcha used. Switching account will not help with that. No, I couldn't log in to the account when I changed the password. I am %100 sure password is true

Try it if you want, it'll be like I said

Changed the password where?

> Zash wrote: > ISTR someone on the Board saying it's okay to ask XMPP-related questions here. Ok then.

https://upload.jabberfr.org/lotbVJP-uNUKmQCN/Screenshot_20210727-003535.jpg

Parola= password

The thing earlier did not want you to enter a password, that seems to be some bug or mistake. You needed to click the link and fill in the captha to proceed.

I tried it before. The password part will show up after a while if one clicks the link and goes back to the conversation app.

> Menel wrote: > I tried it before. The password part will show up after a while if one clicks the link and goes back to the conversation app. Which link?

I've tried twice, I can't get into the account

bung9: Does the old password work?

> me9 wrote: > bung9: Does the old password work? No

The captcha

He says it's unauthorized.

Then the password has to be wrong.

https://upload.jabberfr.org/lQyWOK6qmrGgQ0j0/Screenshot_20210727-004038.jpg

Here

Again: first leave the channel! Then: 1. Joint that channel again 2. Click the link 3. Fill the correct capcha 4 go back and you are in

I tried 30 seconds ago.

If you don't fill it correct it will have this "password" and you can't join

> I wrote: > I tried 30 seconds ago. Yetkisiz

Ok so thats a different topic. You can not join your own server anymore. You need to contact your server admin. We don't know your password ✏

Is it the same with everyone I meet?

I don't understand

Right now, I'm logged in with the old password. Not entered with new password

İf I change password, "yetkisiz" unauthorized

Then don't change?

Didn't you just say the old password didn't work?

Not good if we have to change it

If you post your password in public you definitively should change it.

> me9 wrote: > Didn't you just say the old password didn't work? I don't get it eitherI don't get it either.

> Zash wrote: > If you post your password in public you definitively should change it. yes

> Zash wrote: > If you post your password in public you definitively should change it. Yes

> Zash wrote: > If you post your password in public you definitively should change it. It broke down while changing

Try again via the "change password" button.

Note that changing the password in the app might not change it in the account.

> Zash wrote: > Note that changing the password in the app might not change it in the account. Opening a new account seems to make sense.

Is what I'm going through normal?

Nope.

But in the case of something crashing during password change, errors are to be expected.

It's not a big deal. I can switch to a new account.

OMEMO is the only XMPP E2EE solution that works for file transfers, MUCs and A/V chat, right?

> I wrote: > It's not a big deal. I can switch to a new account. I don't think there's any other way.

phryk: "omemo file transfer" is a hack that has nothing to do with omemo, OX should work in MUCs, and I don't know if there are efforts to replicate the omemo call signing, but the calls are otherwise E2EE anyway, you just lack the trust part

mathieui, nothing to do with omemo? it's not using the same cryptographic protocol?

and by calls being E2EE anyways, I assume you mean there's and end-to-end TLS session?

SRTP or ZRTP or whatsitcalled

Sounds like TLS to me. :)

Also, what's OX? never heard of it before this.

phryk: its pgp in the core.

Menel, got any source? can find nothing mentioning OX or PGP in the RFCs mentioned on xmpp.org…

OX is an XEP, not an RFC.

Its the new pgp. An older legacy one exists too. https://xmpp.org/extensions/xep-0373.html

And 374

Ooooh OX = Openpgp for Xmpp m)

phryk: "omemo file transfer" is really "aes-encrypted http upload files with custom aesgcm:// links and the key as part of the URL, with that link sent inside an omemo session"

The old one still in use: https://xmpp.org/extensions/xep-0027.html

Nothing omemo specific there

Huh, and was there never an XEP for adding OTR support to clients to begin with or was it just removed?

The only omemo part is the key sharing in the message.

That one? https://xmpp.org/extensions/xep-0364.html#intro > Huh, and was there never an XEP for adding OTR support to clients to begin with or was it just removed?

Yeah, but that's the only way to handle multi-device recipients without uploading once for every receiving key…

Menel, OTR is something you just do over whatever transport. There never was any negotiation for it other than OTR itself.

I see. Thats why I didn't find the historical xep

This has its pros and cons. It doesn't fit into XMPP very well, but it also works trough arbitrarily chained gateways, transports and bridges.

Yes, that one. just wasn't shown by default and I thought "deferred" was in the default selection^^

https://paste.xinu.at/ZqX54A/rmd I'm currently writing a text about XMPP – this is part of it dealing with E2EE – please tell me if anything is heinously wrong with it. ^^;

context: it's supposed to become a somewhat detailed explanation of some key features of XMPP and its ecosystem for non-techie lefties

Seems fine, and applicable to right handed people too?

Thanks, also you're the second person making that joke today. :P

also also, don't i know you from fedi?

You may want to explain what you mean by "plausible deniability".

good point. :)