Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid sending the "from" JID before starttls #211

Open
realbiz21 opened this issue May 2, 2023 · 0 comments
Open

Avoid sending the "from" JID before starttls #211

realbiz21 opened this issue May 2, 2023 · 0 comments
Labels
enhancement New feature or request

Comments

@realbiz21
Copy link

Describe your feature proposal
Hide the "from" JID when connecting to a server before TLS establishment has occurred for a starttls-required server.

Is your feature request related to a problem? Please describe.
No, but it would increase user privacy.

When establishing an initial connection to an XMPP server, the following is sent without encryption when a client executes the XmppClient.login() method:

<stream to="[server]" from="[user_jid]" ...>

The user's JID is exposed prior to the starttls proceeding and visible to a passive network observer.

Additional context
Using: Snikket version 1.2.

The issue is similar to tigase/siskin-im#217 however it appears Siskin IM uses a later version of the Martin library. Snikket iOS appears to use version 2.1.3 and the solution described in the above issue does not apply.

However, while looking at version 2.1.3, there appears(?) to be something similar via a SEE_OTHER_HOST_KEY flag, though I am unfamiliar with the Swift language:

https://github.com/tigase/Martin/blob/2.1.3/Sources/TigaseSwift/XmppSessionLogic.swift#L339

I am unaware if this is a valid solution having limited iOS experience.

@realbiz21 realbiz21 added the enhancement New feature or request label May 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant