Subject: Re: [xmpp] Roster Protection on Server?

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 31 Jul 2009 15:04:11 +0200

On 6/22/09 10:12 AM, Dave Cridland wrote:
> On Sun Jun 21 21:43:26 2009, Sean Turner wrote:
>> In reading draft-ietf-xmpp-3921bis-00.txt, I'm curious why there are
>> no requirements to protect the roster that's stored on the server. 
>> Was this discussed previously and determined to be out of scope?
> 
> I'm with Jack on this one. I think at best it's worth addressing in the
> Security Considerations; viz. "The user's roster can contain
> confidential data, and access to this data must be suitably restricted
> to the user, and, potentially, authorized third parties."

Done, with editorial wordsmithing.

> Might be worthwhile adding a pointer there to XMPP-CORE section 15.11,

I don't particularly see the need for that pointer. Authorization would
be based on JIDs, where comparison follows the rules defined in 3920bis
(not on how JIDs appear to the eye).

> but that in itself needs additional text to note that from the
> perspective of example.net, there's no method for distinguishing between
> [email-masked] and [email-masked]. (ie, with foreign domains,
> only the domain can be authorized with assurance).

I have added the following note to Section 15.11 of 3920bis:

   Note: An entity outside the security perimeter of a particular
   server cannot reliably distinguish between bare JIDs of the form
   <localpart@domain> at that server, since the server could forge any
   such JID; therefore only the domain identifier can be authenticated
   or authorized with any level of assurance.

> While I'm here, as it were, the fourth bullet in XMPP-IM's Section 11 is
> largely the same thing as XMPP-CORE's 15.15 - I think some
> consolidation, and possibly cross-referencing, is in order.

I have moved that bullet-point from Section 11 of 3921bis to Section
15.5 of 3920bis.

Thanks!

Peter

- --
Peter Saint-Andre
https://stpeter.im/