Subject: [xmpp] 3921bis 3.1.3 directory harvesting attack (yet another one)

From: Philipp Hancke <[email-masked]>
Date: Wed, 21 Jul 2010 21:28:32 +0200

3.1.3 #2
 > # If the contact does not exist, then the contact's server MUST
 > automatically return a presence stanza of type "unsubscribed" to the 
 > user.

An attacker that sends a subscribe to each user on a server can 
enumerate existing accounts since those will not reply immediately.

At least detecting that attack is easy :-/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 28 Jul 2010 09:45:35 +0200

On 7/21/10 9:28 PM, Philipp Hancke wrote:
>> automatically return a presence stanza of type "unsubscribed" to the >
> user.
> 

Good catch. IMHO we need to remove that text.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/