undefined | Better HN

0 pointsupofadown9y ago0 comments

In practice you always get TLS. That's really all you need if you trust the server.

Something fairly significant has happened in the world of XMPP recently. You can get real certificates for XMPP servers under your control from letsencrypt. That means that things now work transparently between clients and servers and between servers. As a result, organizations that do things that some governments might not approve of can do transparent encryption simply by setting up a server or servers in places that such governments can not physically get at.

0 comments

hannob9y ago

TLS on the s2s side is unauthenticated. Therefore TLS only protects you in a situation where both users are on the same server and trust it.

Getting a real cert for s2s doesn't really help as long as you have no agreed upon mechanism how they can enforce validation of those certs.

upofadownOP9y ago

You need to trust both servers when doing s2s anyway. So you can just turn on certificate validation when depending on just TLS for your security. For Prosody that would be "s2s_secure_auth = true".

Of course an organization using TLS as their only security for XMPP would almost for sure just use one secure server, so I might be being a bit fanciful here. My ultimate point is that because of the way XMPP works, it is possible to make the normal default clients work securely in practice by doing the correct things at the server level.

j / k navigate · click thread line to collapse