Announcing in-band registration also StartTLS might be required (first)
-----------------------------------------------------------------------
Key: VYSPER-288
URL: https://issues.apache.org/jira/browse/VYSPER-288
Project: VYSPER
Issue Type: Bug
Reporter: Bernd Fondermann
Priority: Blocker
Right now, in-band registration is announced before a mandatory switch to TLS
has been accomplished.
I think we should not do that. However, I don't know if the feature still works
over TLS. But I'd strongly suspect so, because, hey, it's a registration.
After crossreading XEP-0077, I don't see why we should allow for doing regs
over an unencrypted wire.
WDYT?
(Marking as a blocker, because of potential security implifications. However,
in-band is not enabled by default, is it?)
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
