Hi all,
[un]fortunately our server is supporting 'unprotected' IBR and we are
not going to disable/'protect' it during next few months/years. For sure
there are also accounts used during attacks registered on our server,
but I think this is the same on all XMPP servers with any open
registration and administrators have to just take care of them (somehow).
@Peter - I find it very useful and simple way to register and do not
want to complicate lives of our potential users. Therefore we are not
running captcha (as 'security' module) for IBR - from my (and our
server's) present point of view it's meaningless and today's attackers
can breach it easy.
@Kevin - that your comparison is not completely right. I do not think
that we need to move away from IBR. I like that approach for
registration and it make sense to install XMPP client and register on
any XMPP server trough using just that one application.
The only we need is to find the way how to protect our servers from the
attacks in the efficient and effective way. (there is nothing efficient
and effective known at this time) The response to this could be
"xep-0268" - already proposed by Peter Saint-Andre on February this year
- and I hope that all of us will push on developers of our XMPP servers
to implement it once it will be available.
This is a question of making XMPP mature and I do not think there is
need to 'move away from IBR' or 'block all XMPP servers with unprotected
IBR from federation'.
IBR is a (nicest?) feature of XMPP and cannot be punished for
'not-the-best' security implementation of XMPP. :-)
--
Peter Viskup
On 04/10/2012 11:22 PM, Kevin Smith wrote:
On Tue, Apr 10, 2012 at 10:13 PM, Peter Saint-Andre<[email protected]> wrote:
Has in-band registration outlived its usefulness? It was originally
designed as a user-friendly way to jumpstart use of Jabber
technologies back in 1999. Perhaps it's not so appropriate today?
FWIW, my view is that servers with unprotected IBR are conceptually
very similar to open proxies and we need to move away from it.
/K
