5 ms·
Will modern clients warn loudly if a server suddenly stops offering channel binding? Otherwise it is trivial to downgrade.
by xnyhps 3y ago
Will modern clients warn loudly if a server suddenly stops offering channel binding? Otherwise it is trivial to downgrade.
- wiktor-k 3y agoConversations.im shows a login failure in this case. See: https://gultsch.social/@daniel/111285494250772742 https://gultsch.social/@daniel/111285494250772742
- MattJ100 3y agoThey do, yes. It's certainly a requirement if channel binding is to work at all. Additionally there is this proposal to also detect attempted downgrade of the channel binding and SASL mechanism lists themselves: https://xmpp.org/extensions/xep-0474.html https://xmpp.org/extensions/xep-0474.html - which we're currently looking for expert eyes on, if you know any... :)