Is using JABBER really secured?

Xeratul · 01-09-2011, 03:16 PM

Hi,

Everyone on this board knows the technique of the man in the middle. I would like to start the discussion about jabber. http://www.jabber.org/

Is that really wise to use jabber, or psi, and so on?
http://lifehacker.com/289097/chat-wi...er-google-talk

Here find a shot of trusting, sometimes, blind'y...

kbp · 01-09-2011, 08:52 PM

Your question seems to combine the protocol (jabber) and user acceptance of certificates (pki) which are 2 completely separate things - which one are you concerned about ?

Xeratul · 01-09-2011, 09:57 PM

Quote:

Originally Posted by kbp

Your question seems to combine the protocol (jabber) and user acceptance of certificates (pki) which are 2 completely separate things - which one are you concerned about ?

You're right. thanks
- Well, actually Jabber is considered (in the title). Servers, jabbers, man in middle, and others

kbp · 01-10-2011, 07:47 PM

Jabber (XMPP) supports TLS and SASL for encryption, there are several RFC's which cover different aspects of the protocol, the primary ones being - 3920, 3921, 3922, 3923. You may be interested in reading 3920 and 3923 (End-to-end signing and object encryption). I guess you would still be vulnerable to dns poisoning attacks (think MITM) but that's not really an issue with XMPP itself.

cheers