[Operators] How-to fight with SPAM accounts

Philipp Hancke fippo at goodadvice.pages.de
Sat Nov 21 06:07:33 CST 2009


Peter Saint-Andre wrote:
> As I always say, we don't need to be perfect, just more difficult to
> attack than other networks. Part of raising the cost (mostly the cost in
> time) would involve requiring TLS with CA-issued certificates for s2s
> (perhaps we can get there eventually!). But as you say there is no magic

If getting there was possible, why is that solution not applied to SMTP?

Besides, the TLS situation on s2s is a huge mess... and will continue to
be so while you accept "bogus certificates" (as defined below) at
jabber.org.
The problem is mostly limited to what is called "starttls+dialback".
Since that had never been officially specified, it seems that developers
ignored possible interactions.

Definition of a bogus certificate:
* subject does contain the hostname (especially: CN=ejabberd)
* subject is valid but certificate is expired - even expired since
   January 2009.
* certificate is revoked (that even worked with 0178 style auth when
   I tested it)
* ...
Note that I did not include self-signed certificates or certificates 
issued by a CA which is not well-known. Those are probably better
handled in a ssh-like approach.

Just another piece of "not really relevant" criticism.

philipp


More information about the Operators mailing list