News for hackers. Stuff that matters.

A comment on Dino: An open-source application for XMPP messaging. Parent comment

Re:Dino: An open-source application for XMPP messaging by Uehreka on Wednesday January 29, 2020 @11:34PM (#22188855)
Bear in mind that when students and employees are on their school/work network, they often have to accept the network admin's certificate authority in order to be allowed to connect to the network. So effectively, the network admin can spoof SSL certificates and MITM traffic, even if it's encrypted.
[ Parent | on HN ]
Re:Dino: An open-source application for XMPP messaging by pmontra on Thursday January 30, 2020 @02:24AM (#22189574)
If that's part of the threat model, a layer 7 protocol can encrypt and sign the payload. Then anybody terminating the connection wouldn't be able to read and modify messages.

There are also replay attacks and probably many other issues I can't think about. Maybe some IM protocol already deals with that.

[ Parent | on HN ]