Avoid sending the "from" JID before starttls
realbiz21 opened this issue · 0 comments
realbiz21 commented
Is your feature request related to a problem? Please describe.
No, but it would increase user privacy.
When establishing an initial connection to an XMPP server, the following is sent without encryption when a client executes the XmppClient.login() method:
<stream to="[server]" from="[user_jid]" ...>
The user's JID is exposed prior to the starttls proceeding and visible to a passive network observer.
Describe the solution you'd like
Restrict sending of from="[user_jid]"
before starttls has occurred. This issue was originally raised at tigase/Martin#22 and a potential solution is already known:
let client: XMPPClient;
client.connectionConfiguration.useSeeOtherHost = false
Describe alternatives you've considered
N/A
Additional context
Using: Siskin IM 7.3.3