Work fork of an Android Jabber client for bridge users git.sr.ht/~singpolyma/cheogram-android
sopranica sgx xmpp jabber

Always indicate support for channel binding in SASL header

This commit breaks logging in on servers that announce a -PLUS variant for SCRAM but do not support XEP-0440. On servers that do not support XEP-0440, we previously decided to use no channel binding because picking "none" was better than picking an unsupported one and failing the login. However, this behaviour also required us to indicate that we did not support channel binding; otherwise, the server, seeing an unknown binding mechanism, would fail our login. This was a decision made for the broadest possible compatibility with the pre-0440 ecosystem. Note that the y flag wasn't the only security layer. Conversations also uses pinning (if you logged in once with -PLUS, it won't fall back) and XEP-0474 (basically a fancy version of the y flag). In addition there is a setting in Conversations to always require Channel Binding. This will also automatically be turned on for conversations.im and quicksy.im. It has now been two years since XEP-0440 was released for ejabberd and Prosody, and our compatibility concerns have shifted: if you want to have -PLUS on your server, please update the server to support XEP-0440.


Author Daniel Gultsch Committer Stephen Paul Weber Date Commit Parent dc5b9022
+1 -4
1 changed file
+1 -4
1 changed file