Recent content on Daniel Gultsch
You might have heard that XMPP in general, and Conversations in particular, make a great UnifiedPush Distributor. That is correct! However, you might find yourself in a dilemma: you already have an XMPP account with a trusted provider that you want to keep using, and you don’t want to host and maintain your own XMPP server. Furthermore, you may not feel comfortable using the publicly accessible…
The goal of this tutorial is to set up a simple REST API that allows you to send XMPP messages to an existing XMPP account. This can be easily integrated into monitoring solutions or other scripts that send out status information. 
 While there are command-line tools like go-sendxmpp that send messages by connecting to an XMPP server directly, this guide is specifically about providing an HTTP…
CVE-2019-16235+: Missing or incorrect sender validations in Dino allow an attacker to spoof messages and inject or remove entries from the user’s roster. 
 Introduction 
 Dino is a Jabber/XMPP client written in Vala and GTK. On September 10th 2019, while chatting on a public channel, a number of vulnerabilities were discovered in Dino. The discovery was initially prompted by a user of the…
For the last couple of years I have been consulting and doing contract work for various instant messaging companies. All of them use the Extensible Messaging and Presence Protocol (XMPP); Mostly with standard extensions on standard servers. There might be a custom extension here and there but nothing that couldn’t be written down as a standard. (I’m of course not implying that all companies use…
A justification for some of the design choices I made; The second part in a series of essays leading up the release of Conversations 2.0 
 I had been a Jabber user for many, many years when I got my first Android device in 2012. It was around that time when Android received its first major UI overhaul called Holo. As a result the available Jabber clients all looked very dated to someone like…
Why it took us more than two years to enable End-to-End encryption by default: The first in a series of essays leading up to the release of Conversations 2.0 
 When Andreas Straub first introduced OMEMO into Conversations he was trying to make it work with existing server infrastructure by utilizing a general purpose storage mechanism called PEP to store the public key material. PEP, at that…
CVE-2018-6591: When storing bookmarks on the server Converse.js does not properly configure the access model to be private. 
 Introduction 
 The Personal Eventnig Protocol (PEP) is a commonly used extension (XEP) for XMPP. It is a subset of the more powerful Publish-Subscribe (XEP-0060), operating on the user’s account. Primarily it is being used to publish information like a user’s avatar…
In May 2016 Moxie Marlinspike published an article on his company’s blog entitled ‘ Reflections: The ecosystem is moving ’ where he claims that federated systems are ‘stuck in time’. Since then his blog post has been passed around primarily to support the argument that federated, XMPP based, instant messaging is not working and won’t ever provide a decent user experience. On the other hand his…
Establishing trust is always a complicated task but especially difficult in a multi-device environment where every device has its own identity. Concepts like Trust On First Use (TOFU) don’t work very well because a malicious server could sneak a ‘surveillance device’ into every device announcement. Furthermore Trust On First Use doesn’t have an answer to users switching devices or otherwise…
XMPP is not suited for mobile devices. That’s a myth that has been around for ages. It is mostly spread by people who want to sell you their own proprietary instant messaging solution. But it also gained some popularity through a blog post entitled The (Sad) State of Mobile XMPP in 2014 by Georg Lukas. While Georg wasn’t wrong with his status report per se, it is important to understand that he…
CVE-2015-8688: Gajim doesn’t verify the origin of roster pushes thus allowing third parties to modify the roster. 
 Alice is using the latest version of Gajim (0.16.4) and logged in as alice@siacs.eu/Gajim . She has her boyfriend Bob ( bob@siacs.eu ) saved under Bob in her roster. Gajim shows Bob’s JID only in the tooltip of the respective roster entry. 
 
 

 Changing Roster…
Conversations is a messenger for the next decade. Based on already established internet standards that have been around for over ten years Conversations isn’t trying to replace current commercial messengers. It will simply outlive them. Commercial, closed source products are coming and going. 15 years ago we had ICQ which was replaced by Skype. MySpace was replaced by Facebook. WhatsApp and…