Subject: [perpass] Security Dogfood: IETF's Jabber Servers

From: Pranesh Prakash <[email-masked]>
Date: Sat, 15 Mar 2014 15:20:28 -0400

Dear all,
As Peter Saint-Andre announced on this list in October 2013, the XMPP 
community has charted out an ambitious plan to encrypt all 
server-to-server communications by May 19, 2014.[1] Currently 
jabber.ietf.org is using a certificate that expired seven months ago, 
does not support TLSv1.2, allows known-weak ciphers to be used and does 
not support forward secrecy:

https://xmpp.net/result.php?domain=jabber.ietf.org&type=server

Could the admins please renew the cert, support TLS 1.2, limit the 
ciphersuite to keep out known-weak ciphers, and ensure that 
server-to-server traffic is encrypted?

http://wiki.xmpp.org/web/Securing_XMPP#ejabberd

Thanks.

Cheers,
Pranesh

  [1]: https://github.com/stpeter/manifesto/blob/master/manifesto.txt

-- 
Pranesh Prakash
Policy Director, Centre for Internet and Society
T: +91 80 40926283 | W: http://cis-india.org
-------------------
Access to Knowledge Fellow, Information Society Project, Yale Law School
M: +1 520 314 7147 | W: http://yaleisp.org
PGP ID: 0x1D5C5F07 | Twitter: https://twitter.com/pranesh_prakash

---

From: "Matt Larson via RT" <[email-masked]>
Date: Tue, 18 Mar 2014 04:32:36 -0700

Greetings.

We are currently planning a major renovation to the IETF Jabber server
infrastructure, working in conjunction with Peter Saint-Andre. The requested
items will be included in the upgrades and changes.

Thanks,

Matt

--
--------------------------------------
Matthew Larson, Asst. IT Director
Association Management Solutions
Forum Management, Meeting and Event Planning
48377 Fremont Blvd., Suite 117, Fremont, CA 94538
http://www.amsl.com