Skip to content

XEP-0490: Add security consideration for sender verification of PEP n… #1554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iNPUTmice wants to merge 1 commit into
base: master
Choose a base branch
from
Open

XEP-0490: Add security consideration for sender verification of PEP n… #1554

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions xep-0490.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,16 @@
<supersededby/>
<shortname>mds</shortname>
&inputmice;
<revision>
<version>1.1.0</version>
<date>2026-07-19</date>
<initials>dg</initials>
<remark>
<ul>
<li>Add security consideration for sender verification of PEP notifications.</li>
</ul>
</remark>
</revision>
<revision>
<version>1.0.1</version>
<date>2024-11-20</date>
Expand Down Expand Up @@ -271,6 +281,7 @@
<li>Servers that support the server assist feature MUST strip the &lt;displayed/> element in the "urn:xmpp:mds:displayed:0" namespace from the message to avoid the stanza-id being leaked to the recipient of that message.</li>
<li>Clients MUST NOT put the &lt;displayed/> into a message to trigger server-assisted displayed synchronization unless the server announces the "urn:xmpp:mds:server-assist:0" feature.</li>
<li>This specification provides a convenient process to synchronize a user’s own devices and informing the third party in one, single message. However letting the third party know is not always desirable, for example when the user has generally opted out of transmitting the displayed status or when a non-contact initiated a chat. In those cases the client MUST use the &xep0060; method instead of server-assist.</li>
<li>When parsing incoming PEP notifications, clients MUST verify that the notification message originates from the user’s bare JID. Notifications from third parties might arrive if that third party has configured the access model of their node to be open.</li>
</ul>
</section1>
<section1 topic='Privacy Considerations' anchor='privacy'>
Expand Down
Loading