From 5691ca30724a541cff4355fead7937d61ce6ec60 Mon Sep 17 00:00:00 2001 From: Peter Saint-Andre Date: Wed, 8 Jan 2014 13:56:49 -0700 Subject: [PATCH] 1.1 correction --- xep-0156.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xep-0156.xml b/xep-0156.xml index 863fedca..2cbf4b00 100644 --- a/xep-0156.xml +++ b/xep-0156.xml @@ -199,7 +199,7 @@ _xmppconnect IN TXT "_xmpp-client-websocket=wss://web.example.com:443/ws"

It is possible that advertisement of alternative connection methods can introduce security vulnerabilities, since a connecting entity (usually a client) might deliberately seek to connect using the method with the weakest security mechanisms (e.g., no channel encryption or relatively weak authentication). Care needs to be taken in determining which alternative connection methods are appropriate to advertise.

-

Entities that use these connection methods need to ensure that they conform to the security considerations of each method (e.g., by preferring to use 'https' or 'wss' URLs that are protected using Transport Layer Security).

+

Entities that use these connection methods MUST conform to the security considerations of each method, for example by preferring to use 'https' or 'wss' URLs that are protected using Transport Layer Security (TLS).