diff --git a/xep-0203.xml b/xep-0203.xml index e28a8d8d..728fa4a8 100644 --- a/xep-0203.xml +++ b/xep-0203.xml @@ -27,6 +27,12 @@ http://www.xmpp.org/schemas/delay.xsd &stpeter; + + 1.1rc1 + in progress, last updated 2009-09-09 + psa +

Addressed security concern about forged timestamps provided during Call for Experience.

+
1.0 2007-03-29 @@ -139,6 +145,7 @@

Delayed delivery data can expose information about the sender's presence on the network at some time in the past. However, this introduces no new vulnerabilities, since the same information would have been available in real time.

+

Absent cryptographic signing of stanzas and parts of stanzas, it is possible for delayed delivery notations to be forged. For example, the originator of a message (or the originator's server) could include a notation that makes it appear as if delivery of the message was delayed by the recipient's server. The same is true of delayed delivery notations putatively added by a Multi-User Chat room, which could be forged by the message originator, the originator's server, the recipient's server, or the server that hosts the chatroom service. Although the recipient's server SHOULD discard a delayed delivery notation whose 'from' attribute matches the server's JabberID (or return a ¬acceptable; error to the originator), this policy does not guard against forging of notations putatively from other entities (such as a chatroom hosted at a different trust domain). Therefore, a recipient SHOULD NOT rely on delayed delivery notations to provide a completely accurate representation of the delivery path or timing of a stanza it has received.

This document requires no interaction with &IANA;.

@@ -179,4 +186,7 @@ ]]>
+ +

Thanks to Sergei Golovan for his feedback regarding forged timestamps.

+