%ents; ]>
Invisible Command This document specifies an XMPP protocol extension for user invisibility. &LEGALNOTICE; 0186 Experimental 2017-12-21 2017-12-12 Standards Track Standards XMPP Core XMPP IM XEP-0030 XEP-0018 XEP-0126 invisible &stpeter; 0.13 2017-11-29 psa

Addressed Last Call feedback: (1) clarified conformance requirements for 'probe' attribute and (2) removed text about using the same server backend for privacy lists because XEP-0016 is now deprecated.

 0.12 2017-01-28 psa

Added method for specifying server behavior regarding presence probes via new 'probe' attribute; incremented the protocol version number from 0 to 1.

 0.11 2012-06-27 psa

Clarified handling of directed presence while in invisible state.

 0.10 2012-05-29 psa

Further clarified server and client handling of stanzas during an invisibility session; updated RFC references.

 0.9 2008-10-07 psa

Further clarified server and client handling of stanzas during an invisibility session.

 0.8 2008-10-06 psa

Modified namespace to incorporate namespace versioning.

 0.7 2008-05-12 psa

Added note about integration with privacy lists; removed XEP-0126 from list of protocols that this specification supersedes; changed temporary namespace to conform to XMPP Registrar procedures; copied several security considerations from XEP-0126.

 0.6 2007-09-05 psa

Clarified that this specification is intended to supersede XEP-0018 and XEP-0126; added several additional examples.

 0.5 2007-01-30 psa

Modified XML namespace name to conform to XEP-0053 processes.

 0.4 2006-08-09 psa

Added XMPP Registrar considerations and XML schema.

 0.3 2006-08-02 psa

Added inbound presence rule to server handling section.

 0.2 2006-07-07 psa

Clarified that invisibility mode does not carry across sessions.

 0.1 2006-05-30 psa

Initial version.

 0.0.2 2006-05-15 psa

Recommended delivery of messages sent to bare JID.

 0.0.1 2006-05-11 psa

First draft.

Some XMPP-based instant messaging systems have long supported the ability for users to be online but to appear offline to other users. This "invisibility" feature was previously defined in nonstandard or complicated ways via &xep0018; and &xep0126; (the latter was a profile of &xep0016;, which is now deprected). By contrast, this specification defines a standards-compliant protocol extension that can be used over the long term, using an IQ-based protocol that enables an IM user to become "invisible" and "visible" at will within the context of a given session.

The requirements for invisible mode are straightforward:

  1. A user can become visible or invisible at any time within an XMPP session.
  2. Invisible mode is active only for the current session; if the user ends that session and starts another session, the invisibility mode set for the previous session does not carry over to the new session.
  3. When in invisible mode, a user can send messages and directed presence to particular contacts.

In order for a client to go invisible, it sends an IQ-set with no 'to' address (thus handled by the user's server) containing an <invisible/> element qualified by the 'urn:xmpp:invisible:1' namespace &VNOTE;.

The <invisible/> element SHOULD include a 'probe' attribute, which specifies whether the server shall or shall not send presence probes to entities in the user's roster (thus determining whether the user does or does not automatically receive presence notifications from contacts). This attribute is a boolean &BOOLEANNOTE;, where a logical value of TRUE (lexical value of "true" or "1") indicates that the server shall send presence probes and where a logical value of FALSE (lexical value of "false" or "0") indicates that the server shall not send presence probes. The default logical value is FALSE.

]]>

Although the default value is false (thus protecting the user from leaking presence information), the client SHOULD always include the 'probe' attribute.

]]>

If the server can successfully process the invisible command, it MUST return an IQ-result.

]]>

(Standard XMPP stanza errors apply; see RFC 6120.)

When the client enters invisible mode during a presence session (i.e., after having previously sent undirected available presence with no 'type' attribute), the server MUST send &UNAVAILABLE; from the specified resource to all contacts who would receive unavailable presence if the client itself were to send &UNAVAILABLE;.

The following sections define server and client handling of inbound and outbound XML stanzas while the client is invisible.

While the client is in invisible mode, the server:

  1. MUST NOT broadcast outbound presence notifications as a result of receiving any subsequent undirected presence notifications from the client.

  2. MUST deliver outbound directed presence stanzas generated by the client.

  3. MUST generate or not generate outbound presence probes in accordance with the value of the 'probe' attribute.

  4. MUST deliver inbound &PRESENCE; stanzas.

  5. SHOULD deliver inbound &MESSAGE; stanzas whose 'to' address is the bare JID &LOCALBARE; of the user (subject to standard XMPP stanza handling rules from RFC 6120 and RFC 6121).

  6. MUST deliver inbound &MESSAGE; and &IQ; stanzas whose 'to' address is the full JID &LOCALFULL; corresponding to the resource of the client.

  7. MUST deliver outbound &MESSAGE; and &IQ; stanzas generated by the client (for an important note regarding presence leaks, see the Security Considerations section of this document).

  8. If there are no other available resources, MUST respond to all IQ-get requests and presence probes sent to the account's bare JID as if the account were offline; this includes but is not limited to the following:

    • If the server responds to a presence probe, the last available presence MUST indicate that the user is unavailable, and if a time is indicated it MUST be the time when the client went invisible.
    • If the server responds to a &xep0012; request, the last activity time MUST be the time when the client went invisible.
    • If the server responds to a &xep0030; items request, the response MUST NOT include the invisible resource as one of the account's available items.

  9. If after sending directed presence the client then sends &UNAVAILABLE;, the server MUST deliver that unavailable presence only to the entities to which the client sent directed presence after going invisible.

While the client is in invisible mode, it is suggested that the client behave as follows:

  • Maintain a temporary list of entities with which communication is allowed and prompt the user before adding any entity to that "communicants list" for this invisibility session; for user convenience, this list might be auto-populated with trusted entities if so configured by the user.

  • Prompt the user before sending any outbound traffic (message, presence, or IQ stanza) to another user, even if the user generated such traffic; upon receiving authorization from the user, the client might then add the authorized entity to the communicants list for this invisibility session.

In order for a client to become visible again, it sends an IQ-set with no 'to' address (thus handled by the user's server) containing a <visible/> element qualified by the 'urn:xmpp:invisible:1' namespace &VNOTE;.

]]>

If the server can successfully process the visibility command, it MUST return an IQ-result.

]]>

When the client becomes visible, the server MUST treat that state as equivalent to an active session before receiving initial presence from the client, with one exception: if the client sent directed presence to any entities while in the invisible state, the server MUST treat those entities as under point 2 of Section 4.6.3 of RFC 6121 (i.e., the server MUST ensure that it sends unavailable presence to those entities if the client subsequently goes offline after becoming visible).

If the user wishes to then send presence to all contacts in the roster, it is the responsibility of the client to send an undirected available presence notification to the server.

]]>

The server would then broadcast that presence notification to all entities who would normally receive presence broadcasts from the client (the server MAY also send that notification to any entities to which the client sent directed presence while invisible, whether or not they are in the user's roster).

In order for a client to discover whether its server supports the invisible command, it sends a &xep0030; information request to the server:

]]>

If the server supports the invisible command, it MUST return a feature of "urn:xmpp:invisible:1" &VNOTE;.

]]>

A client SHOULD complete this service discovery process before sending initial presence to its server (as specified in &xep0115;, a server can include entity capabilities information in a stream feature, which obviates the need for explicit service discovery as shown above).

Implementers need to be aware that use of the 'probe' attribute is not consistent with the older privacy lists approach defined in XEP-0126.

No matter how it is implemented, invisibility can be defeated and presence leaks can occur without careful stanza handling on the part of the server and the client. Use of the protocol defined here does not necessarily prevent presence leaks, either technically or socially (e.g., if the user reveals his presence to one contact but not another and those contacts are in communication).

No interaction with &IANA; is required as a result of this document.

This specification defines the following XML namespace:

  • urn:xmpp:invisible:1

Upon advancement of this specification from a status of Experimental to a status of Draft, the ®ISTRAR; shall add the foregoing namespace to the registry located at &NAMESPACES;, as described in Section 4 of &xep0053;.

 &NSVER; ]]>

Thanks to Philipp Hancke, Evgeny Khramtsov, Ruslan Marchenko, Kevin Smith, and Matthew Wild for their feedback.