Spim Markers and Reports

%ents; ]>

Spim Markers and Reports This document defines an XMPP protocol extension that enables XMPP entities to interact with spim filters by marking unsolicited or suspicious XMPP stanzas. &LEGALNOTICE; 0287 Deferred Standards Track Standards Council XMPP Core XEP-0001 XEP-0030 NOT_YET_ASSIGNED Evgeniy Khramtsov ekhramtsov@process-one.net xram@jabber.ru 0.1 2010-10-04 psa

Initial published version.

0.1 2010-09-13 evk

Initial version.

There are various spim protection methods exist in XMPP: &xep0016;, &xep0158;, &xep0191;, &xep0268; and &xep0275;. But they may not be sufficient enough:

&xep0016; and &xep0191; define blocking mechanism only which is not always appropriate.
&xep0158; interacts badly with automated software such as gateways.
&xep0268; implies trusted network of servers.
&xep0275; concentrates on ranking only.

Service administrators might want to deploy server-based spim recognition software to fill in the gaps. However, every automated spim recognition suffers from false positives - situations where a stanza incorrectly qualified as spim. To avoid them, a spim filter doesn't block suspicious stanza, but marks it and sends to a client in a regular manner. A client software doesn't need to interrupt a user when processing such marked stanzas: for example, it may put them silently in "SPAM" folder, so a user can look through them at any time later. Furthermore, a spim filter may take user's experience into account. When a user receives an unsolicited stanza, he or she can mark it as spim. In this case a client software sends an automatic complaint to a server-based spim filter. This specification deals with both cases. Thus, in contrast to &xep0159;, it doesn't introduce any spim blocking techniques. Also, the various spim recognition procedures that may be employed by the server are beyond the scope of this document.

An implementation compliant with this document MUST support spim markers as described in Spim Marker use case. Support for spim reports, as described in Spim Report use case, is RECOMMENDED.

The following terms are used throughout this document:

Filtering Entity: An XMPP entity which performs spim recognitions, blocks or marks suspicious stanzas and accepts spim reports. Example: a server or an external component with built-in spim recognition module.
Receiving Entity: An XMPP entity which directly receives marked stanzas and sends spim reports. Example: a client or a conference (&xep0045;).

The filtering entity marks abusive stanza by adding child element qualified by the 'urn:xmpp:spim-marker:0' namespace. The element MUST possess the 'filter' attribute whose value MUST be a full jid of the filtering entity. The element MAY contain character data which SHOULD be a human-readable description of the reason to mark. The filtering entity MUST NOT add more than one element and MUST delete all other elements matching itself before adding a new one. The filtering entity MAY remove any elements matching itself even if it doesn't add a new one.

Love pills - 75% OFF Unsolicited advertising ]]> You won $1,000,000! Visit http://www.abuser.com/ Blocked by too many DNSBLs ]]>

Processing rules of marked stanzas taken by the receiving entity are beyond the scope of this document. One possible solution is to put such stanzas silently in so-called "SPAM" folder.

If the filtering entity wishes to receive abuse report for the stanza, it MUST add <report/> child element qualified by the 'urn:xmpp:spim-report:0' namespace and MUST possess the 'key' and the 'filter' attributes. A value of the 'key' attribute is arbitrary, but SHOULD have at least 128 bits of randomness. The 'key' attribute is needed to match the corresponding complaint (if any) with the sender. The value of the 'filter' attribute MUST be a full jid of the filtering entity. The filtering entity MUST NOT add more than one <report/> element and MUST delete all other <report/> elements matching itself before adding a new one. The filtering entity MAY remove any <report/> elements matching itself even if it doesn't add a new one.

]]>

The receiving entity MAY complain by sending an IQ-set containing the <query/> child element qualified by the 'urn:xmpp:spim-report:0' namespace. A value of the 'filter' attribute MUST be copied in the 'to' attribute of the IQ-set stanza. The element MUST possess 'key' attribute copied from the original stanza.

The receiving entity MUST ignore any <report/> elements generated by untrusted filtering entities. If there are more than one <report/> element matching the same filtering entity, all of them MUST be ignored.

]]>

The filtering entity MUST respond with an empty IQ-result stanza upon successful completion of the request:

]]>

A filtering entity SHOULD only add or <report/> elements and a receiving entity SHOULD only process those elements if the corresponding stanza envolves an interaction with a human user: subscription requests, messages, conference invites, voice calls, etc. For example, it doesn't make a lot of sense to mark &xep0232; stanzas.

To avoid obvious false positives and user confusions, a filtering entity SHOULD NOT add or <report/> elements to a stanza and a receiving entity SHOULD ignore and <report/> elements of a stanza if:

The receiving entity has the sender's subscription information of the type "both", "from" or "to".
The receiving entity has pending subscription to the sender, i.e. subscription of type "none" and ask='subscribe'.
The receiving entity has sent direct presence to the sender.

If an entity supports the spim markers, it MUST report that by including a service discovery feature of "urn:xmpp:spim-marker:0" in response to a &xep0030; information request. If an entity supports the spim reports, it MUST report that by including a service discovery feature of "urn:xmpp:spim-report:0" in response to a &xep0030; information request:

]]> ... ... ]]>

Care should be taken if a receiving entity chooses to generate a CAPTCHA challenge (&xep0158;) in response to a marked stanza. A spim recognition system rarely has more than 5-10% of false positives. Thus, producing CAPTCHA images or audio/video samples is likely a waste of system resources and also may overload the receiving entity at high rate of spim stanzas.

A rogue server may add fake elements to compromise filtering entities: a user may decide to remove such entities from the trusted list because, for example, he or she thinks they produce too many false positives. To avoid such situation, a filtering entity MUST remove any elements matching itself before adding new element as described in Spim Marker use case. Also, a filtering entity MAY remove any elements matching itself even if it doesn't add a new one.

An attacker may add fake <report/> element. For example, it may do that for checking an activity of the user. To avoid such situation, a receiving entity MUST send spim reports to the trusted filtering entities only as desribed in Spim Report use case.

An attacker may add thousands of fake <report/> elements matching the single trusted filtering entity in one stanza. A poorly written receiving entity may generate a complaint for all of them. As an effect, a distributed DoS attack on the filtering entity is performed if there are multiple receiving entities envolved. To avoid such situation, a receiving entity MUST ignore multiple <report/> elements matching the same filtering entity as desribed in Spim Report use case.

In its turn, a filtering entity MUST remove any <report/> elements matching itself before adding new <report/> element as described in Spim Report use case. Thus, it is guaranteed that the element will not be ignored by the receiving entity.

An attacker may gain an information about user's trusted filtering entities. In this case he or she may add the <report/> element per every such entity in one stanza. If there are too many filtering entities in the list, a user may generate enormous traffic when generating spim reports. Although this attack is not very effective, a client software MUST not generate spim reports without user's acknowledgement.

An attacker may try to mark an innocent user as a spimmer by producing several IQ-set stanzas qualified by "urn:xmpp:spim-report:0" containing different value of the 'key' attribute each (so-called "dictionary attack"). As a protection, sanity checks MUST be performed when processing such reports. For example, if a filtering entity doesn't store any information about a receiving entity, the value of the 'key' attribute SHOULD have at least 128 bits of randomness.

This document requires no interaction with &IANA;.

This specification defines the following XML namespaces:

urn:xmpp:spim-marker:0
urn:xmpp:spim-report:0

Upon advancement of this specification from a status of Experimental to a status of Draft, the ®ISTRAR; shall add the foregoing namespace to the registry located at &NAMESPACES;, as described in Section 4 of &xep0053;.





  
    
      The protocol documented by this schema is defined in
      XEP-xxxx: http://www.xmpp.org/extensions/xep-xxxx.html
    
  

  
    
      
        
          
	  
        
      
    
  


]]>





  
    
      The protocol documented by this schema is defined in
      XEP-xxxx: http://www.xmpp.org/extensions/xep-xxxx.html
    
  

  
    
      
        
	  
        
      
    
  

  
    
      
        
          
	  
        
      
    
  


]]>

Thanks to Sergei Golovan for the feedback.