daniel, i respect and admire you for your considerate and respectful behavior, but would it be appropriate to point out the potential of unintended #mitm interception more clearly in this case?
i mean, the title could also have been "apple does not want you to notice when you are being wiretapped", or do i miss any other precaution they took for this not to happen?
also, i find it shocking that i don't find this shocking any more… 🤯
Vortrag über den MITM Angriff auf jabber.ru den @daniel@gultsch.social im Rahmen des Berlin XMPP Meetups am 13. Dezember 2023 gehalten hat.
Slides: codeberg.org/iNPUTmice/talks/s…
Video Production: @xHain_hackspace@chaos.social
@protonmail The problem is more like "fiddling with the contents" or doing anything in transit.
Cuz I do #E2EE the way it's meant to be done aka. #SelfCustody of #Keys and not some #MITM'ing "Appliance"...
Mitigating the Hetzner/Linode XMPP.ru MitM interception incident, part 2: XMPP-specific mitigations
#XSF Announcement
Recently there was an incident via a so called #man_in_the_middle attack happened to an #XMPP #server.
To reduce the risk of such attacks in the future an early stage service called CertWatch has been published by our Community: certwatch.xmpp.net/
Many thanks to Stephen P. Weber (@singpolyma)!
Read two related blog posts:
blog.jmp.chat/b/certwatch/cert…
snikket.org/blog/on-the-jabber…
#Jabber #mitm #security #vulnerability #machine_in_the_middle #chat
Reports of a possible recent interception of the public XMPP service jabber.ru have raised a lot of questions for people about how the attack happened, and whether it could affect them too. We have some answers.snikket.org
Detailed and credible looking report of #LawfulInterception #MitM on an #xmpp server hosted at #Hetzner in Germany: notes.valdikss.org.ru/jabber.r…
Looks like a transparent bridge was deployed in front of the actual server, obtained dedicated certificates from #LetsEncrypt and MitMed all incoming client connections since July. It was discovered because the LE certificate expired 🤦
