XMPP Notifications

July 7, 2018 - Reading time: 2 minutes

Another of the features I'd wanted to add to Freedombone for a long time was server notifications via XMPP, and now that has been added. This is for things like notification that an upgrade or security test has failed or that the tripwire has been triggered. Previously those notifications were only via email, but I'm not very obsessive about email and rarely check it, whereas instant messages are much more likely to get my attention.

The security policy for XMPP chat was previously set such that end-to-end security was required, but it was difficult to automatically send out an OMEMO encrypted message from the server and so I've had to downgrade end-to-end security to being optional. This is not ideal, but the tradeoff between having to deal with folks trying to send me plaintext messages and being promptly alerted if something has failed on the server is probably worth it. Longer term I'd like to figure out if I can automatically generate OMEMO messages and then I can return to a better security policy.

The main factor which delayed the implementation of this was the question of needing to generate a separate XMPP account on the server to push out notifications. I didn't really want there to be a permanent separate account with a password lingering around somewhere which could become a possible security vulnerability. The solution to this was to generate an ephemeral account purely for the purpose of sending a single message. A new notification XMPP account gets created with a random password, sends the message and then about one second later the account is deleted. Even if the account credentials were to leak during the sending of a plaintext message they can't subsequently be useful to a potential adversary.

Another addition to the notifications system is being able to send a webcam photo if the USB canary is triggered. The purpose of that is to answer the paranoid question "Is anyone trying to mess with the server while I'm not at home?" if you're out shopping or at work. The particular threat model is known as evil maid. If you're running Freedombone on an old laptop and have a secondary webcam plugged it it will preferentially use that, so that you can set up the field of view appropriately. Not many people will need this level of physical device security, but it's nice to have the option. Also if you have the Syncthing app installed then any USB canary photo will be synced to the admin account.


End-to-End Policy

May 5, 2018 - Reading time: 2 minutes

Another thing changed recently on the XMPP configuration within Freedombone is the end-to-end security policy. Previously if you posted anything without encryption there would be a big scary and usually also noisy warning notification telling you to do better. This is ok for private one-to-one chats, but not for public multi-user chats such as channels used for open source projects.

So I did a little tweaking and now either OpenPGP or OMEMO are required for one-to-one chat (if you try anything else it will just fail) and there is no encryption requirement for multi-user chat. So you won't get any annoying alarms when posting to multi-user chats. You can of course still do encrypted multi-user chat if you want to, it's just not a strict requirement enforced by the server.

I now find that using XMPP with Conversations on Android is actually a nice experience with very little friction. The cryptostuff all seems to "just work", and there is no possibility of accidentally sending an unencrypted private message as there was before. As of Conversations 2.1 OMEMO encryption is now the default, so you don't need to be concerned about turning it on.

Also in cryptostuff-related news I noticed recently that the Tor daemon on my server was struggling and that apps were not accessible via their onion addresses. This happens occasionally, because Tor is not a perfect system. Relays appear or disappear. Guards change. Systems are attacked and defended. It would be nice to know when these outages are occurring though, so I've added a watchdog to monitor the health of the Tor daemon and report any changes in status via email. So now just by reading your email you can know whether there are any Tor problems happening. In future I'd like to integrate this with XMPP, because that might be more useful. I don't read emails all that often.