Subject: RE: [Simple] Another idea for presence authorization

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 17 Jul 2001 17:22:36 -0400

> -----Original Message-----
> From: Michael Hammer [mailto:[email-masked]]
> Sent: Tuesday, July 17, 2001 5:14 PM
> To: Jonathan Rosenberg
> Cc: Jonathan Rosenberg; 'Rosen, Brian'; 'Daniel Starin';
> [email-masked]
> Subject: RE: [Simple] Another idea for presence authorization
> 
> 
> At 04:51 PM 7/17/2001 -0400, Jonathan Rosenberg wrote:
> 
> >For privacy. I don't want subscribers to be able to determine my
> >authorization policy. Therefore, differing protocol behavior based on
> >authorization policy can't happen. If a NOTIFY only comes if 
> I'm authorized,
> >then I can use the presence, or lack thereof, of an 
> immediate NOTIFY to
> >determine my presence.
> 
> But, I thought that the whole point of the protocol (specifically the 
> Notify) is to provide me presence information if I subscribe and am 
> authorized.  I saw these two (Subscribe and Notify) 
> transaction as separate 
> with consistent behavior.

Of course these are separate transactions. 

> 
> In the Subscribe transaction, the behavior is always 
> acknowledge receipt of 
> request, nothing more.  Same behavior whether authorized or not.

Correct.

> 
> The Notify transaction is only provided to authorized subscribers and 
> always behaves according to policy rules.  I didn't think 
> there was an 
> issue when presence was revealed when revealing presence was 
> authorized.

OK, let me try again. Telemarketer A decides to use presence as a great way
to sell stuff. When someone logs in, they send them an IM asking to buy the
latest widget. So, the telemarketer gets a huge list of addresses, and
starts sending SUBSCRIBEs. Most sane people go and upload authorization
policy that prohibits the subscription. However, the telemarketer responds
to that in an interesting way. When the telemarketer refreshes the
subscription, they detect whether a negative authorization, or no
authorization has been provided. They then send an email to the user, saying
"you still haven't approved subscriptions from widgets inc. Please do so now
to find out the latest and greatest!". How do they do this detection? Well
they send a SUBSCRIBE. THey get a 200. If a NOTIFY comes immediately, they
know they are authorized. If none comes, they know that haven't been
authorized, or have been rejected.

In other words, since the message sequence differentiates between the case
where a subscription was authorized, or was not, an attacker can ascertain
authorization information. To combat this, the message sequence must always
be the same. In the case of an unauthorized subscriber, the NOTIFY contains
a body with something in it. That something is a syntactically valid, but
incorrect piece of presence (i.e., joe is offline, no matter whether he is
or isn't). Now, the subscriber has no way to determine if their subscription
was authorized or not, based on message flows.

Now, this issue was discussed a lot on the impp list, and I thought there
was consensus that it was a good thing. I think authorization information is
sensitive, and I think its important to protect it.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: "Zane Thomas" <[email-masked]>
Date: Wed, 25 Jul 2001 22:33:20 -0700

Jonathan,

> ... telemarketer ...

Forgive me if this has already been discussed, but what's the situation if
the possible replies to SUBSCRIBE are 200 (followed by NOTIFY, of course) or
Silence?

If there's no reply at all it's not clear to me that any useful information
has been obtained by T.  Before the SUBSCRIBE T already knew that it wasn't
authorized, and after Silence it still knows that.  What it doesn't know is
whether it was actively rejected or simply not heard.

If the Subscribe was accepted and NOTIFY follows then there's no problem
since B apparently intended to provide information to T.

> Now, this issue was discussed a lot on the impp list ...

Another list to join, great. :-)

Zane