[Reviving a very old thread]
It looks like today is going to be the day Google shuts down ClientLogin [1],
and with that, SASL PLAIN [2]. This might be the final nail in the coffin of
XMPP support for Google Talk, as I fear few clients have implemented X-OAUTH2.
We have an update in beta for
That’s a relief. I noticed you did this in the newer Adium betas and was
wondering what was going on. I guess it’s on my radar to complete on Monal now
as well. The gradual movement away from standard XMPP in gtalk is depressing.
-Anu
On Apr 20, 2015, at 10:01 AM, Thijs Alkemade
On 20 apr. 2015, at 10:15, Thijs Alkemade th...@xnyhps.nl wrote:
[Reviving a very old thread]
It looks like today is going to be the day Google shuts down ClientLogin [1],
and with that, SASL PLAIN [2]. This might be the final nail in the coffin of
XMPP support for Google Talk, as I fear
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/18/12 12:19 PM, Hannes Tschofenig wrote:
On 09/18/2012 08:51 PM, Peter Saint-Andre wrote:
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1
On 9/18/12 11:25 AM, Hannes Tschofenig wrote:
On 09/18/2012 08:21 PM, Peter Saint-Andre wrote:
(Btw,
Here is my impression: Since the community OAuth specification allowed
the usage of PLAIN without TLS there is most likely still a lot of code
out there that uses it without any confidentiality protection (which is
obviously very insecure). (Btw, the current XMPP OAuth XEP is also
insecure...)
Hi Randy,
the issue about the browser interaction is that the SSO mechanisms for
the Web* have not standardized the authentication part. Since there is
so much Web deployment out there and folks have an interest to work with
existing deployment.
However, there is a window of opportunity
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/18/12 11:16 AM, Hannes Tschofenig wrote:
Here is my impression: Since the community OAuth specification
allowed the usage of PLAIN without TLS there is most likely still a
lot of code out there that uses it without any confidentiality
On 09/18/2012 08:21 PM, Peter Saint-Andre wrote:
(Btw, the current XMPP OAuth XEP is also insecure...)
Calling it current is a bit of a stretch.:) It was deferred for
inactivity quite some time ago. At this point, any use of OAuth in
XMPP would likely be based on the SASL mechanism.
I didn't
The choices are:
* OAuth SASL
http://tools.ietf.org/html/draft-ietf-kitten-sasl-oauth-08
IMHO it would work fine with OpenID Connect since OpenID Connect is
based on OAuth 2.0.
* OpenID SASL
http://tools.ietf.org/html/rfc6616
* SAML SASL
http://tools.ietf.org/html/rfc6595
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/18/12 11:25 AM, Hannes Tschofenig wrote:
On 09/18/2012 08:21 PM, Peter Saint-Andre wrote:
(Btw, the current XMPP OAuth XEP is also insecure...)
Calling it current is a bit of a stretch.:) It was deferred
for inactivity quite some time ago.
On 09/18/2012 08:51 PM, Peter Saint-Andre wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/18/12 11:25 AM, Hannes Tschofenig wrote:
On 09/18/2012 08:21 PM, Peter Saint-Andre wrote:
(Btw, the current XMPP OAuth XEP is also insecure...)
Calling it current is a bit of a stretch.:) It
On 2012-09-13 19:20, Peter Saint-Andre wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/11/12 4:24 PM, Lance Stout wrote:
It's a bit annoying that they add an extra attribute to the auth
/ element, because it adds a special case to check in what would
ideally be a fully generic
PLAIN is going to be deprecated, even though TLS is pretty much ubiquitous?
RandyRalph Meijer ral...@ik.nu wrote:On 2012-09-13 19:20, Peter Saint-Andre
wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/11/12 4:24 PM, Lance Stout wrote:
It's a bit annoying that they add an extra
On 2012-09-17 21:10, Randy Turner wrote:
PLAIN is going to be deprecated, even though TLS is pretty much ubiquitous?
This has to do with their intent to ban the use of passwords in
applications and rely on 2-step verification with OAuth2 bearer tokens.
--
ralphm
On 2012-09-17T21:10:20 CEST, Randy Turner wrote:
PLAIN is going to be deprecated, even though TLS is pretty much
ubiquitous?
Looks like it only affects GTalk.
--
Regards,
Kim Zash Alvefur
signature.asc
Description: OpenPGP digital signature
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/17/12 1:36 PM, Ralph Meijer wrote:
On 2012-09-17 21:10, Randy Turner wrote:
PLAIN is going to be deprecated, even though TLS is pretty much
ubiquitous?
This has to do with their intent to ban the use of passwords in
applications and rely
On Monday, September 17, 2012 01:39:46 PM Peter Saint-Andre wrote:
On 9/17/12 1:36 PM, Ralph Meijer wrote:
On 2012-09-17 21:10, Randy Turner wrote:
PLAIN is going to be deprecated, even though TLS is pretty much
ubiquitous?
This has to do with their intent to ban the use of passwords
I'm currently considering wether to use OAuth2 or OpenID2 in my server.
Which one do you think will be more adopted as a user authentication
mechanism in XMPP servers?. Which companies are planing to use each of
them?.
Thanks,
Ivan
On Mon, 17 Sep 2012 13:39:46 -0600, Peter Saint-Andre wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/17/12 3:00 PM, Ivan Martinez wrote:
I'm currently considering wether to use OAuth2 or OpenID2 in my
server. Which one do you think will be more adopted as a user
authentication mechanism in XMPP servers?. Which companies are
planing to use
What about a combination...OpenID Connect ? Peter Saint-Andre
stpe...@stpeter.im wrote:-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/17/12 3:00 PM, Ivan Martinez wrote:
I'm currently considering wether to use OAuth2 or OpenID2 in my
server. Which one do you think will be more adopted as a
I would like to emphasize the earlier point….it would be nice if we had a
solution that did NOT require an interactive browser procedure.
Randy
On Sep 17, 2012, at 5:21 PM, Randy Turner rtur...@amalfisystems.com wrote:
What about a combination...OpenID Connect ?
Peter Saint-Andre
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 9/11/12 4:24 PM, Lance Stout wrote:
It's a bit annoying that they add an extra attribute to the auth
/ element, because it adds a special case to check in what would
ideally be a fully generic implementation. Fortunately, it doesn't
seem to be
FYI, Google recently documented their X-OAUTH2 SASL method;
https://developers.google.com/talk/jep_extensions/oauth
It's a bit annoying that they add an extra attribute to the auth / element,
because it adds a special case to check in what would ideally be a fully
generic implementation. Fortunately, it doesn't seem to be required for now.
-- Lance
On Sep 11, 2012, at 3:15 PM, Arc Riley arcri...@gmail.com
24 matches
Mail list logo
