Achtung! Deanon via jabber? Sometimes it happens.

[Jollier]

Do you wash your hands when you come home? Now let's remember that there is also such a thing as digital hygiene. Failure to comply with it can also lead to sad consequences. And even the “safest” Jabber can lead not only to deanon you, but also your friends.

Suppose you added a contact to Jabber, renamed it as convenient and assigned it to the necessary group for ordering. All information instantly "flew" to the server contact list, or in other words - Roster. Imagine, the contact was called “bArmAlEy”, and you renamed it “Misha Berdoev” out of old friendship, and even added it to the “Carders” group. All this was saved on the server.

JabberID	Nickname	Group	Subscription
[email protected]	Misha Berdoev	Carders	both

Clearly, for understanding, on the server everything looks like this
At the same time, the very bArmAlEy on the other end of the wire does not even suspect that it has already been drained. This is important to understand, because those who do not know you under a nickname, or know you under a different nickname, can “rename” you for nothing to do in their contact “as a priest”, or for some other sexual-racial-ethnic characteristics ... Or, for example, link different nicknames. And unexpectedly, the contact [email protected] will have the nickname Aibolit (more convenient for human communication), which goes to other contacts from other people as [email protected]. And no one in their hearts knows that barmaley @ and aibo @ are one and the same person. Only now the roster knows. This means everyone who has access to it.

You created two separate jabber with a person you know for personal correspondence, and someone (at least one of you) renamed it to your “usual” nickname or name, everything is fucked up, epic fail is a drain.

It is impossible to control this remotely. You can only observe social hygiene. That is, all your environment should be aware of this feature of contacts and not engage in such renaming or division into groups (according to them, you can also find the same people in the roster with different nicknames / contacts, if the group structure is the same).

To make life a little easier for Jabber users using Miranda NG, I cleaned up this issue there with the help of George Hazan. (Below is a list of commits).

It is very important to understand: how this happens in other jabber clients is known only to their authors. But, with a probability of about 95%, all information from the local contact list is sent to the roster by default, as the XMPP (server contact list) logic dictates. Those. all your local contact names and groups are merged to the server. (This applies to any clients that work as prescribed by the protocol - with a server contact list, i.e. all mobile clients of the Xabber type - too; do not rename contacts there and do not add people to groups ! Unless it is group1, group2 and etc. in the literal sense).

If you have previously leaked information about nicknames and groups, what should you do now? At least clean it up (although, most likely, it is already in the hands of “those who”). And as a maximum - update contacts.

I give instructions on how to clean up this information using the latest version of Miranda NG ( these fixes are available only in the latest debug beta version dated 05/27/2020 ; this is not yet available in the release).

1) First, see how bad it is. Just overview. In the top menu, select Status -> the required jabber account -> Services… -> Roster Editor. In the window that appears, click [Download]. A list of contacts from the roster will appear - this is what the server (and “those who”) knows about your contacts, their names, groups.

2) Do not rush to edit anything here - it does not make sense, this table is read only in practice (i.e. even if you change something, it will not work in any way).

3) Have you seen? Close the window.

4) Now go to the settings to turn off the synchronization of your contacts (now this turns off not only the synchronization of groups, but also of nicknames, + it also works perfectly).
The path is as follows:
= -> Options ... -> Network -> the required jabber account -> the “Advanced” tab.
Scroll the list almost to the very bottom. A checkbox will be visible above the Security subgroup:
[] Ignore server roster (groups and nick names)
Turn it on - [x].
Then - [OK] (close the settings).

5) Now you can start cleaning. You need to go to the Roster Editor for this account (how to do this is indicated in paragraph 1). Click the [Download] button there, then click the [Export] button and save to jabber-acc.xml (a name you like).

6) After that, open the jabber-acc.xml item saved in the previous paragraph in any editor convenient for you and bring all the fields name = ”” and group = ”” exactly to this (empty) state. (There you will probably have something like jid = ”[email protected]” name = ”Vasek Koreshok” group = ”Finance”, but you need to do jid = ”[email protected]” name = ”” group = ””).

7) After finishing the preparation of the clean .xml (better in another copy in case something happens), press the [Import] button in the same Roster Editor and load the cleaned .xml.

8) Done. (This should be done with all jabber accounts if you have more than one)

For information, the list of commits in Miranda NG with the indicated changes:

Roster (the ignore groups / nicknames):

Jabber: stronger appliance of Roster Editor with RFC 6121 · miranda-ng/miranda-ng@5ebba85

Miranda NG: Next Generation of Miranda IM. Contribute to miranda-ng/miranda-ng development by creating an account on GitHub.

github.com

Jabber: custom roster nicks should be ignored as well as roster groups · miranda-ng/miranda-ng@67adb1e

Miranda NG: Next Generation of Miranda IM. Contribute to miranda-ng/miranda-ng development by creating an account on GitHub.

github.com

Jabber: if we ignore roster, thy shalt update existing nicks either · miranda-ng/miranda-ng@fd1139f

Miranda NG: Next Generation of Miranda IM. Contribute to miranda-ng/miranda-ng development by creating an account on GitHub.

github.com

https://github.com/miranda-ng/miranda-ng/commit/985d99a13b43a8420faadae25c4b3fe7f52305d6

Jabber: if we ignore roster nicks, we don't apply them when local CLi… · miranda-ng/miranda-ng@c6f19f0

…st/MyHandle isn't empty

github.com

Roster: xml export / import (roster editor)

Jabber: roster to be exported into the simple xml format (import from… · miranda-ng/miranda-ng@59bcd60

… the old format is also supported)

github.com

Bonus:

1) Hiding the type / version of the client software:

Jabber: fix for hiding software version via caps request · miranda-ng/miranda-ng@728b55c

Miranda NG: Next Generation of Miranda IM. Contribute to miranda-ng/miranda-ng development by creating an account on GitHub.

github.com

2) Commits March 15-21, 2020: GPG fix for different situations (all sorts of freezes, etc.)

With the permission of sporaw.livejournal.com

 

[Hacker]

Anonymous Jabber
Hello, I would like to tell you about PGP message encryption and tell you how to make Jabber more anonymous. I will try to remove all the water from the article and explain it as clearly as possible. Let's go!

The main thing in PGP.

PGP (English Pretty Good Privacy) is a computer program, as well as a library of functions that allows you to perform encryption and digital signature operations of messages, files, and other information presented in electronic form, including transparent encryption of data on storage devices, such as a hard disk.

I think everything is clear. We encrypt, sign and everything is fine, no one knows what's inside. But for proper operation, it is important to understand how keys work.
In any program that works with PGP, you need to create a key pair, as a rule, when creating keys, you must enter your email address (you can enter icq, jabber, vk profile, etc.). You can also set the key length, expiration date, and comment, but each program has a different key generation pattern.

After generating it, you will receive a key pair:

1. First key is public (it has a signature in the form of email or whatever you specified. Has a comment), you distribute it and use this key to encrypt messages for you. This message can only be decoded by you and no one else.
2. Second key is private and stored only with you, it is important to keep it safe, as its theft will allow you to decrypt all messages addressed to you. To decrypt it, you will need to enter your password that you used when generating it.

Example. A and B decided to talk about security. A starts a dialog and discards its public key B. B writes a message in the PGP program and encrypts it with the public key A, and then transmits the message as a PGP cipher, for example, via jabber. A receives an encrypted message and decrypts it with its private key. A, after reading that big brother is watching everyone, asks B for his public key, and B kindly gives it to him. And using the public key B encrypts the message to it and also throws it off via jabber.

For key generation, signing, encryption, and decryption, I recommend the gpg4usb program .

Anonymous communication in Jabber.
Jabber is a convenient way to communicate via the XMPP protocol, but just putting the client on Windows or Linux and talking about how you sold a camera on Ebay for$ 1k is not reasonable. You should do this anonymously.

OpenVPN: This example is used to hide Tor from the provider.
Tor: A beast for anonymity, 3 IP addresses under the hood and powerful encryption, the possibilities are endless.
OpenVPN+Tor: for those who are not ready to buy a VDS to raise their OpenVPN server.
OpenVPN is used for traffic encryption and anonymity, but anonymity is not complete, since you have to trust the host where the VPN server is located. As a rule, paid / free VPNs merge your logs on request, and if they write that they don't keep logs, it's not a fact that they don't, so I would recommend still raising your own vpn.
Для начала лучше использовать www.vpngate.net and if possible, Korean OpenVPN, but it is important to remember that they give data to the authorities on request (I wrote to them on behalf of the police, they did not give logs, but they may be busy). Their speed is acceptable, servers live for weeks, some for a couple of hours. It is important to specify the OpenDNS server in your network settings, in the router. This is done so that there are DNS leaks. In order to avoid DNS leaks, you also need to configure the Firefox browser and encrypt all requests to the DNS server.

Connecting Jabber to Tor.
Для создание цепи VPN+TOR, you need to make sure that the jabber client has a Tor proxy, this can be done in the client settings somewhere in the proxy or security settings. If you are using Linux, then install Tor packages and run the daemon and you will have port 9050 open on 127.0.0.1, connect to it as to socks5 and you will direct all your traffic through the Tor loopback that will exit through OpenVPN.
The chain goes out: Vpn+Tor (jabber + PGP (message)) - I think it is clear that in order to understand what is inside, you will have to sweat.
Also, if you are familiar with Linux, there is a software for creating chains/tunnels called Proxychain. There is an analog for Windows, but I will not say what it is called, since windows is insecure and they send everything to Microsoft and others, this is not an anonymous axis and fuck with it as you want.
Proxychain allows you to wrap applications in a tunnel, for example, you have connected a Vpn and wrap tor+socks through Proxychain and get vpn+tor+socks. you just need to configure Firefox, firewall, dns and you are anonymous.
About anonymity in general, I would like to say the following: there is no limit to it, there are many options. If you want complete anonymity and have strong security, then use Tails. This is debian, focused on anonymity and all traffic there is only through Tor.

OTR
Off-the-Record Messaging (OTR) is a cryptographic protocol for instant messaging systems created in 2004 by Nikita Borisov and Ian Goldberg.
The authors created a library distributed under the GNU Lesser GPL license, used for OTR support by clients of instant messaging systems. The authors also created a plugin for Pidgin based on this library. The EFF Foundation recommends using OTR to protect against eavesdropping
As mentioned above, there is a plugin for encryption and you can also use pgp inside this protocol.
The chain exits: VPN+TOR (Jabber+[OTR+PGP (message)])

The basis is distrust of all intermediaries in the network, if you use Windows or iOS, then I have nothing to talk about with you, since almost any software sends reports in these oss. For example, Avast collects huge statistics about your software and they will know if you have a TOR and maybe if they are looking for you, Avast will give them a report about you, but it knows your true IP for a simple reason, it is in your system and monitors your axis.