求助 HN：哪些 Jabber 客户端支持 SCRAM+ 和 XEP-0474？
2 分•作者: Bender•10 天前
与此讨论串 [1] 相关，该讨论串指出 Jabber 客户端不仅能在使用中间人攻击（MitM）时检测到篡改（即使中间人使用的证书是有效的，但并非服务器上的证书），而且客户端不仅会拒绝这个替代的有效证书，还会向用户发出 MitM 攻击的警报。XEP-0474 SASL SCRAM 降级保护（*实验性*）[2] Claude 似乎并不了解，我也找不到任何澄清性的文档，只有大量的未解决问题。
目的是撰写一篇关于端到端加密（E2EE）的文章，但我希望推荐一些客户端，它们能在中间人攻击篡改时发出警报，而且用户无法轻易忽略。*即，不会轻易点击忽略警告*。
在服务器端，eJabberd 和 Prosody 似乎是唯一支持 XEP-0474 的服务器守护进程，但我就是找不到一份明确的支持客户端列表，即使它们处于实验阶段。*它们可能支持 SCRAM+，但不会在篡改时使用有效证书发出警报*。
我对 LLM 的回答不感兴趣。LLM 似乎不知道答案，反而给出 XEP-0474 是实验性的官方说法，这对于希望进行实验的人来说毫无价值。
[1] - https://news.ycombinator.com/item?id=37955264
[2] - https://xmpp.org/extensions/xep-0474.html
查看原文
Related to this thread [1] which Jabber clients not only detect MitM tampering when a valid cert is used in the middle but is not the cert on the server, meaning an entity obtained a certificate, used it to MitM the connection and the client not only rejects this alternate valid certificate but also alerts the user to the MitM. XEP-0474 SASL SCRAM Downgrade Protection <i>(Experimental)</i> [2] Claude does not seem to know and I can't find any clarifying documentation, just lots of open issues.<p>The purpose is for writing an article on E2EE but I want to suggest clients that will alert on MitM tampering in a manor the person using the client can not accidentally ignore it. <i>i.e. just click through a warning</i><p>On the server side eJabberd and Prosody appear to be the only server daemons supporting XEP-0474 but I just can't find a definitive list of supported clients even if they are in the experimental phase. <i>they may support SCRAM+ but do not alert on tampering using a valid cert.</i><p>I am not interested in an LLM answer. LLM's do not appear to know the answer and instead give the official stance that XEP-0474 is experimental which holds no value for those wishing to experiment.<p>[1] - https://news.ycombinator.com/item?id=37955264<p>[2] - https://xmpp.org/extensions/xep-0474.html