[JDEV] Transports and unregistered Jabber accounts

[Trejkaz Xaoza]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 7 Jan 2004 20:38, Matthias Wimmer wrote:
> The result is, that an other person can register for the same account
> and use the former users transport without reregistering and without
> knowing the password used to register the accounts.

Are you sure about this?  Can the new user simply add a transport straight to 
their roster?  I was under the impression that the only way to add a 
transport was via registration with the transport, which should require the 
password.

An ostrich approach to solving the problem would be not to allow removal of 
accounts.  This approach seems good enough for every other IM service on the 
planet so it's probably good enough for a Jabber server, assuming it's 
actually possible.

> It would also be possible, that not the server cares about this but the
> client and that the client unregistered all transports before removing
> them or before unregistering the account. While this might be a good
> idea, I think the server should still care for this as well.

I guess it is possible to find out which entries on the roster are transports, 
by using service discovery... maybe a module could be written, but it 
certainly doesn't seem like a task for the core server.  I mean, what if the 
transport is down when the user deletes their account, in that case you have 
no way to unregister the transport anyway. :-/

TX

- -- 
'Every sufficiently advanced technology is indistinguishable from magic' - 
Arthur C Clarke
'Every sufficiently advanced magic is indistinguishable from technology' - Tom 
Graves

      Email: Trejkaz Xaoza <trejkaz at xaoza.net>
   Web site: http://xaoza.net/trejkaz/
  Jabber ID: trejkaz at jabber.xaoza.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/++QKmifzwBMPxxoRAjWfAJ9XozWavl4B6ROQQgMCbXnIS9f4qQCdGAeA
Xj8hkAjXZDvhpt0AhkxguTk=
=LEPJ
-----END PGP SIGNATURE-----