<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META content="text/html; charset=iso-8859-1" http-equiv=Content-Type> <META content="MSHTML 5.00.3103.1000" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#ffffff> <DIV><FONT face=Arial size=2>It seems that the jabber server does nothing to prevent users from</FONT></DIV> <DIV><FONT face=Arial size=2>querying the contents of private namespaces of other users.</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2>If user A has set data in a private ns "test:private". User B can</FONT></DIV> <DIV><FONT face=Arial size=2>get at that data by issuing the following info query.</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2><iq to="A@server" type="get" id="blah"><query xmlns="test:private"/></iq></FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2>user B will get back whatever is in that ns.</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2>Is this by design?!? It seems like a major security hole to me.</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2>--------------------<BR>Ben Piercey<BR>Voice IM Software Designer<BR>Nuance Communications<BR>Ottawa, Canada.</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2><A href="http://www.nuance.com">www.nuance.com</A></FONT></DIV></BODY></HTML>