XEP-0404: Mediated Information eXchange (MIX): JID Hidden Channels.

1. Introduction
2. Concepts
    2.1. Private Messages
    2.2. JID Visibility Services
    2.3. JID Visibility Architecture
    2.4. Resource Hiding
    2.5. JID Map Node
3. Use Cases
    3.1. User Preferences and Additional Information
    3.2. Sending Private Messages
4. Internationalization Considerations
5. Security Considerations
6. IANA Considerations
7. XMPP Registrar Considerations
8. XML Schema
9. Acknowledgements

Appendices
    A: Document Information
    B: Author Information
    C: Legal Notices
    D: Relation to XMPP
    E: Discussion Venue
    F: Requirements Conformance
    G: Notes
    H: Revision History

2.1 Private Messages

Mediated Information eXchange (MIX) (XEP-0369) [1] exposes participant JIDs to other participants, and so messages can always be sent directly. When JIDs are hidden this is no longer possible. Private messages MAY be sent to channel participants if allowed by channel policy. Private messages are switched through the channel to hide addressing.

2.2 JID Visibility Services

MIX channels have three modes controlling JID visibility, defined to prevent JID harvesting:

A channel participant MAY specify a preference for JID visibility for the channel, with one of the following values:

The default value is 'Prefer Hidden'.

2.3 JID Visibility Architecture

MUC hides real JIDs by using Nicks to identify room occupants. This has problems with Nick changing and with multiple active clients for the same user. MIX identifies channel participants by Stable Participant ID. In Mediated Information eXchange (MIX) (XEP-0369) [1], the users JID is in the participants node and is shared in messages and presence. To hide JIDs, this specification makes three key changes

1. The requirement to include real JID in the participants list is relaxed for channels that are not "JID Visible". For a "JID Hidden" channel, real JIDs MUST NOT be included in the participants list. For a "JID Maybe Visible" channel, real JIDs will be included in the participants node according to participant preference.
2. JIDs are not shared in messages and presence.
3. In presence messages, the client resource is anonymized, to prevent leakage of information through the resource.

This change means that the client will not be able to determine real JID of the participant using the participant node, as it can with Mediated Information eXchange (MIX) (XEP-0369) [1].

It is important that MUC owners and administrators are able to see the JIDs of participant. For this reason, a MIX channel following this specification MUST hold a JID Map node, which gives a mapping between Stable Participant ID and JID.

2.4 Resource Hiding

When JIDs are being hidden, the resource of the full JIDs stored in the presence node MUST also be anonymized using a similar mechanism. Where the JID is not being hidden, the resource is simply the resource of the clients full JID. Where the JID is hidden, the resource is replaced with a generated value. For example, 'hag66@shakespeare.example/UUID-a1j/7533' in the channel coven might have an encoded JID of '123456#coven@mix.shakespeare.example/789'. There is no client visible mapping maintained, as this is not needed. The MIX channel will need to maintain a mapping, to support directly addressing clients, such as for client to client disco#info queries. While an encoded JID is held in the presence node, the mapping to real JID MUST NOT be changed. When adding a client to the presence node, the server MAY add the same anonymized JID as used before by that client, or it MAY create a different anonymized JID.

2.5 JID Map Node

This specification defines a JID Map node, so that administrators can see JIDs for JID Hidden channels.

The JID Map node is used to associate a Stable Participant ID to its corresponding bare JID. It is a PubSub node with the 'node' attribute set to 'urn:xmpp:mix:nodes:jidmap'. The JID Map node MUST have one entry for each entry in the Participants node. This value is added when a user joins the channel and is removed when the user leaves the channel. Each item is identified by Stable Participant ID mapping to the bare JID. This node is used to give administrator access to JIDs. This node MUST NOT be modified directly using pubsub. Only administrators can subscribe to this node. The JID Map node is a permanent node with one item per participant. Information is stored in a <participant/> element qualified by the 'urn:xmpp:mix:anon:0' namespace. The real JID is stored in a <jid/> child element of the <participant/> element.

Example 1. Value of JID Map Node

<items node='urn:xmpp:mix:nodes:jidmap'>
  <item id='123456'>
      <participant xmlns='urn:xmpp:mix:anon:0'>
         <jid>hecate@mix.shakespeare.example</jid>
      </participant>
  </item>
</items>

3.1 User Preferences and Additional Information

A channel MAY store user preferences and parameters with each user. A user JID visibility preference has the following values:

1. 'default'. In this setting, the channel default value will be used. This value is used if another value is not explicitly set. This means JID is visible for a JID Visible channel and JID is hidden for JID Hidden and JID Maybe Visible channels.
2. 'never'. If this is set, JID will never be shared and user will be removed from the channel if its mode changes to JID Visible.
3. 'always'. If this is set, JID will always be shared and users will be removed from the channel if its mode changes to JID Hidden.
4. 'prefer not'. If this is set, JID will only be shared if mode is JID Visible.

The user MAY specify that no Private Messages are to be sent from the channel, and allow vCard retrieval.

The user MAY specify that presence is not to be shared, which will prevent the MIX Channel from sending a presence probe for the user on channel start-up. The user will also choose to not include the MIX channel in the user's roster, so that presence will not be updated. Where the channel configuration sets 'Participants Must Provide Presence', this variable MUST be set to 'Share'.

The following table sets out the standardized user preference values. A MIX implementation MAY use other values.

When joining a channel, the client MAY specify one or more preference options as a Data Forms (XEP-0004) [2] form. In the response, the server MUST specify all of the user preferences supported by the server, with default values if the user has not requested a different value. The following example shows joining a channel and setting a preference. The following example shows the message sent from the user's server to the MIX channel, which will have been preceded by a message from the user's client to the user's server.

Example 2. User Joins a Channel and Specifies a preference

<iq type='set'
    from='hag66@shakespeare.example'
    to='coven@mix.shakespeare.example'
    id='E6E10350-76CF-40C6-B91B-1EA08C332FC7'>
    <join xmlns='urn:xmpp:mix:anon:0'>
    <subscribe node='urn:xmpp:mix:nodes:messages'/>
    <subscribe node='urn:xmpp:mix:nodes:presence'/>
    <x xmlns='jabber:x:data' type='submit'>
        <field var='FORM_TYPE' type='hidden'>
             <value>urn:xmpp:mix:anon:0</value>
        </field>
        <field var='JID Visibility'>
            <value>never</value>
        </field>
     </x>
  </join>
</iq>

The following example shows the result of a successful join, which also reports all the user preferences. This example shows the message coming from the MIX channel to the user's server, which will be sent on to the user.

Example 3. Channel Successfully Processes Join and returns the preferences set

<iq type='result'
    from='coven@mix.shakespeare.example'
    to='hag66@shakespeare.example'
    id='E6E10350-76CF-40C6-B91B-1EA08C332FC7'>
  <join xmlns='urn:xmpp:mix:anon:0' jid='hag66@shakespeare.example'>
    <subscribe node='urn:xmpp:mix:nodes:messages'/>
    <subscribe node='urn:xmpp:mix:nodes:presence'/>
    <x xmlns='jabber:x:data' type='result'>
      <field var='FORM_TYPE' type='hidden'>
        <value>urn:xmpp:mix:anon:0</value>
      </field>
      <field var='JID Visibility'>
        <value>never</value>
      </field>
      <field var='Private Messages'>
        <value>allow</value>
      </field>
      <field var='vCard'>
        <value>block</value>
      </field>
    </x>
  </join>
</iq>

The client MAY also query the channel in order to find out which user preferences are supported and the options available. This will allow users to set options not specified in the standard, by providing a form template in the result. The request is encoded as a <user-preference/> child element of <iq/>. <user-preference/> is qualified by the 'urn:xmpp:mix:anon:0' namespace. The result is encoded as a form child element in the <user-preference/> element.

Example 4. User Requests and Recieves Preferences Template Form

<iq type='get'
    from='hag66@shakespeare.example/UUID-a1j/7533'
    to='coven@mix.shakespeare.example'
    id='E6E10350-76CF-40C6-B91B-1EA08C332FC7'>
    <user-preference xmlns='urn:xmpp:mix:anon:0'/>
</iq>

<iq type='result'
    from='coven@mix.shakespeare.example'
    to='hag66@shakespeare.example/UUID-a1j/7533'
    id='E6E10350-76CF-40C6-B91B-1EA08C332FC7'>
    <user-preference xmlns='urn:xmpp:mix:anon:0'>
    <x xmlns='jabber:x:data' type='form'>
      <field var='FORM_TYPE' type='hidden'>
        <value>urn:xmpp:mix:anon:0</value>
     </field>
     <field type='list-single' label='Preference for JID Visibility
            var='JID Visibility'>
        <option label='JID Never Shown'><value>Never</value></option>
        <option label='Default Behaviour'
        <value>default</value></option>
          <option label='Try not to show JID'>
            <value>prefer not</value></option>
     </field>
     <field type='list-single' label='Example Custom Preference'
            var='Custom Preference'>
        <option label='One Option'><value>a</value></option>
        <option label='Another Option'><value>b</value></option>
      </field>
    </x>
  </user-preference>
</iq>

A user MAY modify preferences using the corresponding set operation. The set MAY specify values for some or all attributes. All attributes are returned in the result.

Example 5. User Updates Preferences

<iq type='set'
    from='hag66@shakespeare.example/UUID-a1j/7533'
    to='coven@mix.shakespeare.example'
    id='E6E10350-76CF-40C6-B91B-1EA08C332FC7'>
    <user-preference xmlns='urn:xmpp:mix:anon:0'/>
     <x xmlns='jabber:x:data' type='submit'>
        <field var='FORM_TYPE' type='hidden'>
             <value>urn:xmpp:mix:anon:0</value>
        </field>
        <field var='JID Visibility'>
            <value>never</value>
        </field>
        <field var='Private Messages'>
           <value>allow</value>
         </field>
        <field var='vCard'>
          <value>block</value>
         </field>
     </x>
</iq>

<iq type='result'
    from='coven@mix.shakespeare.example'
    to='hag66@shakespeare.example/UUID-a1j/7533'
    id='E6E10350-76CF-40C6-B91B-1EA08C332FC7'>
    <user-preference xmlns='urn:xmpp:mix:anon:0'>
    <x xmlns='jabber:x:data' type='result'>
        <field var='FORM_TYPE' type='hidden'>
             <value>urn:xmpp:mix:anon:0</value>
        </field>
        <field var='JID Visibility'>
            <value>never</value>
        </field>
        <field var='Private Messages'>
           <value>allow</value>
         </field>
        <field var='vCard'>
          <value>block</value>
         </field>
     </x>
  </user-preference>
</iq>

3.2 Sending Private Messages

Private Messages are used to provide communication with another channel participant through the MIX channel, where the initiating user does not know the real JID of the channel participant. A message is addressed to the channel using the encoded JID of the client to which the message is being sent. This is shown in the following example.

Example 6. User Sends a Private Message

<message from='hag66@shakespeare.example/UUID-a1j/7533'
         to='444456#coven@mix.shakespeare.example/4588'
         id='92vax143g'>
  <body>Private meeting about Macbeth???</body>
</message>

The MIX channel will then process the message, to send to the real JID of the recipient. An encoded JID is used to identify the message sender.

Example 7. MIX Channel Sends Private Message to Recipient

<message from='123456#coven@mix.shakespeare.example/9988'
         to='hag99@shakespeare.example/UUID-a1j/7533'
         id='92vax143g'>
  <body>Private meeting about Macbeth???</body>
</message>

Private Messages MAY be archived using MAM by the XMPP servers associated with initiator and responder. Private Messages MUST NOT be archived by the MIX channel.

Kevin Smith

Email: kevin.smith@isode.com
JabberID: kevin.smith@isode.com

Steve Kille

Email: steve.kille@isode.com
JabberID: steve.kille@isode.com

Copyright

Permissions

Disclaimer of Warranty

Limitation of Liability

IPR Conformance

1. XEP-0369: Mediated Information eXchange (MIX) <https://xmpp.org/extensions/xep-0369.html>.

2. XEP-0004: Data Forms <https://xmpp.org/extensions/xep-0004.html>.

Version 0.2.0 (2018-06-05)

Version 0.1.0 (2018-05-21)