请问HN：哪些Jabber客户端支持SCRAM+和XEP-0474？
与这个主题相关的[1]，哪些Jabber客户端不仅在中间使用有效证书时检测到中间人攻击（MitM）篡改，而且该证书并不是服务器上的证书，这意味着某个实体获得了一个证书，并利用它进行中间人攻击，客户端不仅拒绝这个替代的有效证书，还会提醒用户存在中间人攻击。XEP-0474 SASL SCRAM 降级保护 <i>(实验性)</i> [2]，Claude似乎并不知道，我也找不到任何澄清的文档，只有很多未解决的问题。
这篇文章的目的是关于端到端加密（E2EE），但我想建议一些客户端，它们能够以一种用户无法意外忽视的方式警告中间人攻击篡改。<i>即：用户不能仅仅点击通过警告</i>。
在服务器端，eJabberd和Prosody似乎是唯一支持XEP-0474的服务器守护进程，但我就是找不到一个明确的支持客户端列表，即使它们处于实验阶段。<i>它们可能支持SCRAM+，但在使用有效证书时不会警告篡改。</i>
我对大型语言模型（LLM）的回答不感兴趣。LLM似乎并不知道答案，而是给出了官方立场，称XEP-0474是实验性的，这对那些希望进行实验的人没有任何价值。
[1] - https://news.ycombinator.com/item?id=37955264
[2] - https://xmpp.org/extensions/xep-0474.html
查看原文
Related to this thread [1] which Jabber clients not only detect MitM tampering when a valid cert is used in the middle but is not the cert on the server, meaning an entity obtained a certificate, used it to MitM the connection and the client not only rejects this alternate valid certificate but also alerts the user to the MitM. XEP-0474 SASL SCRAM Downgrade Protection <i>(Experimental)</i> [2] Claude does not seem to know and I can't find any clarifying documentation, just lots of open issues.<p>The purpose is for writing an article on E2EE but I want to suggest clients that will alert on MitM tampering in a manor the person using the client can not accidentally ignore it. <i>i.e. just click through a warning</i><p>On the server side eJabberd and Prosody appear to be the only server daemons supporting XEP-0474 but I just can't find a definitive list of supported clients even if they are in the experimental phase. <i>they may support SCRAM+ but do not alert on tampering using a valid cert.</i><p>I am not interested in an LLM answer. LLM's do not appear to know the answer and instead give the official stance that XEP-0474 is experimental which holds no value for those wishing to experiment.<p>[1] - https://news.ycombinator.com/item?id=37955264<p>[2] - https://xmpp.org/extensions/xep-0474.html