Monal Blog

Moved

2011-03-26T14:24:00.002-04:00

Monal is a free chat program for iPhone and iPad. The official site has moved to Monal.im

Monal 2.0.3 Submitted

2011-03-10T02:03:00.002-05:00

Monal 2.0.3 has been submitted to the app store. Below is the slightly changed final change log. Along with 2.0.3 I am launching the new Monal site found at Monal.im . The new site is designed to be more descriptive for new users, allow for better social media integration and bug tracking. In addition I have started to build a detailed and illustrated help section. The first post explains how to use group chat

Followers of this development blog should go to the new one

Monal 2.0.3 changelog:

1. Proper multi tasking. It will run in the background
until you logout or close the app. No more 10 minute limit.
2. Manually set XMPP priority
3. Shows offline contacts
4. Added gtalk extensions for google apps
5. fixed an issue with Digest-Md5 servers and connectivity
6. Fixed a bug with some non english messages not arriving
7. improved auto recovery in the event of a network error
8. when swiping to close an active chat it says "close" instead of delete. When clearing a chat log it says "clear" and not delete
9. improved UI for adding new contact
10. shows a badge with a count of messages received on app icon
11. status is not overwritten when setting away
12. fixed misc crashing bugs with the UI
13. new buddy details screen
14 optimized and switched from GCC to LLVM+Clang compiler
15. Added Multi user chat (MUC) menus.
16. Removed browser tab from iPad UI

This blog is closing

2011-03-08T11:07:00.002-05:00

This blog is closing. I have decided to upgrade to a proper site to better meet the needs of the massive global user base that Monal has garnered. Certain things such as help pages and bug tracking systems have become necessary. The new site is a massive improvement and will launch with the release of Monal 2.0.3. I will make one more post here later this week with a link to the new site.

Oh one more thing, you can now actively join as many groups as you like on any server that supports it (Monal will discover the service)

2.0.3 Final Change Log

2011-02-27T01:25:00.003-05:00

2.0.3 is a major update that improves the application significantly. It is now feature complete and is being beta tested. This is the final change log. It's scheduled to be released early March.

1. Proper multi tasking. It will run in the background

forever until you logout or close the app. No more 10 minute limit.

2. Manually set XMPP priority

3. Shows offline contacts

4. Added gtalk extensions for google apps

5. fixed an issue with Digest-Md5 servers and connectivity

6. Fixed a bug with some non english messages not arriving

7. improved auto recovery in the event of a network error

8. when swiping to close an active chat it says "close" instead of delete. When clearing a chat log it says "clear" and not delete

9. improved UI for adding new contact

10. shows a badge with a count of messages received

11. status is not overwritten when setting away

2.0.3 changelog

2011-02-14T23:27:00.002-05:00

Winter break is over and I am updating Monal again. The next release will be a pretty big update. I am sure many people will appreciate #1 on this list. Obviously, this is only for iOS4 users on 3GS and above.

1. Proper multi tasking. It will run in the background forever until you logout or close the app. No more 10 minute limit.

2. fixed an issue with Digest-Md5 servers and connectivity

3. improved auto recovery in the event of a network error

4. when swiping to close a chat it says "close" instead of delete. when clearing a chat log it says "clear" and not delete

A shameless plug

2010-12-18T01:30:00.000-05:00

I recently released my second iPhone/iPad app. It has absolutely nothing in common with Monal. The program is called MyNepali and uses sounds and images to teach young children some basic animal names in the Nepali language. It is 99 cents. If you are interested, you can find MyNepali here
http://itunes.apple.com/us/app/mynepali/id406911355?mt=8

And we're back

2010-12-14T00:43:00.000-05:00

I have no idea what happened. The email account that was used to create this blog was listed among the 1.3 million accounts taken from Gawker hack on Sunday. While my account password was not there, I did get locked out of Gmail because of suspicious activity, likely thousands of failed login attempts from all over the world. I assume this blog was taken down for the same reason. This was annoying but could have been much worse, I could have been stupid and used the same password for my Gawker account and my email account.

The Gawker hack is one more reminder of why trusting some third party with your Gmail, Facebook or corporate login is a bad idea. While push messages are really nice, are you sure that the database that has your username and password is secure? Do you trust the company making your IM client with all of that info?

A note on privacy and tracking software

2010-12-11T16:16:00.001-05:00

How many people use Monal? A lot. Thousands and thousands of people all over the world in all sorts of random places (Hello, Antarctica!). However, all I know is what the Apple download/upload counter shows and what people tell me in emails. Much the same way I have objections to ads in my software, I do not like the "metrics" software and libraries that are out there. Unlike many other iOS apps, Monal does not contain and will never contain user tracking software. Consider this app your refuge from ads, trackers and middle man servers.

2.0.2 changelog

2010-11-28T16:54:00.000-05:00

This is a bug fix update that addresses issues users have raised. I have tried to have one release roughly every month, there will be no January release. Unless there is a major issue in this release the next release will be in February.

1. fixed a bug where some people might not show up as online sometimes
2. fixed bug where away was not working
3. added status orbs
4. fixed bug adding accounts
5. several ipad ui improvements
6. SECURITY: fixed possible XSS attack
7. active chats count update properly
8. Misc connectivity bugfixes

Always free, no ads, no creepy servers

2010-11-02T12:36:00.004-04:00

A lot of people have told me about being willing to see ads to support development. I actually really dislike ads and all the apps that I have used that had ads were slowed down by them. I also notice that certain other IM clients released versions without ads and then pushed updates with them after the user base grew. I find that to be a rather deceptive bait and switch particularly since I know that the ad services collect and use user data --possibly based on your chats-- to present more ads. It is behavior like this, the 3rd party account sign up nonsense and the lack of direct connections that prompted me to write Monal in the first place.

There will always be a free version of Monal, it will always support direct connections and it won't have ads.

2.0.1 bugfixes

2010-10-18T00:15:00.002-04:00

I am pushing out a quick bugfix update to fix some issues people have told me about.

1. removes a lock up when user disconnects while chatting
2. added a progress indicator to show when large chats are loaded
3. fixed a compatibility bug with some ejabberd servers
4. fixed failure to load on some devices
5. added timeouts on connection to better detect errors
6. fixed the issue where sometimes the login window spins forever

Jabberd and Monal 2

2010-10-11T09:57:00.002-04:00

I am receiving a few reports of issues connecting to some Jabberd servers. I haven't been able to replicate this on any of my test installs. If anyone has access to a server that is not working with Monal and can give me a test account to work with, email me.

Monal 2.0 is out

2010-10-09T13:03:00.000-04:00

The new release is now available for download in the app store. If you encounter any bugs, please email me at monaltest@gmail.com

Monal 2.0 iPad screen dump

2010-10-04T11:33:00.002-04:00

Monal 2.0 iphone screen dump

2010-10-04T11:32:00.001-04:00

While we are waiting for the new version to be approved, here are final screens for the iphone app's page

back on track

2010-10-03T23:36:00.001-04:00

I hope to have a new build sent to the app store on Monday

Delayed!

2010-09-30T22:14:00.001-04:00

A beta tester just found a rather serious bug that I need to check. I've pulled the binary and the release will be pushed into next week so I can look at this.

Monal 1.07 is now 2.0 and other updates

2010-09-29T14:27:00.001-04:00

Monal has been submitted to the app store for approval. Don't be alarmed when you see Monal 2.0 show up on your application list. It is what was 1.07. I had to increase the version number to 2.0 because for some reason the application loader couldn't tell that 1.07 was greater than 1.062 and refused to allow me to upload an "older" version. It should be approved in a few days. While, this isn't how I wanted 2.0 to be released, it is the biggest update to the software since it came out and it has been over a year since 1.0, so it's not that bad.

I have also added Monal to the business category in addition to social networking because of the cisco webex connect support. The minimum iOS version has been changed to 3.1.2 from 3.1.3. Finally, the application rating has been changed to 17+ since it includes a web browser.

Monal 1.07 feature complete

2010-09-23T00:39:00.003-04:00

Monal 1.07 is feature complete and is about to complete testing. Release candidate 1 was sent out to testers today. If no issues arise this will be the build submitted to the app store.

This is the final changelog of what to expect. In addition to the graphical overhaul, the other major change that will affect many people is support for group chat.

1.07 changelog

This is a major update that significantly changes the front and backends of the program.

1. Stops crash on load on iphone 3g and fixed many other bugs

2. faster start up and much more efficient login code (3-4x faster)

3. fixed bug where chat input box was disabled after viewing logs

4. urls in chat are detected and can be tapped to bring up safari when there is multi tasking or in app when there isn't.

5. Added a logoff button for easy logoff without closing app

6. contacts listed in alphabetical order, own username not shown

7. support for xmpp tunes, option to set status as currently playing ipod song

8. New ipad UI autorotates to all orientations, supports landscape

9. new lighter, faster and more accurate XMPP parsing engine

10. xmpp uses JID for setup

11. UI improvements for consistency

12. new sliding notification when a message is received or song changes

13. status updates are immediately seen

14. added a simple web browser for non multi tasking OSes

15. Icons update correctly when buddy changes it

16. added an active chats tab to access current conversations easily

17. added DNS SRV record discovery. this enables cisco webexconnect support in addition to greater compatibility overall.

18. added support for group chat

19. added support for itunes file transfer

Cisco Webex connect support

2010-09-16T12:29:00.003-04:00

I can confirm that the next version of the client connects to cisco webex connect XMPP servers. There are still a few quirks that I intend to iron out, but basic the functionality is working.

Edit 4/13/2011 :
you can find instructions on the new monal site's help page for webex

http://monal.im/help/cisco-webex/

DNS service discovery, priorities and Cisco Webex

2010-09-13T01:10:00.006-04:00

It's not everyday I learn about something totally new. I learned today that XMPP uses SRV records in the DNS to correctly determine the highest priority server and port to use. I have now added XMPP DNS service discovery. This improves compatibility with servers across the board and in theory it should also enable connections to Cisco WebEx XMPP servers -- something several people have asked about. I will write back with confirmation.

See debug logs below:

Gtalk:

Cisco:

1.07 changelog so far

2010-09-12T11:16:00.002-04:00

Development and testing on 1.07 is almost complete. This is the near final changelog. The one more addition to this will be multi user chat support.

1. Stops crash on load on iphone 3g.
2. faster start up and much more efficient login code (3-4x faster)
3. fixed bug where chat input box was disabled after viewing logs
4. urls in chat are detected and can be tapped to bring up safari when there is multi tasking or in app when there isn't.
5. Added a logoff button for easy logoff without closing app
6. contacts listed in alphabetical order, own username not shown
7. support for xmpp tunes, option to set status as currently playing ipod song
8. New ipad UI autorotates to all orientations, supports landscape
9. new lighter, faster and more accurate XMPP parsing engine
10. xmpp uses JID for setup
11. UI improvements for consistency
12. new sliding notification when a message is received or song changes
13. status updates are immediately seen
14. added a simple web browser for non multi tasking OSes
15. Icons update correctly when buddy changes it
16. added an active chats tab to access current conversations easily

Multi user chat

2010-09-06T15:59:00.000-04:00

The next release will support joining multi user chats.

Monal 1.07 Private Beta

2010-09-04T00:11:00.003-04:00

I am ready to begin beta testing the next release of Monal. I am interested in making sure Monal works with as wide a range of XMPP servers as possible. If you are interested in joining the beta please email monaltest@gmail.com with the subject : Monal 1.07 private beta .

In your email please include the following information:

1. if are you using gmail, facebook or some other server.
2. if you are using some other server do you know what it is (openfire, ejabberd etc)
3. what device (s) you use iPad, iphone 3g, ipod touch etc.
4. what ios version you use
5. your device UDID ( http://www.tuaw.com/2008/08/08/iphone-101-find-udid-with-a-single-click/ )
6. what country you are in

In App Browser

2010-09-03T00:12:00.000-04:00

For users of older iPhone and iPads that do not have multi tasking, I have added a simple in-app web browser. This is under the more menu and takes up no additional resources since it uses the same message rendering engine. Its not safari but it should let you do other stuff while still receiving messages

iPads

2010-08-29T11:41:00.000-04:00

The next release will have much better iPad support.

More Changes: Meet The Slider

2010-08-22T22:07:00.005-04:00

Monal now has the option to tap into itunes and use a neat little notification system. The black translucent overlay box slides in from the bottom and works like growl on OSX. Here are some preliminary shots. I plan on showing the song art/buddy icon and letting you tap on them to go to the incoming message.

XMPP Feature list

2010-08-21T01:47:00.006-04:00

This page has been moved to

http://monal.im/topics/features/

Changes

2010-08-21T01:09:00.001-04:00

I am improving the UI and trying to make it more intuitive while incorporating your feedback. The next release will look and behave different in a few ways. Here are some of them

JIDs:

Use of sliders instead of alert windows:

Can run in any orientation on the ipad

An explicit logout button

How to contact me

2010-08-20T16:28:00.000-04:00

If you need to contact me regarding Monal please email monaltest@gmail.com. You can also add me on gtalk or as a contact on your own jabber server.

More updates

2010-08-18T01:29:00.002-04:00

I've been overhauling the system to make it faster and more stable. It is noticeably better now. This is the current change log

1. Stops crash on load on iphone 3g.
2. faster start up and much more efficient login code (3-4x faster)
3. fixed bug where chat input box was disabled after viewing logs
4. urls in chat are detected and can be tapped to bring up safari
5. Added a logoff button for easy logoff without closing app
6. contacts listed in alphabetical order, own username not shown
7. support for xmpp tunes, option to set status as currently playing ipod song

iPhone 3G crash issue

2010-08-08T18:39:00.000-04:00

I have been testing more heavily on iPhone 3G iOS4 and have discovered the cause of the crash on load issue that many users have described. It has now been fixed. Bugs fixed so far for the next release:

1. Stops crash on load on iphone 3g.
2. sped up application start to prevent time out (crash) on load
3. fixed bug where input box was disabled after viewing logs

1.062 is in the store

2010-07-31T22:53:00.001-04:00

Use this thread to tell me about any issues you may have, questions or comments. I use this feed back to improve subsequent releases. Thanks.

1.062 pushed out

2010-07-23T00:04:00.000-04:00

Because I have been too busy to complete all the features I planned on having in 1.07, I have pushed out 1.062 with many of the bug fixes and user recommendations. It should be in the app store in a few days. this is the final change log:

1. removed unnecessaty XMPP commands (chatstates, pings) to reduce CPU/battery load
2. xmpp keep alive increased to 4 minutes to reduce network/battery usage
3. fixed bug where there was no vibration or ring when messages arrived
4. made the idle logout notification only if an account is active
5. background idle logout notification may be turned off
6. fixed bug where disabling the account didn't disconnect it
7. chat log: no duplicate names, names sorted in alphabetical order, own username no longer shown

crashes and 1.07 changes so far

2010-07-03T00:24:00.002-04:00

these are the changes coming in 1.07 so far. I will fix things as i become aware of them. Some people still report ipad crashes. Please sync your ipads to itunes so Apple sends me the crash log and i can see whats going on. I havent been able to replicate them. Could someone still experiencing this problem try deleting the app and reinstalling it.

1. fixed bug where there was no vibration or ring when messages arrived
2. made the idle logout notification only if an account is active
3. background idle logout notification may be turned off
4. xmpp keep alive increased to 4 minutes to reduce network usage

5. fixed bug where disabling the account didn't disconnect it

1.06 bugs, IPad and 1.061

2010-06-22T15:40:00.001-04:00

1.06 with multi tasking is on the itunes store. I made a mistake with the compile process and 1.06 will crash on immediately on iPads since they still run OS3. I have pushed out 1.061 which fixes this issue for iPad users.

Use the comments on this post to tell me about problems you have experienced anything else you might need to ask/tell me.

How background works in iOS4

2010-06-14T12:02:00.001-04:00

Background Apps
iOS4 has several classes of background apps. Unfortunately, IM is not one of those classes. The classes that do exist are for essentially for voip (network socket maintenance), audio (audio processing) and location services (full multi tasking) . Having run Monal in the background for a few weeks and seen the battery life, I now understand why Apple has done this. You are always aware of and interacting in some way with all of the classes of background apps allowed. You are either making a voip call, listening to audio or using the GPS navigation. At no time do any of these background apps run with the user not aware of it. IM on the other hand is expected to run at all times. It runs silently in the background, using the cpu , keeping a connection open and generally draining the battery. It is entirely possible for someone to run an IM app, not be aware it is running and then begin to wonder why the battery only lasts a couple of hours. I have seen this happen time and again to android users. Power users may be able to use the task manager to kill processes, but that is unreasonable for a mass market product.

How Monal Works
All of that being said, Monal does run in the background and the way it does it should satisfy the needs of most users. Monal runs in the background for 10 minutes. After 5 minutes of idle time, it will push a notification that only 5 more minutes of background time remain. After 10 minutes, the program will logout and suspend itself. A suspended program is not a drain on the battery. If at any point in the 10 minutes you bring Monal back to the foreground, the clock will be reset for a fresh 10.

When Monal is running in the background, it will push notifications to the user when messages are received. The user will view/reply to the message and thus continuously reset the 10 minute clock.

I think the typical user would sign in and move Monal to the background and do other things. They either send and receive messages and continuously reset the 10 minute clock or at 5 minutes are asked to renew it for another 10 minutes by brining Monal the the foreground once. This prevents the scenario where someone signs in and forgets to sign out, locks the phone and then completely drains the battery.

What if someone wants to stay signed in while the phone is idle ?
If you want to remain signed in while not using the phone, move Monal to the foreground before locking the phone. If you do this you will always be signed in and will receive notifications for all messages. When you want to use the phone again you can move it to the background and renew the 10 min lease periodically.

Background apps

2010-06-03T22:32:00.000-04:00

Monal runs in the background now. When you go to another program, it will continue to remain connected using Apple's battery saving background processes. If you receive a message while in the background, you will see a pop up that looks like a push notification with the message. It will also popup a push notification if you have the home screen locked.

Monal 1.06 with multi tasking will be released as soon as Apple releases the official SDK (expected to be

June 7th )

1.05 Approved

2010-06-03T00:01:00.001-04:00

Monal 1.05 has been approved and is in the app store. Grab it for your iPad and iPhones

Crazy stuff

2010-05-30T01:08:00.000-04:00

OS4 is a blast to work with and I have gotten it to do some really crazy stuff to have Monal run seamlessly in the background. Hopefully these aren't bugs in the beta and Apple will allow it.

Final Change log for 1.05

2010-05-23T12:59:00.000-04:00

These are the changes in 1.05. This will be the final 3.x release. This should show up in iTunes soon. I have already started programming for the multi tasking in 4.x . The next release will be a huge update and will drop as soon as 4.0 is released.

1.05 changelog

1. fixed all bugs from crash logs, made some speed improvements
2. removed the confusing chat logs window edit button
3. fixed bug where names of users signing in sometimes showed up in other chats
4. opening conversation shows last 10 not 20 messages (faster load)
5. the input box now allows multiple line input and expands when tapped on
6. input box does not delete unsent messages when tapping outside of the box
7. Graphical emoticons in chat
8. added a basic iPad interface
9. Added button to quickly clear all conversation logs

Ipads

2010-05-22T18:57:00.000-04:00

The iPhone Monal app already works on the iPad and I see from the crash logs that there are quite a few of you using it. The next release will be a universal application that takes advantage of the added space. The native iPad version doesnt look much different right now, I'm still learning all the new features. It's a start.

Emoticons

2010-05-22T16:34:00.002-04:00

Sorry it too so long.

Multi tasking.

2010-05-22T13:34:00.003-04:00

Monal runs in the background for a while on OS4. You should be able to switch back and forth between chat and other programs.

1.05 in the works

2010-05-22T13:16:00.002-04:00

1.05 moving along well. Here is the change log so far for the next release.

1.05 changelog

1. fixed all bugs from crash logs
2. removed the confusing chat log edit button
3. fixed bug where names of users signing in sometimes showed up in other chats
4. opening conversation shows last 10 not 20 messages (faster load)
5. the input box now allows multiple line input and expands when tapped on
6. input box does not delete unsent messages when tapping outside of the box

Happy Birthday Monal

2010-05-21T11:07:00.001-04:00

It's been a whole year since the initial 1.0 release of Monal (then called SworIM) was pushed out to the app store. Thank you all for the feedback, testing and generally helping me improve the software.

It's come a long way in the past year and is going to keep improving in 2010.

A year ago:

Today:

Iphone OS4 And More Server Support

2010-05-04T22:17:00.001-04:00

I can confirm that Monal 1.04 works fine in OS4. While it doesn't fall under the class of programs allowed to multi task, I am planning on adding fast switch and task completion which should hopefully allow you to switch between programs quickly without losing your connection.

Work on Monal 1.05 will resume this week. Before OS4 comes out I want to get another version out that is focused on bug fixes and server compatibility. If you are aware of public servers that do not work, let me know in the comments section. If it is a private server and you can give me access to test, contact me at anurodhp@SPAM.gmail.com (remove the spam) with instructions. I will make sure it works in the next release.

1.04 getting pushed out

2010-02-16T11:50:00.000-05:00

I am about to push out 1.04 here is the final changelog

1.04 changelog

1. added support for SSL on port 5222 (New style) (XMPP)
2. added support for digest md5 authentication mechanism (XMPP)
3. added support facebook chat (XMPP)
4. added basic support for AOL Instant Messenger (AIM)
5. uses the contact's full name from vCard if available instead of username (XMPP)
6. opening a conversation shows the last 20 messages not 30. speeds up loading
7. added network activity indicator on top bar
8. fixed bug where some offline messages were being ignored
9. fixed several crashing bugs
10. fixed random disconnect/reconnect issue
11. modified message theme to have less image loading and better space use
12. tested with jabberd2 servers

There is a new screen shot to go along with this of course

How weak is Facebook's XMPP security?

2010-02-15T16:08:00.004-05:00

As I mentioned earlier, Facebook does not use SSL on their new XMPP server. All of their security is based on an algorithm called Digest-Md5. As the name says this is based on the popular MD5 hashing algorithm that is no longer considered secure. From Facebook:

Does Facebook Chat support SSL?

No. At this time, Facebook Chat does not support SSL.

Does Facebook Chat use plaintext authentication?
No. Facebook Chat uses DIGEST-MD5 during authentication.

Are my Chat messages encrypted?
No. However, authentication information is secured using DIGEST-MD5.

Regarding MD5:
US-CERT, the US Department of Homeland Security's Computer Emergency Readiness Team, says:

"Do not use the MD5 algorithm"
"Software developers, Certification Authorities, website owners, and users should avoid using the MD5 algorithm in any capacity. As previous research has demonstrated, it should be considered cryptographically broken and unsuitable for further use."
"Scrutinize SSL certificates signed by certificates using the MD5 algorithm"
"Users may wish to manually analyze the properties of web site certificates (...) Certificates listed as md5RSA or similar are affected. Such certificates that include strange or suspicious fields or other anomalies may be fraudulent. Because there are no reliable signs of tampering it must be noted that this workaround is error-prone and impractical for most users."

No SSL:
What happens when you don't use SSL for your chat? People sniffing the network can see what you are saying. This is very simple to do.
Either use tcpdump from the command line (works on Mac,linux etc) or grab a packet sniffer like wireshark . I would recommend wireshark anyway because it makes the next part even easier. If you used tcp dump, this you would have something like this

sudo tcpdump -i en0 -s500 -w ~/Desktop/DumpFile01.pcap -vv

Lets say you have a network dump somehow and you open up wire shark. set it to filter jabber and you will start to see something like this. I've highlighted a message packet so you can see that I was able to read this message someone sent.

Now everything sent on the network can be read and the password "security" is based on MD5 right? behold a captured password sequence:
cmVhbG09ImNoYXQuZmFjZWJvb2suY29tIixub25jZT0iNjdFRDdCQTg3NjgwN0MyOEIzQUI2RkE2MzRGQTE2MDUiLHFvcD0iYXV0aCIsY2hhcnNldD11dGYtOCxhbGdvcml0aG09bWQ1LXNlc3M=

this decodes from base64 to:
realm="chat.facebook.com",nonce="67ED7BA876807C28B3AB6FA634FA1605",qop="auth",charset=utf-8,algorithm=md5-sess

Excellent we have some information. The client replied with:

dXNlcm5hbWU9InNvbWVvbmUiLHJlYWxtPSJjaGF0LmZhY2Vib29rLmNvbSIsbm9uY2U9IjY3RUQ3QkE4NzY4MDdDMjhCM0FCNkZBNjM0RkExNjA1Iixjbm9uY2U9ImQzM2M4ODYyMTI2NjI2NTYzNzcxMDk3YjcwIixuYz0wMDAwMDAwMSxxb3A9YXV0aCxkaWdlc3QtdXJpPSJ4bXBwL2NoYXQuZmFjZWJvb2suY29tIixyZXNwb25zZT01MjBhMjdiOWRjOTE5NWRjMTJjNTVjZGY4MTUyOWI2MixjaGFyc2V0PXV0Zi04

this decodes from base64 to:

username="someone",realm="chat.facebook.com",nonce="67ED7BA876807C28B3AB6FA634FA1605",cnonce="d33c8862126626563771097b70",nc=00000001,qop=auth,digest-uri="xmpp/chat.facebook.com",response=520a27b9dc9195dc12c55cdf81529b62,charset=utf-8

Nonce and cnonce are used to calculate the encrypted "response". This is where the password is. nonce and cnonce are really there for one time use to prevent a replay attack.

What do we know now?

password hash: 520a27b9dc9195dc12c55cdf81529b62
nonce: 67ED7BA876807C28B3AB6FA634FA1605
cnonc: d33c8862126626563771097b70
qpop: auth
nc: 00000001

password hash is based on a series of md5 hashes:
first hash (X) is of username:realm:password
we know this to be = someone:chat.facebook.com: (password)
Next hash (Y) is X:nonce:cnonce
we know this to be: (password hash): 67ED7BA876807C28B3AB6FA634FA1605: d33c8862126626563771097b70

Next hash (Z) fully known to be of AUTHENTICATE:xmpp/chat.facebook.com

Final hash is the response value, which is also known and we know it is in the form:
Y:nonce:nc:cnonce:qop:Z

we fully know Z, nonce, cnonce, qpop, nc

The only thing missing here is Y, which is dependent on X, which is just an unsalted MD5 hash based on a password. How would you crack this? There are a few ways, but the simplest in most cases is just to use rainbow tables but compute the hash 2 times more using the other parts of the string from above and see if it matches the response. I'm going to stop the explanation here for obvious reasons. More info on rainbow tables here:

http://www.freerainbowtables.com/
http://en.wikipedia.org/wiki/Rainbow_table

There is also the possibility of finding another string that will create the same password hash. This is called a hash collision. In this case, the attacker doesn't even need to know the actual password. They can just use this other string in its place and access an account just the same.

If the person is using a short or insecure password a dedicated attacker (identity thieves, spammers etc) should have it cracked easily and since the packet was captured, the attacker can test against the password as much as he likes on his own machine.

New optimized space icon

2010-02-14T20:54:00.001-05:00

I've implemented the full stockholm theme now, each message from a user does not load the icon and colored bar all over again. This leads to dramatically faster loading of chat windows and much better use of space. Compare below to what we had before.

The biggest improvement is in landscape mode with the keyboard on. You can now see up to 5 lines above the keyboard and the input box.

old landscape in 1.03

1.04 will support Digest-Md5 and Facebook

2010-02-14T00:56:00.002-05:00

I have added Digest-Md5 support to Monal and it will be in 1.04 . I added this because it is what Facebook uses. I will have a Facebook preset in Monal with all of the server settings in 1.04. Hopefully facebook will fix the lack of SSL by then as well. It also looks like I need to support aliases. Facebook chat is unusable and confusing without it.

Monal supports AIM

2010-02-13T00:58:00.000-05:00

As I have said from the beginning, Monal will be a multi protocol instant messenger client. Something to look for in 1.04

Monal mentioned on Cnet podcast

2010-02-12T23:45:00.000-05:00

There is a mention of Monal and the Facebook XMPP security hole on today's Buzz Out Loud podcast. You can hear it at 35:45 mark.
Listen to it here:
http://www.cnet.com/8301-19709_1-10452774-10.html

People have also voted up the SSL bug on the Facebook developers site.

Warning on Facebook XMPP

2010-02-12T00:10:00.003-05:00

I just finished looking at the new Facebook XMPP server. I strongly recommend against using it.

This is probably one of the worst implementations ever. The chat does not use SSL encryption unlike almost every other server. Better yet, they decided to use an authentication scheme called Digest-MD5, which aside from having varying implementations and compatibility problems was DEPRECATED by the IETF in January 2009 ( https://tools.ietf.org/html/draft-ietf-sasl-digest-to-historic ) because it can be cracked. Facebook has just opened up a gaping hole in their security. Someone at facebook needs to be fired.

The link above explains many of the problems with Digest-MD5 but this is the best one.
  8. The cryptographic primitives in DIGEST-MD5 are not up to today's
      standards, in particular:

      A. The MD5 hash is sufficiently weak to make a brute force
          attack on DIGEST-MD5 easy with common hardware.

      B. Using the RC4 algorithm for the security layer without
          discarding the initial key stream output is prone to attack.

Facebook and 1.03

2010-02-11T23:18:00.000-05:00

Monal 1.03 has been released into the wild. Grab it from itunes. As mentioned earlier, this version has the improved landscape and support for self signed SSL certificates.

I just found out that Facebook added support for XMPP chat. Oddly, it uses the deprecated Digest-Md5 authentication and no SSL. Because digest-md5 was deprecated and sasl plain over SSL was the defacto standard, I never bothered implementing it. I guess I have to do it now.

Improving SSL in 1.04 (works on 5222)

2010-02-10T19:32:00.002-05:00

This is probably one of the most requested features. SSL now works on port 5222 using the "new style" SSL connection that uses the StartTLS command. It isn't 100% reliable yet, which is why it wasn't pushed out in yesterday's 1.03 but it will definitely be in 1.04. This combined with support the support for unsigned SSL certificates already in 1.03 should satisfy almost everyone.

1.03 submitted

2010-02-09T00:31:00.000-05:00

Its only been a few days since 1.02 was released, but I think I've gotten enough feed back to push out a quick 1.03 update. The improved landscape and SSL support should make the application much more usable and I saw no reason to sit on it. Expect 1.03 by the end of the week.

The full changelog below. I am also going to update the FAQ to clarify that 1.03 supports self signed certificates.

1. Self signed SSL certificates now work
2. removed non public API used
3. improved xmpp support
4. message send failure is treated as a disconnection and handled automatically
5. navigation bar and status bar now disappear in landscape mode
6. scroll to the newest message when first going into a chat now
7. adjusted brightness of icon so it isnt so dark

Improving SSL in 1.03

2010-02-08T23:27:00.000-05:00

There has been some criticism on the itunes store about the lack of support for self signed certificates when using SSL. 1.03 now supports self signed certificates.

Improving landscape in 1.03

2010-02-06T22:45:00.000-05:00

A user pointed out to me that the old landscape mode had lots of wasted space at the top. In 1.03, when the phone goes to landscape, the navigation bar and status bar disappear. This recovers that space and when using a keyboard, much more can be seen on top.

Monal 1.02 Approved

2010-02-05T14:40:00.002-05:00

You can grab the newest version on the iTunes store now.

Don't forget to rate in itunes and Digg!

Monal 1.02/1.03 FAQ

2010-02-02T16:16:00.001-05:00

Here is a quick list of things i think people should know when trouble shooting the next release. If there is anything else, post a comment and I will try to address it.

What servers have you tested this with?

Monal 1.02 has been tested mostly with google talk, openfire and ejabberd.
Openfire has been very heavily tested on multiple versions all the way up to 3.6.4.

ejabberd was tested on jabbim.com .

What SSL settings work?

At the moment only old style SSL works. This means if you are going to use SSL it probably should be on port 5223. If you connect on 5222 with SSL it will not work.

What server settings work?

The server must support SASL Plain authentication. This is the standard and should not be a problem for most people. Connections to port 5222 should not have SSL enabled. To use SSL you need to use port 5223. Not all servers support SSL on port 5223 if your server does not, you can either use 5222 without SSL if you are ok with that.

What if the certificate on the server does not match the server address?
Monal does not check to make sure that the certificate name and the server name are the same. SSL connections to these servers should work fine.

What if I have a self signed certificate?
Edit: the answer below applies for 1.02 only. 1.03 supports self signed certificates.

Monal does not support servers with self signed certificates right now. You cannot use SSL to connect to a a server with self signed certificates.

Why does the program slow down when I open it the first time/ connect to a server the first time.

Monal tries to download all the buddy icons after loading the list of people online. This takes up resources and might slow things down depending on how many buddies you have, how fast your connection is and how big your icons are.

Why does the chat screen flash when I load a new conversation.

Monal basically uses a web view (safari) to show the chat window in all its glory. The flash is safari loading the page. This only happens when you first start a chat

How do I delete chat history?

Go to the chat logs and swipe to delete all history with that user or click "Edit" on the upper right to select items and delete them. If you want to delete all logs, delete the log that is an entry for your own user. This will delete every message you have received or sent.

New Icon

2010-01-31T21:01:00.001-05:00

With a new name, Monal also has a new icon also designed by Ayush Pokharel.

Adium themes are in

2010-01-30T02:34:00.000-05:00

As luck would have it, there was a critical bug in the version of Monal submitted to the App store and I pulled it before it was approved. While it was in the approval queue i managed to get the Adium themes working correctly so it will be in 1.02.

appending the following to the change log:
21. New faster and better looking message display that is compatible with Adium themes.

1.02 submitted for approval

2010-01-27T01:18:00.000-05:00

Monal 1.02 has been submitted to the app store and should be approved in the next few days. This is the final change log for this version. I this is a substantial upgrade and will post a FAQ for this version soon.

1. Faster click response on buddy list

2. added an arrow to show buddies are clickable in chat log

3. added blue arrows to see expanded status message and other details of buddies in buddylist

4. "away" users are greyed out

5. Away, invisible and message Settings persistent between sessions

6. can delete conversation logs for budddies

7. xmpp protocol handling more efficient

8. new notification engine, much faster loading, more responsive UI and lower CPU usage/better battery life

9. new in application account manager

10. Landscape mode for chats.

11. option to play a sound when a message arrives (iphone only)

12. the entire program does not freeze when loading many buddy icons the first time

13. Edit button added for buddy list to remove buddies

14. Edit button added to chat history to remove history

15. badge on the tab bar at the bottom will indicate unread messages

16. offline messages. If the server supports it when messages are sent while sworim is closed, they will be sent to you when you open

17. Smoother/cleaerer buddy icon appearance

18. The new message indicator is in a grey oval like in mail.

19. copy and paste enabled in chat windows

20. Reconnects seamlessly when a dropped connection is detected

One more thing..

2010-01-25T02:40:00.000-05:00

Well, not exactly. This unfortunately doesn't look like it is ready for prime time. One of those features that's so cool I really wish I had it ready for the 1.02 release. OSX users will see the screenshots below and immediately know what it is. For everyone else, the gist of it is I have support for Adium message themes. Adium is the main IM client on OSX. All of the message themes you see on the Adium extras page should now work. I really like Renkoo and Stockholm. The screenshots below are of the Stockholm running on the iPhone. This will likely be the default theme in future versions. Despite how cool it is, the reason I don't think I can include it in this upcoming release it is just not as fast as the existing message display and speed is kind of important here. There are also little bugs with the keyboard display and auto scrolling to the newest message at the bottom. Hopefully it will be good enough to be in 1.03.

Screenshot dump!

2010-01-23T18:33:00.001-05:00

These are the shots that will appear in the iTunes store.

Say hello to Monal

2010-01-22T16:56:00.000-05:00

1.02 is now feature complete. I will not be adding anything new to it before release. The only thing left is to optimize the code and check for bugs. A release should come soon.

I am changing the name of the program to Monal starting with this release. SworIM was just randomly chosen one afternoon when I originally wrote the program. The name comes from swor (pronounced like swore) which is the Nepalese word for voice. I think Monal keeps the same theme and is unique but should be much easier to say. SworIM is pretty much a translation of Talk (as in Google Talk) with IM tacked on the end and not very creative. It worked out well because it was unique, It also got mispronounced to sound like soar. This led to the bird icon, which amusingly as a pheasant is not an animal likely to soar any time soon. Why the bird theme? I want Monal to eventually be like these guys and these . With better general XMPP support it's not really just a google talk program anymore.

SworIM has been around for just under a year and the name will probably live on underneath in the library that it uses and in the name of this blog. I'll be gradually changing the name over everywhere. Hopefully I wont regret it when I lose some traffic as it transitions.

New Account Manager and iPod Touch Users

2010-01-17T19:31:00.000-05:00

Sorry iPod touch users, OS 3 will be required for the next release. There are now definitely things in the program that simply don't work the same in OS2. Its been a while since OS3 came out, so I hope most iPod touch users have upgraded. I'll keep trying to see if I can redo things to work in OS2.

There is a new account manager in the application. This should address the most common complaint about the program, people cant find the settings app. It will also sets the groundwork for future multi account/ multi protocol support.

Gray message indicators

2010-01-17T02:28:00.000-05:00

Sure it is something small, but the fact that the message indicators didn't look like the ones in mail was something that bugged me. This is mainly due to the fact that uitablecell view in the iPhone actually doesnt have a built in system of showing that badge. It wasn't too hard to add one manually though. It not only makes the app closer to the standard UI, but the clear indicator should help see the number of messages when using the app. You may notice that the buddy icon is smoother, no more jaggies seen in the screen shots further down on this page. The anti aliasing filter was also added recently.

Offline messages and little icons

2010-01-16T02:39:00.000-05:00

Its not exactly push notification -- which will likely never be in sworim because its not connecting to the server through a proxy -- however if you xmpp server supports offline messages (such as google talk) then you will receive them when you open the application.
On the improved UI front, there's a notification badge added to the chat tab when new messages come in showing the number of unread messages.

Clicking on he blue arrow near a buddys name on the right will also show a detail page for that buddy so its possible to read longer status messages

Digest-MD5 will not be supported

2010-01-13T15:19:00.000-05:00

I began work on the DIGEST-MD5 authentication mechanism and realized that it was recently deprecated from the XMPP protocol. Considering how much trouble it is to implement and varying implementations on different servers that might lead to failed logins, I've decided not to add this login mechanism. This souldn't impact most people as the preferred method of logging in these days is SASL PLAIN +SSL connection, which SworIM has supported from day one.
SworIM does detect what mechanisms are supported when logging into a server, so I will code it so that if it encounters a server where SASL PLAIN is not supported it will have an error saying that is what the problem is.

More updates

2010-01-13T00:23:00.001-05:00

I feel I probably owe it to everyone to update this blog with new features as I am adding them considering how long it has been since both a release and new posts here.

I've been trying to get new style SSL working correctly. This would be SSL on port 5222 that many people have requested. I am about 95% there, I know how it works and have written code to initialize it, unfortunately, I also realized that the built in apple objects I am using are probably not compatible with the kind of communication it is doing. It seems I cant create a secure stream after already talking in the clear on the same BSD socket and port 5222 requires clear text communication before starting SSL. I'll have to try a new approach.

A couple of more things have been added to the change log:

11. option to play a sound when a message arrives (iphone only)
12. the program does not freeze when loading many buddy icons the first time
13. Edit button added for buddy list to remove buddies
14. Edit button added to chat history to remove history

SworIM 1.02 is coming

2010-01-10T17:42:00.002-05:00

Sorry for the lack of updates in the past few months. 1.02 is currently being developed. This should be a fairly big update that addresses many of the issues that were raised with 1.01. I am working hard on improving the XMPP protocol underneath in addition to the presentation. In particular, Im trying to improve the compatibility (more servers, more authentication methods) and eliminate crashing bugs. Here is the current change log. This will grow as I have a rather large list of things to fix before the next update, hopefully it will be worth it.

1. Faster click response on buddy list
2. added an arrow to show buddies are clickable in chat log
3. added blue arrows to see expanded status message and other details of buddies in buddylist
4. "away" users are greyed out
5. built with OS 2.2.1 as the base for ipod touch compatibility
6. can delete conversation logs for budddies
7. xmpp protocol handling more efficient
8. new notification engine, much faster loading, more responsive UI and lower CPU usage/better battery life
9. new in application account manager
10. Landscape mode for chats.

FAQ for v 1.01

2009-07-20T12:17:00.000-04:00

Does this work with ipod touch.

Yes. As long as you have an internet connection.

Where are the settings?

Settings are currently in the iphone/ipod setting application. Look for the sworim icon.

What authentication is supported right now?

Currently, it supports only SASL Plain. I am adding SASL MD5 and Plain text in the next release.

I am having SSL connection issues.

Try setting it to port 5223 instead of 5222 and see if that helps. Make sure your server uses SASL plain authentication or it will not be able to log in

Does it need iphone os3?
While it doesnt technically at the moment, there are database hooks (Core Data) that i want to use that isn't available in 2.0 and it will be 3.0 exclusive in the future. I will try to compile the next release with the 2.0 SDK and release that if it works.

What servers does it work with?

1.02 has been the most heavily tested with google talk. I have also connected to jabber.org's ejabberd server and the latest openfire server. I am currently heavily testing with openfire.

1.01 released, FAQ and reviews

2009-07-06T21:23:00.000-04:00

1.01 has been released in the app store. This is a bug fix update that fixes sticky/slowdown issues experienced by some users in the first version.

I am working on making a FAQ page on this blog so that people can see quick answers to recurring problems. I am also working resolving SSL and authentication problems people are having for the next release. Keep an eye out on this page for updates on that.

Finally, there are a ton of 1 star reviews on itunes, some from people looking for the settings menu. I've decided to ditch the standard apple menu and make my own in application to reduce confusion. In the mean time, if you have used the application and find it useful, please consider giving a positive star rating in itunes. You do not have to write anything, just give it a star rating. There are 50 people who gave 1 star reviews and close to a thousand users, it would be unfortunate for the 50 to drown out the rest. Thanks!

1.01.. just sitting there..

2009-07-02T23:17:00.001-04:00

1.01 still hasn't been approved. I have no idea why it is taking so long for approval. I'm going to have to see what the allowed frequency of releases in the store is.

v1.01 Sent for approval

2009-06-20T01:34:00.000-04:00

Based on the feedback I've gotten for version 1. I've fixed a few things and pushed out v1.01 to the store for approval. I just noticed some people were having login issues. I'll fix it in 1.02. Below is a change log for 1.01. Thanks!

1. removed debug code that got left behind in the 1.0 release build that was causing massive slowdown for some users
2. Status messages update properly on buddylist
3. Fixed bug when loading buddy icons, speeding up scrolling on chats and reduced memory use
4. made the message input box more obvious and visible in a chat view
5. initial prompts ask for missing username explicitly says go to settings program
6. Misc bug fixes

Bugs and Issues

2009-06-17T07:44:00.000-04:00

If you are having any problems connecting to servers or have experienced other issues. Post them in the comments below. I am aware of at least one case where someone wasn't able to connect to a jabber server using "old style SSL" i am looking into that. Everything else, comment away.

Dont forget to Digg

2009-06-16T10:32:00.000-04:00

Digging this blog would be very helpful in spreading the word. Please Digg. I've left this permanently on the sidebar.

Approved.

2009-06-15T18:18:00.000-04:00

SworIM 1.0 has been approved. Download it for free by clicking the image or the link below.

http://itunes.com/apps/sworim

Buddy Icons are in 1.0

2009-06-10T21:20:00.000-04:00

I ended up having to resubmit it because of incompatibility with iPhone OS3. The new version I have submitted has buddy icon support. Hopefully third time is the charm for approval.

Buddy Icons

2009-05-30T21:36:00.000-04:00

While I couldnt fix all the bugs in time for the 1.0 release, buddy icons are working in 1.1 and will definitely be in the next release.

Submitted and Final Icon

2009-05-28T17:22:00.000-04:00

Coming soon to your applications list:

List of features in V1.0

2009-05-23T15:29:00.000-04:00

Quick rundown of important features:

1. add/remove buddies

2. custom status messages

3. visible/invisible mode

4. vibration

5. SSL support

6. custom port and servers

7. VPN support

8. Unicode support for chatting in any language

9. Chat logs

What to expect in future releases:

Currently being tested:

1. buddy icons

2. groups

Future development:

1. Facebook support

2. AIM support

3. MSN (if I can get documentation on the protocol)

Submitted for review

2009-05-23T00:45:00.001-04:00

1.0 has been submitted for review in the iTunes store. Hopefully this won't take long. Below are the screenshots that will appear in iTunes.

Version 1

2009-05-20T01:41:00.001-04:00

Art assets are in, major memory leaks out, connection issues fixed and target features complete. We've now bumped it up to version 1.0 and are submitting it to the iTunes store.

Feature Complete

2009-05-17T12:08:00.000-04:00

All the features intended for the first release in the app store are now in place. I need to test a little more (random connection issues sometimes) before i submit this for inclusion in the store. Hopefully I can iron out any glaring bugs soon.

iPhoneOS 3.0

2009-05-16T12:59:00.000-04:00

One of the new requirements for all apps sent to the app store is that they be compatible with iPhone OS3, which is going to launch in under a month. This morning was spent testing SworIM with the OS and aside from some rather odd issues with the project file, the application runs just fine on the new OS.

When OS3 does launch, I'm going to try to add push notifications so it replicates the feel of running a background process.

Server Support

2009-05-15T20:31:00.000-04:00

While google talk is the default settings on SworIM, it is also a standard XMPP (Jabber) client. It has been tested with two other very popular systems Openfire (aka wildfire), which is a popular open source XMPP server and eJabberD which power Jabber.org, one of the major XMPP servers on the internet. It is this flexibility that distinguishes SworIM from other clients on the store right now

vibration and buddies

2009-05-14T00:23:00.000-04:00

The app is about a week away from initial release. We've just added the ability to add/remove buddies using the finger side on the row to remove and a plus button on the upper right to add. In addition there is an option to trigger vibration when a new message comes in.

The only things left to finish before final release are a alpha sort on the buddies, populating the chat log tab and final icons and art.

We can also confirm that SworIM has been tested with Wildfire/openfire servers and will connect to corporate servers through a VPN connection.

Below are screenshots from build .581, the latest build

Operating on the iPhone

2009-05-03T13:14:00.000-04:00

We now have a version operating on the iPhone. Most of the launch target features are in place. I still need to add the ability to add/remove a buddy and test with some more non google xmpp servers.

So far, it has worked perfectly with the google talk servers. Some screenshots from the current build (.56) running on Iphone 2.2.1

Progress so far

2009-02-20T23:36:00.000-05:00

So far the client can connect to most Jabber (xmpp ) servers, including google talk. using either SSL or clear text. Since this is a native jabber client unlike all other iphone IM clients, you can use this to connect to you corporate jabber server over VPN. It will connect, download the list of buddies and let you chat with them. The basic chat client is done. I am currently working getting avatars to load in a way that will not overly tax the iphone. Avatars do download but do not yet show up in the buddy list. That's my next major to do item.