Secure IM in Gaim with OTR

Wednesday, January 24th, 2007

I just learned about off-the-record, a plugin for Gaim which “Just Works”. apt-get install gaim-otr should do the trick on Ubuntu or Debian, then go into the plugin configuration list in Gaim and generate keys for the accounts you want to use it with. Voila!

One needs to do an out-of-band (voice, typically) verification of someone’s key if you want to be sure to make life hard for the man in the middle. I suspect that we’ll soon have voice chats in Gaim too, so that will be even easier to arrange. Very classy work.

Anybody care to file a main inclusion report?

16 comments:

  1. Tony Yarusso says: (permalink)
    January 24th, 2007 at 4:20 am

    Incidentally, we (I) just covered Main Inclusion Reports in the Ubuntu Weekly Newsletter, so if anyone was on the fence about saying yes to that, you can see what it entails! :) https://wiki.ubuntu.com/UbuntuWeeklyNewsletter/Issue28#head-598904a93b7134e15d803782b5a3a6e68eb83ac8

  2. Scott Robinson says: (permalink)
    January 24th, 2007 at 5:30 am

    If you play with gaim-otr a bit, you’ll notice some issues. There are bugs with multiple locking buttons appearing in multi-protocol chats. The encryption refresh logic could use some serious love, and finally when a user logs in with an account that was previously encrypted and changes to unencrypted, the plugin fails badly…

    These are all reported. ;-)

  3. .fosk. says: (permalink)
    January 24th, 2007 at 8:04 am

    I would like to know if Marks has some information to suspect “to have soon voice chat in gaim”. :)
    I think a lot of users are specting that a lot, and this would be good news.
    Regards.

  4. tamgo says: (permalink)
    January 24th, 2007 at 12:59 pm

    Interesting. I was about to put up a jabber server in a couple of days, but this may very well be more elegant solution. I hope the bugs don’t make the plugin unusable.

  5. Jesse Jarzynka says: (permalink)
    January 24th, 2007 at 1:00 pm

    I prefer gaim-encryption. Same deal though, sudo apt-get install gaim-encryption. Haven’t found any bugs in that one.

  6. António Manuel Dias says: (permalink)
    January 24th, 2007 at 4:46 pm

    I use Psi mainly because it supports GnuPG encryption and I often wonder why isn’t this proven technology supported by more jabber clients. It has been working seamlessly for me for over a year.

  7. stephen o'grady says: (permalink)
    January 24th, 2007 at 5:47 pm

    if you’re just discovering that, maybe you haven’t run across guifications yet. highly recommended if not.

    apt-get install gaim-guifications

    then ensure the plugin’s activated.

  8. Roshan Shariff says: (permalink)
    January 24th, 2007 at 6:12 pm

    Using Gaim voice chat to exchange shared keys is insecure, since anybody who can intercept your text messages can also listen in on voice conversations. You need to use an out-of-band medium, like the telephone or face-to-face (imagine that!)

    Mark Shuttleworth says:

    If you know the voice of the person, then you could do the voice confirmation in the same band, as long as you think that it’s unlikely that someone could pull off a real-time man in the middle voice substitution attack!

  9. SixDays says: (permalink)
    January 24th, 2007 at 11:40 pm

    What is really needed is a plugin to rule them all, on all platforms and for all clients.
    According to Sean Egan (lead developer of gaim) the plugin “voice and video” will be incorporated directly into gaim, but he could not give me a timeline for that actually happening.
    This may seem of the topic, but it’s not.

    Many weindogs/winblows/wintendo users on my IM refuses to switch to gaim or even to run it in parallell with the MSN original client solely based on “I need to see webcams”.

    So I’ve concluded that either there need to be a cryptoplugin to rule THEM (msn, mirande, amsn, gaim, trillian, icq etc) all or gaim needs to have full webcam support.

  10. required says: (permalink)
    January 26th, 2007 at 10:16 pm

    Someone should make a cross-platform plug-in for Firefox.

  11. Gaby says: (permalink)
    January 30th, 2007 at 6:34 pm

    zfone inclusion (either native as is in Ekiga CVS or as a proxy or plugin to a to-be-coming gaim-vv work-alike) is quite like this and just as worthy a cause.

  12. The UbuCon NYC at ISIS Blogs says: (permalink)
    February 2nd, 2007 at 5:36 pm

    [...] The UbuCon is an unconference for Ubuntu users, developers, and sysadmins taking place on February 16th at the new Google offices in Manhattan. A few people from ISIS will be there to represent the interest of security in Ubuntu’s future development and hopefully moving improvements like GCC proactive security measures, encrypted LUKS partitions, and main inclusions of Seahorse and gaim-otr up to a higher development priority. If you’d like to join us add your name to the RSVP list and we’ll see you there (it’s free!). Share and Enjoy: These icons link to social bookmarking sites where readers can share and discover new web pages. [...]

  13. chris penn says: (permalink)
    February 22nd, 2007 at 8:38 am

    I think RSA gaim encryption is more secure.
    Just a note: if it has not been said, you can not use RSA an OTR together. Although, it looks kinda neat.

  14. Paul Wouters says: (permalink)
    April 3rd, 2007 at 3:13 pm

    I just noticed this post, and as one of the develors and active promotors of OTR, I’m happy to see the adoption by Mark and others of Ubuntu.

    Some ocmments:

    - The “double” buttons is really a design problem in gaim. When folding two users into one, gaim has no way of selecting which of the multiple identities you will use to talk. And both might be using the other identity, resulting in two OTR sessions, and thus two buttons.

    - “RSA is safer”. OTR is designed by two Computer Science professors, both graduates from Berkeley. It’s not some “home grown crypto”. OTR has other properties that it deems important that public key crypto systems do not have, such as repudiation (you can deny you said something, and the other party will not have any mathematical proof you said it)

    - gaim-encryption : from the FAQ: The gaim-encryption plugin provides encryption and authentication, but not deniability or perfect forward secrecy. If an attacker or a virus gets access to your machine, all of your past [monitored] gaim-encryption conversations are retroactively compromised. Further, since all of the messages are digitally signed, there is difficult-to-deny proof that you said what you did: not what we want for a supposedly private conversation!

    - cannot use RSA+OTR: it should work. If not, this might be a problem with the RSA plugin. Contact me if you want to see if we can find this issue.

    Paul Wouters

  15. Stu Tomlinson says: (permalink)
    May 7th, 2007 at 3:06 pm

    Paul,

    > When folding two users into one, gaim has no way of selecting which of the multiple identities you will use to talk

    Pidgin (and Gaim) has a ‘Send To’ menu to select which identity will be used.

    Stu.

  16. Fabian Rodriguez says: (permalink)
    December 19th, 2007 at 12:45 am

    Just a quick note to let anyone interested know that pidgin (formerly known as gaim) and pidgin-otr will be in the main repository starting with Ubuntu 8.04. ;)