Comments on: Setting The Standards Bar Linux. GNU. Freedom. Thu, 15 Feb 2018 18:04:15 +0000 hourly 1 By: Aaron Wed, 21 Feb 2007 21:04:05 +0000 Peter- However, I should mention that if the end-to-end encryption spec is realized, that will be good news for Jabber. Seeing as though it's the only protocol that I use for my encryption, then it'll be the exact "standard" that I'm looking for. I'm eager to see it's progress.

By: textshell Wed, 21 Feb 2007 20:40:40 +0000 @Steve
In jabber you always know if the other person will be able to decode it, because proper gnupg usage in jabber includes signing the presence. I think the newer session based encryption standard as comparable assurance. (yes, that's all xmpp specific)

@Hans, David
puting a layer of abstraction and/or a plugin system between the instant messanger part and the crypto part could be done. But i think you can't thread all system equally, because there are a lot of differences, like jabber supports signed presence and announcing capabilities in the presence.

there are 2 ways encryption can be specified in standards. xmpp has both client-to-server (that's where the server can decrypt the session) and client-to-client crypto support. if a client/user uses client-to-client encryption there is nothing the server can do to decrypt the chat session. I can only log encrypted "garbage".
So "in the protocol" only means specified in an protocol specific way, it doesn't mean it's something server side.

By: Aaron Wed, 21 Feb 2007 20:13:56 +0000 Peter- I don't even have an aunt that uses IM, let alone, concerned about her security.

From my experience, the #1 reason no one uses it, is they are caught unaware with what they can do with it. If it's not that, then they are too lazy to take the 5 minutes time to set it up. I have no tolerance for laziness. Just do it.

Good luck on your presentation.

By: Peter Saint-Andre Wed, 21 Feb 2007 20:08:38 +0000 Does anyone have an aunt who uses OpenPGP? Most IETF standards weenies don't even use it (or S/MIME), and they are the geekiest of the geeky. As far as I can see, OpenPGP is a non-starter for regular end users. I wish it weren't so.

And if you'll excuse me, now I need to write my talk about Jabber security to be presented on Sunday at FOSDEM 2007 in Brussels... 🙂

By: Aaron Wed, 21 Feb 2007 19:58:11 +0000 Peter- I agree and I don't agree. First, I agree that Aunt Tillie will most likely use OTR or some other 3rd-party plugin that will be easy to install.

But I don't agree that Aunt Tillie won't implement PGP/GPG. If she is using IM, and is concerned about her security, and even knows about encryption, it's a non-issue for her generating a keypair.

Also, about encrypting the whole packet, I agree. Just the text is not enough. I would much rather see the whole packet encrypted. However, we need options for more than just Jabber users. This is a start.

By: Peter Saint-Andre Wed, 21 Feb 2007 19:44:44 +0000 PGP is great for geeks but not for Aunt Tillie, who doesn't have a public key and never will. OTR is great for Aunt Tillie (if presented in a friendly way) because it uses opportunistic encryption, but it encrypts only the message body. In the Jabber world we'd like to encrypt the complete packet, not just the message body, so we can do things like encrypt the packets we use to set up voice calls (you don't want your IP address exposed, do you?). We have an emerging XMPP standard for end-to-end encryption (similar to OTR but it encrypts the entire packet) and we will be putting a lot of effort into that over the next year or so. It won't work for AIM/MSN/Yahoo but then if they would just use XMPP instead of their own proprietary technologies, all would be well...

By: Aaron Wed, 21 Feb 2007 19:40:36 +0000 Kyle- Yeah. I just came aware of Kopete and the GnuPG encryption capability that they have built in.

Pretty cool.

This means, as far as I know, Gajim, Psi and Kopete can interoperate securely with GnuPG.

As far as the servers handling the few extra bytes, big deal. We're talking a couple extra grains of sand on the beach.

By: Kyle Brantley Wed, 21 Feb 2007 19:35:43 +0000 Kopete has a plugin that ships with it which does just that: GPG keyring encryption, based on who you're sending it to.

The biggest problem with using this is how many times larger the ciphertext is than the plain text, and not many servers enjoy passing a few KB/sec between two people.

By: astrophoenix Wed, 21 Feb 2007 18:54:44 +0000 I routinely use gpg in kopete to encrypt IM over a jabber server. unfortunately, it doesn't seem to work reliably over google's jabber server. but it works fine on the jabber server we run at work.

By: Aaron Wed, 21 Feb 2007 18:11:32 +0000 textshell- The only problem is the servers decrypting and storing your chat sessions. This is a problem with Gmail.

Steve- I think this is the #1 reason why the Gaim devs have not implemented PGP/GPG into their client. It is difficult to know whether or not they are who they say they are, and with generating keys just for IM, this could pose a problem. But, I think the majority of us know who we are chatting with, and there is something to be said for common sense.

Hans- Rather than in the protocol, the spec needs to be implemented in the client, keeping servers from decrypting and logging your chats.

David- This is a good point. Standardizing the plugin capability makes sense. However, each plugin creates and utilizes keys differently, so a standard would need to be set to make the keys the same and behave properly, and this brings us to either GnuPG or using a common plugin, rather than several.

By: David Wed, 21 Feb 2007 16:36:05 +0000 Rather than standardize the encryption, doesn't it make more sense to have a standard way for IM's (and possibly other programs) to share (multiple encryption plugins? That way the plugins and the IM's can develop indpendently with only a common API that everyone needs to write to. Something very simple that is fed a block of clear text and returns crypt and vice versa. IM people don't have the think crypto, crypto people don't have to think IM and anyone who wants to is free to think about both together...

By: Hans Wed, 21 Feb 2007 16:26:43 +0000 Encryption definitely should be done in the framework of the protocol. But that doesn't mean there can't be an umbrella standard that is implemented in a protocol-aware way for each protocol.

I agree that gpg would be ideal, but I'm perfectly happy with the way OTR works too. Any public/private key thing works, the primary advantage to GPG is sharing the web of trust.

By: Steve Wed, 21 Feb 2007 15:31:54 +0000 I know Kopete has a plug-in for GPG encryption, but I'm not I've used it. I have done encrypted Jabber between a pair of Psi clients. Unfortunately there does not be a way to check if the person at the other end will be able to decode the message. You may have their public key, but they may not have encryption set up on their IM client.

By: textshell Wed, 21 Feb 2007 15:25:29 +0000 I think it's wrong to have a encryption standard that ignores the used protocol. At least in jabber encryption should work at the xml stream level, that's something that the closed protocols just can't do properly.
I think what is really needed to have clients that support the agreed upon encryption of the protocol in use. If there is no such thing the relevant client authors should get together and do a specification for it. For jabber the XMPP Standards Foundation has at least on protocol specified (gnupg based) and it's will be possible to get OTR usage in jabber and things like that properly done too.
For the rest of the protocols it might be better to just define a common crypto over simple messages protocol by the thirdparty client authors. they might be similar enough to share a standard.