3 ms·

Pidgin is predominantly developed for Linux, where they would have to support Gnome, KDE and probably at least one other mechanism. Sure, that could be done, bu

Pidgin is predominantly developed for Linux, where they would have to support Gnome, KDE and probably at least one other mechanism. Sure, that could be done, but it is a lot of work to do that sensibly on all platforms, and, more importantly, of questionable sense: I would classify the logs of my conversation as much more relevant to a potential attacker than the mere password to my XMPP account.

MichaelGG 13y ago
All of this is true. But when the Pidgin devs state things like "there's no way" and "it's just as secure" (as they do on the wiki), that's just incorrect. An intellectually honest description would note that many platforms offer protection, but it's not standardized across Linux (I'm assuming). The logs of the conversation can be protected in the same way, so I'm not sure what that has to do with anything. (Although you might wish to keep logs as plaintext, to facilitate backups, if you're not backing up the user's keychain info.)
- claudius 13y ago
  The wiki explicitly says (under “Is that the final word?”): > No. The Pidgin developers are generally open to, and would encourage integration with keyrings (KeyringSupport). and then goes on to state that this is difficult to do, since Pidgin runs on so many different platforms, then stating again that they will happily accept such patches. However, I find it understandable, that the devs don’t go out of their way to support use-cases they don’t feel necessary to support. On their systems, they trust the filesystem and are happy with that, if others don’t have that level of trust in their computer, that’s fine, but not necessarily their problem. My point about the logfiles was that to store these in the keyring (rather than a key to the encrypted files) would probably annoy the keyring somewhat (at least the poorer implementations thereof), given that it is intended for use with few-byte passwords and not multi-megabyte logfiles.
  - MichaelGG 13y ago
    The wiki does mention some info, yes. But it also makes a false comparison, noting how you can extract passwords on a system, and implying that the level of security is identical. That's 100% false, and to suggest so is being very misleading. As far as logs, do what everyone does when you can only store a bit of material: Store your bulk encryption key there.

MichaelGG 13y ago

All of this is true. But when the Pidgin devs state things like "there's no way" and "it's just as secure" (as they do on the wiki), that's just incorrect. An intellectually honest description would note that many platforms offer protection, but it's not standardized across Linux (I'm assuming). The logs of the conversation can be protected in the same way, so I'm not sure what that has to do with anything. (Although you might wish to keep logs as plaintext, to facilitate backups, if you're not backing up the user's keychain info.)

claudius 13y ago
The wiki explicitly says (under “Is that the final word?”): > No. The Pidgin developers are generally open to, and would encourage integration with keyrings (KeyringSupport). and then goes on to state that this is difficult to do, since Pidgin runs on so many different platforms, then stating again that they will happily accept such patches. However, I find it understandable, that the devs don’t go out of their way to support use-cases they don’t feel necessary to support. On their systems, they trust the filesystem and are happy with that, if others don’t have that level of trust in their computer, that’s fine, but not necessarily their problem. My point about the logfiles was that to store these in the keyring (rather than a key to the encrypted files) would probably annoy the keyring somewhat (at least the poorer implementations thereof), given that it is intended for use with few-byte passwords and not multi-megabyte logfiles.
- MichaelGG 13y ago
  The wiki does mention some info, yes. But it also makes a false comparison, noting how you can extract passwords on a system, and implying that the level of security is identical. That's 100% false, and to suggest so is being very misleading. As far as logs, do what everyone does when you can only store a bit of material: Store your bulk encryption key there.