5 ms·

I wish they would recommend alternatives to Pidgin or Adium. (Because they are graphical interfaces to libpurple, which wasn't written with security in mind, to

I wish they would recommend alternatives to Pidgin or Adium. (Because they are graphical interfaces to libpurple, which wasn't written with security in mind, to put it nicely.) Gajim and Jitsi are both free software IM clients, cross-platform, implement OTR, and are written in high-level languages. Please contribute time to both these projects, if you can.

snassar 12y ago
I, and others, have found Jitsi to fail in real-life situations on the simplest task: XMPP. The software looks great, seems to work nicely, but at the critical point of exchanging messages has failed me during training sessions. Security-wise Jitsi might be awesome, but I can't rely on it and I can't recommend it.
easytiger 12y ago
Why, out of interest, do you care about privacy when you are sending all of your messages to a third party system? Unless you encode the text itself that you send (been possible for a very long time with pidgin plugins etc) then the debate from 5-6 years ago that you are presumably referring to deals with your assertion. Namely their storage of plaintext passwords in your ~/
- schoen 12y ago
  Pidgin and Adium are discussed in the guide specifically because they can do OTR. The trouble is that both clients are probably quite vulnerable to remote code execution bugs arising from things like memory corruption. Hence using them might protect you quite a bit from someone recording your IMs, but also expose you to someone who knows about a specific unpatched vulnerability and can send you messages taking over your computer. The authors of the guide are very aware of this concern and will definitely be considering it further.
- tedks 12y ago
  >Namely their storage of plaintext passwords in your ~/ Personally, I don't see this as terribly bad. An attacker with physical access can do a lot more damage than just discovering your XMPP credentials, and if that's all they were looking for, they could just replace the Pidgin binary to send the credentials in plaintext to Moldova the next time you launched it. You need full-disk encryption to really not be affected by this. However, libpurple is a sea of zero-days. It's a library made to deal with input over the network written in C, which is really enough to be damning. There's far, far worse in libpurple than storing plaintext passwords.

snassar 12y ago

I, and others, have found Jitsi to fail in real-life situations on the simplest task: XMPP. The software looks great, seems to work nicely, but at the critical point of exchanging messages has failed me during training sessions. Security-wise Jitsi might be awesome, but I can't rely on it and I can't recommend it.

easytiger 12y ago

Why, out of interest, do you care about privacy when you are sending all of your messages to a third party system? Unless you encode the text itself that you send (been possible for a very long time with pidgin plugins etc) then the debate from 5-6 years ago that you are presumably referring to deals with your assertion. Namely their storage of plaintext passwords in your ~/

schoen 12y ago
Pidgin and Adium are discussed in the guide specifically because they can do OTR. The trouble is that both clients are probably quite vulnerable to remote code execution bugs arising from things like memory corruption. Hence using them might protect you quite a bit from someone recording your IMs, but also expose you to someone who knows about a specific unpatched vulnerability and can send you messages taking over your computer. The authors of the guide are very aware of this concern and will definitely be considering it further.
tedks 12y ago
>Namely their storage of plaintext passwords in your ~/ Personally, I don't see this as terribly bad. An attacker with physical access can do a lot more damage than just discovering your XMPP credentials, and if that's all they were looking for, they could just replace the Pidgin binary to send the credentials in plaintext to Moldova the next time you launched it. You need full-disk encryption to really not be affected by this. However, libpurple is a sea of zero-days. It's a library made to deal with input over the network written in C, which is really enough to be damning. There's far, far worse in libpurple than storing plaintext passwords.