Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pidgin: The Universal Chat Client

pidgin.im

Post reply on HN
Print view View original

171–180 of 181 posts

Re: Pidgin: The Universal Chat Client

#171

Post by mike_d »

fiddlerwoaroof wrote: post #134
heavyset_go wrote: post #104

Earlier quoted context omitted.

That time period was magical for interoperability of services, P2P and open protocols. The tech landscape today would look much different if the principles of that era were adhered to today. Instead, the "interoperability" we get today is the result of multibillion dollar corporations making partnerships with each other, while independent developers are locked out. As an example, Google gets access to streaming servi…

Does the European DMA law indicate a possible return of this? It sounds like Europe is about to require interoperability between Facebook Messenger-likes and other clients.

Likely not. You'll just see everyone fall back to supporting SMS like iMessages does.

There is no way to regulate an equivalent level of service and features be provided on a platform you don't control.

Re: Pidgin: The Universal Chat Client

#172

Post by upofadown »

pabs3 wrote: post #170
upofadown wrote: post #166

Earlier quoted context omitted.

How exactly is OTRv3 insecure?

Too small encryption keys, using DH instead of RSA or newer encryption etc

From Wikipedia:

>OTR uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function.

What specifically is wrong with any of that?

Re: Pidgin: The Universal Chat Client

#173

Post by damagednoob »

mdasen wrote: post #7

I really miss Adium ( https://adium.im ) which was based on Pidgin's libpurple. Adium had such a great user experience. It was built with native widgets and also incorporated chat themes that were implemented using WebKit's rendering ( https://www.adiumxtras.com/index.php?a=search&cat_id=5&sort=... ). It was fast and memory friendly given that it was a native app and the themes were just small templates offering a di…

> It's really sad that we've lost the ability to connect to so many of the services we use with third party clients.

https://meetfranz.com/

Re: Pidgin: The Universal Chat Client

#174

Post by mattgreenrocks »

rincebrain wrote: post #153
Kye wrote: post #97

Earlier quoted context omitted.

AOL definitely took issue with gaim, which was Pidgin's old name from when it was mainly an AIM client. https://en.wikipedia.org/wiki/Pidgin_(software)#Naming_dispu...

AOL took issue with most third-party clients - I and a number of other users would periodically get permanently banned from AIM, apparently for the sole crime of using a third-party client they could notice. My friends got used to every 6-12 months seeing that I was messaging them from a new name. But naim was such a nice client before finch was really a thing. (No, I never did anything more exciting than have privat…

I used my third party client for a few years circa 2003. I think after more services entered the fray (MSN/Yahoo) they eased up.

Re: Pidgin: The Universal Chat Client

#175

Post by syntheticnature »

upofadown wrote: post #172
pabs3 wrote: post #170

Earlier quoted context omitted.

Too small encryption keys, using DH instead of RSA or newer encryption etc

From Wikipedia: >OTR uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function. What specifically is wrong with any of that?

None of those sizes are considered secure these days. AES-128 is the strongest of the bunch, though much more vulnerable to multi-channel attack[0] than AES-256 (and OTR would be a definite place to use that if you have a number of people). It's at the lowest end of suggested symmetric key in the approved NIST document[1] right now. Diffie-Hellman key exchange with 1536 bits is considered to be within nation-state reach, providing only 89 bits of actual security[2]. SHA-1 has been considered insecure since 2005[3], with chosen-prefix attacks now considered practical; if, somehow, the bitcoin network was retargeted to SHA-1 chosen-prefix attacks it would be capable of generating 32 such per second.

0: https://crypto.stackexchange.com/questions/75880/what-is-a-m...

1: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/r...

2: https://weberblog.net/site-to-site-vpns-with-diffie-hellman-...

3: https://sha-mbles.github.io/

Re: Pidgin: The Universal Chat Client

#177

Post by spyc »

zaik wrote: post #66
eimrine wrote: post #63

Earlier quoted context omitted.

I have tried Matrix not on my wish but it has not worked. Also I like Tox but it needs processor with hardware cryptography and have not use it a long time.

OMEMO is an XMPP extension: https://omemo.top/

The OMEMO plug-in for Pidgin is named "lurch" and has it's home at https://github.com/gkdr/lurch .

Re: Pidgin: The Universal Chat Client

#178

Post by account42 »

ValtteriL wrote: post #8

Pidgin has been a trusty XMPP client. Staff at one of my previous employers used it for IRC. Interestingly, some actors are willing to buy exploits against Pidgin users for sums higher than what the authors have made out of it.[0] [0] https://therecord.media/zerodium-acquiring-zero-days-in-pidg...

Not supporting Message Archive Management [0] makes Pidgin a pretty meh XMPP client if you use more than one device.

[0] https://xmpp.org/extensions/xep-0313.html

Re: Pidgin: The Universal Chat Client

#179

Post by upofadown »

syntheticnature wrote: post #175
upofadown wrote: post #172

Earlier quoted context omitted.

From Wikipedia: >OTR uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function. What specifically is wrong with any of that?

None of those sizes are considered secure these days. AES-128 is the strongest of the bunch, though much more vulnerable to multi-channel attack[0] than AES-256 (and OTR would be a definite place to use that if you have a number of people). It's at the lowest end of suggested symmetric key in the approved NIST document[1] right now. Diffie-Hellman key exchange with 1536 bits is considered to be within nation-state re…

0. What use would a break of a random OTR user's AES-128 be if it took millions of dollars, years and a significant chunk of all the memory that exists? And only a single session key's worth.

1. Does that not mean that NIST considers AES-128 secure?

2. Who exactly thinks that 1536 bit DH is breakable by nation states? The closest I have heard is 1024 bit DH. Note that we are talking messaging here where a break gets you one users messages.

3. Exactly what sort of attack would be possible against OTR using a practical SHA-1 collision?

Re: Pidgin: The Universal Chat Client

#180

Post by rincebrain »

wolrah wrote: post #167
rincebrain wrote: post #153

Earlier quoted context omitted.

AOL took issue with most third-party clients - I and a number of other users would periodically get permanently banned from AIM, apparently for the sole crime of using a third-party client they could notice. My friends got used to every 6-12 months seeing that I was messaging them from a new name. But naim was such a nice client before finch was really a thing. (No, I never did anything more exciting than have privat…

> AOL took issue with most third-party clients - I and a number of other users would periodically get permanently banned from AIM, apparently for the sole crime of using a third-party client they could notice. My friends got used to every 6-12 months seeing that I was messaging them from a new name. Weird, I used Trillian on Windows and Adium on Mac exclusively for years, from 2004 through some time in the mid 2010s…

My impression was that something about naim in particular triggered their wrath, since as you say, Gaim and Trillian rarely provoked ire. But their support was unhelpful, and it happened a couple times to more people than just one user at once, so _something_ about it was clearly rustling their jimmies.

They did eventually seem to back off though, as the sibling commenter said, because after a certain point I stopped randomly getting banned ever again from then until the end of AIM as a service.

Post reply on HN