Firefox add-on to add OTR encryption to web-based chats
lists.cypherpunks.ca
Firefox add-on to add OTR encryption to web-based chats
1–10 of 16 posts
Re: Firefox add-on to add OTR encryption to web-based chats
#2I wish I had more friends that would actually use OTR...
Re: Firefox add-on to add OTR encryption to web-based chats
#3I wish I had more friends that would actually use OTR...
I know that feel bro :/
Re: Firefox add-on to add OTR encryption to web-based chats
#4I wish I had more friends that would actually use OTR...
This is the first I've heard of OTR, do you know what good sources of information are on it?
Re: Firefox add-on to add OTR encryption to web-based chats
#5I wish I had more friends that would actually use OTR...
This is the first I've heard of OTR, do you know what good sources of information are on it?
Re: Firefox add-on to add OTR encryption to web-based chats
#6I want this for general posts on Facebook!
Re: Firefox add-on to add OTR encryption to web-based chats
#7I don't like that OTR allows the person your talking with to deny that they said something they said. I'd rather have pgp signed/encrypted chat so I can prove who said what.
I may be misunderstanding but I think OTR sends the encryption keys with the chat (to accomplish deniability), and while this means your text isn't transmitted in plaintext, it may as well be. Im open to being proven wrong though.
Re: Firefox add-on to add OTR encryption to web-based chats
#8I don't like that OTR allows the person your talking with to deny that they said something they said. I'd rather have pgp signed/encrypted chat so I can prove who said what. I may be misunderstanding but I think OTR sends the encryption keys with the chat (to accomplish deniability), and while this means your text isn't transmitted in plaintext, it may as well be. Im open to being proven wrong though.
You are misunderstanding, in the latter case. Asymmetric cryptography is used to determine a session shared secret. The deniability aspect is that either participant can generate messages in the same session. Alice receiving X from Bob knows that either Alice or Bob wrote X (assuming the session secret stays secret). Alice cannot prove to Carol that Bob wrote X because Alice's inference of this is dependent on local knowledge that Alice did not write X.
Re: Firefox add-on to add OTR encryption to web-based chats
#9I don't like that OTR allows the person your talking with to deny that they said something they said. I'd rather have pgp signed/encrypted chat so I can prove who said what. I may be misunderstanding but I think OTR sends the encryption keys with the chat (to accomplish deniability), and while this means your text isn't transmitted in plaintext, it may as well be. Im open to being proven wrong though.
You're misunderstanding, OTR isn't equivalent to plain text at all. For a good introduction to the details, see the CodeCon presentation on the website (http://www.cypherpunks.ca/otr/).
The encryption keys are not sent with the chat, they're generated using DH key exchange. After a conversation is finished, others may forge messages to make them look like they came from you, but they cannot read the messages you originally sent. This gives you plausible deniability, which is what you want in most use cases (if you don't, then you're right that PGP is a better option).
The key exchange is susceptible to a man in the middle attack, which can be prevented by comparing fingerprints using a separate communication channel. Once compared, all future conversations should be impossible to intercept. If your private keys are ever found (a TSA official steals your laptop), they'll be unable to decrypt past conversations. Unless you've left conversation logging on in your chat client, of course.
I never thought much about using OTR until i logged into GMail and discovered reams and reams of OTR conversations stored in the chat logs. I never used the GMail Chat client, and this was a real eye-opener for me. Had I not been using OTR, Google would have stored a couple of years worth of conversations between my friends and kept them forever.
By the way, ZFone / ZRTP (http://zfoneproject.com/) is a protocol using similar ideas, but for VoIP calls.
Re: Firefox add-on to add OTR encryption to web-based chats
#10I wish I had more friends that would actually use OTR...
I think the biggest problem is client support, and that some people prefer using multiple devices for chat, including web based services (GMail, Facebook Chat etc).
Even with Jabber where you can have separate resources, it's not possible to have some clients use OTR and some not (with good reason, I guess), so you either have to add a separate, non-OTR account, or get used to turning OTR on and off manually. And I'm still looking for an iPhone Jabber app with OTR support.