Hi guys, I think this is an important article to read by anyone who has IM, or ICQ. Or is thinking of using IM / ICQ to talk to peopl.
Title: GAIM-OTR Protects Against AOL's Privacy Invasion It turns out that by using AOL's IM and ICQ network, AOL owns everything you send over it. The solution is to use OTR encryption. The article then goes on to talk about Gaim and the OTR plugin. OTR stands for "Off The Record". I is a new encryption protocol designed by Ian Goldberg and Nikita Borisov from UC Berkeley: http://www.cypherpunks.ca/otr/ I have been using OTR for about a week, and I highly recommend it. It provides a level of security beyond other protocols (like PGP and S/MIME). I've written an explanation in the PS. OTR is available in both Windows and Linux, through Gaim (gaim.sf.net) using a plugin. It will soon be available in Mac OS X through Adium X version 0.8 (adiumx.com). Gaim doesn't support OTR natively, but the plugin is easy to install. You can see it on the plugins page, or you can go straight to the URL I gave you. AdiumX is a Gaim-based IM client for Macs. It will support OTR natively starting with version 0.8. Right now they are on 0.8beta3. If you are interested in privacy over IM, I urge you to use OTR. Cheers, Daniel. PS: My experience with OTR. I started using OTR about a week ago (for an unrelated reason). Before I began, I read the paper explaining OTR encryption. I was very impressed with it. OTR is based on tried and true algorithms (AES, HMAC, DH, etc). Yes, it provides a novel type of security that you don't get through PGP. PGP and S/MIME provide: * Encryption * Authenticy -- the guarantee you're talking to whom you think. OTR provides both of those, and it also provides: 1) Perfect forward security The drawback of PGP is that it relies on the secrecy of your private key. In most cases, that key will remain private. But what happens if someone does get they key (e.g. through a virus, stealing your computer, or an FBI subpoena). What then? Then, they can read everything you have ever sent using that key. Perfect forward encryption means that even if someone *does* get the key, they still can't read what you sent. They can't force you to show them what you sent, because even you can't recover the data. It is unrecoverable. 2) Repudiability The lack of repudiability is another drawback of PGP. If a third party does manage to see what you said, they also have mathematical proof that you said it. That's not very private. This is where OTR shines. Even though it provides authenticity, it still gives you repudiability. The person you are talking to knows what you said, and they know it was you who said it. But they can't prove it to anyone else. This is my favourite part of OTR, because it involves a clever uses of known algorithms, applied in a way I hadn't seen before. Allow me to use a real-world analogy: Regular email and IM is like using postcards. When you send a postcard to someone, the postcard goes through a lot of anonymous hands. Any of the intermediaries is free to read what you wrote. PGP is like signing a written letter, and putting it in a safe. This is definitely a security improvement over the postcard. Now even skilled attackers can't read what you wrote. Furthermore, the recipient gets the assurance that you were the real sender. However, if you wanted to tell me something private, would you want to put it on paper and sign it? Not really. The "signed envelope in a safe" model is only good compared to postcards. But in they physical world, you wouldn't go for it. Instead, you'd ask me to meet you at a bar. We'd go to a quiet corner, and talk. Why would you prefer that? Because that would be an "off the record" conversation. I know what you said, and I know it was you who said it, but I can't prove it to anyone else. A face-to-face conversation provides authenticity, but maintains repudiability. If I go off and tell someone "Joe said such and such", Joe can turn around and say "no I didn't". That is repudiability.
