Firefox add-on to add OTR encryption to web-based chats(lists.cypherpunks.ca) |
Firefox add-on to add OTR encryption to web-based chats(lists.cypherpunks.ca) |
Even with Jabber where you can have separate resources, it's not possible to have some clients use OTR and some not (with good reason, I guess), so you either have to add a separate, non-OTR account, or get used to turning OTR on and off manually. And I'm still looking for an iPhone Jabber app with OTR support.
http://getsatisfaction.com/kik/topics/otr_for_private_conver...
I also set up one calling for SSL at the same time:
http://getsatisfaction.com/kik/topics/secure_kik_with_encryp...
That ones been implemented now though. Kik 5.0 came out a little over a month ago and had SSL support, but didn't do certificate verification. Kik 5.1 came out a few days ago and now finally has working certificate verification.
FireGPG was brilliant. It would detect blocks of PGP in the page, and add "Decrypt/Verify" links to the appropriate place in the page, and would let you easily encrypt/sign data. I can't believe nobody took over development. I keep meaning to learn how to write Firefox addons specifically so I can take up this project, but I haven't found the time.
I may be misunderstanding but I think OTR sends the encryption keys with the chat (to accomplish deniability), and while this means your text isn't transmitted in plaintext, it may as well be. Im open to being proven wrong though.
The encryption keys are not sent with the chat, they're generated using DH key exchange. After a conversation is finished, others may forge messages to make them look like they came from you, but they cannot read the messages you originally sent. This gives you plausible deniability, which is what you want in most use cases (if you don't, then you're right that PGP is a better option).
The key exchange is susceptible to a man in the middle attack, which can be prevented by comparing fingerprints using a separate communication channel. Once compared, all future conversations should be impossible to intercept. If your private keys are ever found (a TSA official steals your laptop), they'll be unable to decrypt past conversations. Unless you've left conversation logging on in your chat client, of course.
I never thought much about using OTR until i logged into GMail and discovered reams and reams of OTR conversations stored in the chat logs. I never used the GMail Chat client, and this was a real eye-opener for me. Had I not been using OTR, Google would have stored a couple of years worth of conversations between my friends and kept them forever.
By the way, ZFone / ZRTP (http://zfoneproject.com/) is a protocol using similar ideas, but for VoIP calls.
But Facebook and privacy don't mix anyway.