| |||||||||||
Well...Well...Posted Oct 4, 2004 14:42 UTC (Mon) by obobo (guest, #684)In reply to: Well... by jwb Parent article: Gaim-Encryption: Simple encryption for instant messages (NewsForge)
> It would be better if, instead of using a "PGP-like" scheme, Gaim just used PGP.
Actually, I wouldn't describe Gaim-Encryption as being particularly PGP-like, as encryption schemes go.
I wrote up the reasons why Gaim-Encryption doesn't use PGP in the FAQ. Basically, I wanted to do something that works opportunistically, and that doesn't interact with my PGP/GPG web of trust. That way I can accept keys from people over IM and have some security, while not having their keys end up "trusted" in my GPG keyring. I can understand why someone who has a large GPG keyring, and who only wants to IM people who are on it, would rather have a GPG-based based plugin, but I don't think that that description fits most users.
The other big issue is that IM is in a middle ground between one-shot communication (like Email, where PGP makes sense) and allowing typical network usage (where something like SSL makes more sense. While your email client will easily catch duplicate copies of the same letter, most IM protocols don't have such a feature. So, you need replay protection for IM, which PGP doesn't have.
On the other side of the fence, end-to-end SSL (with cached certificates) would be great, except that (most) IM is sessionless. You don't necessarily get any notification when I stop my client and restart it on a different machine, and that makes life hard for IM encryption. Add in the back-and-forth messages needed to establish the link (which can get hit by rate limiting on the IM server), and things get problematic.
-Bill
(Log in to post comments)
Well... Posted Oct 5, 2004 10:50 UTC (Tue) by angdraug (subscriber, #7487) [Link] I can understand why someone who has a large GPG keyring, and who only wants to IM people who are on it, would rather have a GPG-based based plugin, but I don't think that that description fits most users. The Right Thing for users who don't have a large GPG keyring is to build up one, and to hook up to a sizeable web of trust. And to encrypt all of their communications, so that the really important transactions don't stand out begging for brute-force attack. But who ever cares about doing The Right Thing, even about security?
|
|||||||||||