-
Notifications
You must be signed in to change notification settings - Fork 10.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Off-the-Record (OTR) Messaging [$1,000] #36
Comments
You mean beyond https? |
it would be nice if it has some OTR for direct messaging |
the idea of OTR implies in not saving the message on db? |
Off-the-Record (OTR) MessagingAllows you to have private conversations over instant messaging by providing: EncryptionNo one else can read your instant messages. AuthenticationYou are assured the correspondent is who you think it is. DeniabilityThe messages you send do not have digital signatures that are checkable by a third party. Anyone can forge messages after a conversation to make them look like they came from you. However, during a conversation, your correspondent is assured the messages he sees are authentic and unmodified. Perfect forward secrecyIf you lose control of your private keys, no previous conversation is compromised. |
I don't know if this implementation has been audited or not but https://github.com/arlolra/otr |
|
And further reading on the state of otr arlolra/otr#59 |
It's indeed very easy to implement OTR using arlolra/otr. |
Looks like this feature has more people interested than I expected. I'll raise its priority. 👍 |
Can any of you guys do a Pull Request or create a fork with a proposed implementation? |
Hi @Igor1201 can we work together to get your PoC to work on Rocket.Chat? |
See #268 |
Problem with OTR is that it only works while both users are online. I recommend using Axolotl instead, developed by Open WhisperSystems of TextSecure/Signal fame. It's like OTR but it supports secure asynchronous messaging, which is important because it's rare that everyone is online all the time. :) There are lots of Axolotl libraries out there, available for both iOS, Android, and Web. |
I agree with @taoeffect. OTR isn't optimal here. |
FYI, this feature, regardless of how you implement it, really only makes sense for DMs (for now). Encrypting group conversations is extremely difficult, and with today's tech it would result in most of the other features of RocketChat having to be removed (like search). |
@mitar is the paper you mentioned available somewhere? You mentioned it being in review a year ago - and it sounds very interesting! Also: Thanks for your very detailed descriptions. |
Sadly, not. We had issues finding research novelty in that work. It was mostly engineering work, which is not what academic papers should be about, it seems. :-( |
+1 for Olm Double Ratchet. It's certainly challenging to implement but would imho provide the most features (one-on-one and group conversations, partial forward secrecy etc.) and best user experience. |
Any news? Anything? Anyone? |
Make sure you are using https |
Our implementation of e2e encryption has a PR open: #10094 Would be great to get some feedback on that PR. |
Bounty still open? |
It is still listed on BountySource, but #10094 was released with v0.70.0. So I assume it has not been claimed yet. Either way this issue should be closed. |
Is that pull request really OTR, though? From the commits alone I can't tell. E2E and OTR are very different things. |
@RocketChat/core can someone address the concerns here. Technically OTR has been in for a while. Now we have E2E encryptions with #10094 Does this issue need to stay open for some specific tasks for OTR? Maybe refactoring OTR to go on top of the e2e? cc: @engelgabriel |
|
@LemonAndroid I don't think the issuer is responsible for submitting the completion claim. |
Ear real user name invite
Any news on it? |
Bountysource decided to update their Terms of Service:
https://www.bountysource.com/issues/18684038-off-the-record-otr-messaging |
@gustavorps Withdrawn. https://twitter.com/Bountysource/status/1273406549252177920 |
There is a $1,000 open bounty on this issue. Add to the bounty at Bountysource.
The text was updated successfully, but these errors were encountered: