Menu

#20 OTR figerprint entries for Jabber and other XMPP based acco

open
nobody
None
5
2013-01-23
2013-01-23
Cálestyo
No

Hi.

Currently, pidgin only stores and verifies the user@host part of a JID in XMPP-based protocols in the ~/.purple/otr.fingerprints file.
E.g.:
foo@… bar@…/Mobile prpl-jabber adfe384759294857366529497462648590373263 verified

The resource-part is missing (note that it _does_ include the resource-part on the sending account).

Quite obviously this is both a technical and a security problem:
1) Technical:
It's very likely that when people use different devices, they will also use different keys, which now is a problem.

2) Security:
It's not really possible to specify to expect which key on which resource.

Cheers,
Chris.

Discussion


Log in to post a comment.

MongoDB Logo MongoDB