Menu

#27 Pidgin buzz is not encrypted

open
nobody
None
pidgin-otr
5
2014-03-20
2014-03-20
No

Hi,

I noticed, that buzzing someone in Pidgin using OTR is not encrypted.

The bug report below is copied from Archimedes ticket under
https://developer.pidgin.im/ticket/11928

It was closed, because "This issue is caused by a third party plugin."


When using the OTR plugin for secure conversations, the
Attention/Buzz/Nudge? is send in plaintext instead of encrypted (at
least in jabber, can't tell for other protocols as ICQ doesn't work atm):
(23:56:30) The following message received from archimedes@jabber.*.de
was not encrypted: [Archimedes has buzzed you!]

Though this is just a minor leak of information, it should still be
avoided to preserve complete privacy of the conversation.

I guess this is a libpurple bug, as both the button and the /buzz
command show this behaviour.

In a short:

Steps to reproduce:

Start a chat
Enable OTR
Send /buzz or click "Attention!" Button

What happes:
Buddy gets an unencrypted buzz message

What is expected:
Buddy gets an encrypted buzz message

Discussion


Log in to post a comment.