Menu

#29 OTR session is established with another resource

open
nobody
None
pidgin-otr
5
2014-05-05
2014-05-05
random
No

User A uses pidgin with pidgin-otr plugin. User B establishes OTR session with A from resource B/1, then proceeds to establish another session from resource B/2. In this case A and his pidgin-otr will renew the session with B/1, and B/2 will still have unencrypted session. Moreover, further messages from A will be delivered to B/1 (as this is the "most recent" session in view of erroneous session establishment).

It seems the reason for this is that when request for OTR is received, the receiver (A's pidgin-otr) ignores the resource (as per "from" field) and respond to the generic client name ("B", not "B/2") which then is determined by the resource priority. This does not seem to be correct/optimal behaviour.

Discussion


Log in to post a comment.