Slashdot Mirror

The real question is why to the Russians want it?

Its not like it makes a lot of money.

Is it because it allows user encryption on top of the normal ICQ channel with plugins like SimpLite?

.. between OTR and simp lite?
I've been using simp for ages, and it even encrypts the logs (in a sense that the logs appear as gobbledegook).

Oh wait.. I guess its only for msn messenger / yahoo / icq /jabber / google.. its not like anyone uses those clients.

Check out SiMP-Lite

It's a fantastic product, I just wish it was multi-platform... Really nice for Windows though...

I guess this is probly a good time to begin encrypting all your IM's and emails. As previously mentioned there is PGP for email. But for msn there are a couple options. I had a really good experiance with simp: http://www.secway.fr/us/products/simplite_msn/home .php

Can do a pub/priv key exchange or just use a symmetric key and do a Diffie-Hellman exchange. Changes text colour based on authentication type, warns you about possible compromises, etc.

I have nothing to do with the company it is just something i stumbled upon one day. Of course could use skype for all IMing. Probably quite a bit less secure than simp because with simp you can authenticate someones public key in person with hash checking. But it is an option.

You could try http://www.secway.fr/us/products/simplite_msn/tech .php , which encrypts MSN traffic using AES and is free (as in beer).

Personally I'd be happy with 128-bit AES, as it is still way more secure than protocols such as the one that MSN Messenger uses.

I've personally been using SimpLite, a free tool that can seamlessly encrypt MSN messenger traffic (with versions for YIM, ICQ, and AIM) by acting as a local SOCKS proxy that understands the protocol. It uses 2048-bit RSA keys with AES 128-bit encryption.

SIMP

Actually, by far the best product i've used to encrypt msn/aim etc is Simp.

Simp for windows uses a 2kbit RSA pub/priv key system to authenticate, and uses that to exchange a 128 or 256 bit AES key. It is very customizable, and changes the colour of the text of the people you're talking to to show they are encrypted and authenticated (2kbit rsa was used to exchange the aes key) or that they are just encrypted (diffie hellman method used to exchange key), or not encrypted at all.

For *nix, they have a transparent proxy server running. I'm in slack now and it works great. also changes the colour/name of the person (if you want of course, its all customizable for both versions)

Every single person I talk to regularly uses simp for encryption. (which is about 5 people, but there is still the bunch of people i talk to occaisionally who dont use it)

Anyways, its all totally free. They have a for pay version that has some more features..i think chosing different encryption types and sending files encrypted (but i use skype for that currently anyways..which has rsa key authentication and aes-256 for everything else)

Either way, linky here.

You are using AOL Instant Messaging to chat with your friends or colleagues. Did you know your messages are sent over the Internet in cleartext form?

By encrypting messages before they leave your computer to the Internet, SimpLite-AIM prevents eavesdroppers from reading your personal AIM conversations. As the original successor of Simp 1.0, SimpLite-AIM benefits from state of the art algorithms to secure your messages, whilst maintaining an intuitive interface.

SimpLite-AIM is free for a personal use at home or at the office. The only restriction is that only one product from the SimpLite family can be launched at the sametime: either SimpLite-AIM, SimpLite-MSN, SimpLite-ICQ or SimpLite-Yahoo!.

True, but my point was that there ARE people using it to communicate NOW. These people are the ones with something to hide (like you said, most normal people don't encrypt their communications) and their communications can't be sniffed. So monitoring the internet is already a futile attempt.

However, SIMP from Secway is a relatively easy (read: transparent once it's setup) to use product to encrypt your IMs if you're overly paranoid.

I'm not worried about John User. Everyone: you, me, John User, etc.. have 3 options:

1) Not give a shit about the feds monitoring everything you do.

2) Lobby to enact laws to prevent this (or repeal the ones that allow it)

3) Prevent it from working (until said prevention is illegal).

All 3 are feasible, of course #2 is the hardest and #1 is the most common.

I've tried GAIM, but it seemed like this wsa not configurable. With Trillian I can specify different network connection settings for MSN and AIM.

These guys make a great encryption product (I have only used it for MSN on OSX and Windows). It works transparently but does require all parties in the chat to be running it to enable encryption.

Use something like simp to encrypt your messages before they are even sent over the IM network.

If you're concerned about monitoring of your chats, try SimpLite. The free versions support seperate keys for two different logins, and the only restriction on it is that you can only use encryption for one IM protocol (AIM, MSN, ICQ, Yahoo) at a time, although I think the pro version lets you use them all simultaneously. And all of the encryption is done client-side, so there's no need to worry about a third party sharing your keys with the federales. And if you're *really* paranoid, I'd think it'd be trivial to write a plugin for your preferred IM platform that utilizes PKI, encryption outgoing messages with the recipients public key and linking keys to everyone on your buddy list so it can automatically encrypt/decrypt all the trafic transparently.

Encryption utilities for a few popular chat networks: Simp

If the riaa really wanted to decrypt it they probably could I think.

Distributing keys over an insecure medium is often done using the diffie-hellman method. This method is venerable to the 'man in the middle' attack. Something that's fairly involved and maybe too much work to just catch one user, but it defiantly can be done.

This is all common knowledge so if you look up diffie hellman and man in the middle attack you will find info on it. Anyone on any of the intermediate hops can do it. In fact, any public/private key system is generally vulnerable

Just saying, encrypted doesn't automatically mean safe. If you can't speak over a trusted medium and compare hashes of your public keys, then it's not all that hard to decrypt your stuff without you even knowing.

If you wear that comfy tin foil had, you can use Simp(ignore the tacky flash intro, it's a good program) to transparently encrypt your msn conversations. They even have a Linux version that works with any client supporting a SOCKS proxy. This doesn't solve the problems, but at least you can verify your hash with your friends. Once you have authenticated and verified the hash, you are completely invulnerable, unless the AES-128 algorithm is compromised. Have fun.

This is why I use SimpLite with Trillian (or MSN Messenger)

Encrypts everything, works very well.

SIMP offers IM encryption for AIM, ICQ, MSN and Yahoo - either individually for free or SIMP Pro which supports all four IM systems and costs $25.

I was part of the beta program for SIMP Pro and I have to say it's an excellent little program, it even supports encrypted file transfers.

SimpLite for AIM.

Acts as a proxy for your AIM client and allows encryption of your messages. Course the person you're talking to has to have this installed as well in order to have the convo encrypted.