New AIM Offering "end to end" Encryption

MankyD writes "The current AIM beta is now offering message encryption. They don't offer a lot of details but it's nice to see they are offering some extra privacy. Will the new AIM be illegal in Michigan?"

Comments

Thank god

[craigtay]

Now I can feel secure when I talk on AIM.. Because I didn't before...?

Re:Thank god

[swtaarrs]

AIM is very insecure by nature. I downloaded Ethereal, a packet sniffer, and it has built in filters for extracting AIM messages out of the packets AIM sends. So anyone with a packet sniffer program and half a brain can easily eavesdrop on your conversation. And under the PATRIOT act, the US government can do this any time they want... ugh

Re:Thank god

[krisp]

iChat, which connects to AOL instant messager service, uses SSL to encrypt my end to the server. You can't sniff what i'm sending, and if the receipent is using SSL also, you can't sniff what she's reveiving, unless you are on AOL's server, or somewhere inbetween AOL servers where the message might be routed in plain text,.

Re:Thank god

[carpe_noctem]

That's pretty cool. It's a shame that iChat looks like something my cat coughed up, or else I'd be tempted to use it on my Mac instead of gaim.

Re:Thank god

[CableModemSniper]

Speaking of Gaim, theres a GPG plugin for it that allows you to encrypt your messages. And their safe from AOL too, not just all the people in between.

Re:Thank god

[Anonymous Coward]

"And under the PATRIOT act, the US government can do this any time they want... ugh"

HAHA .. Don't you expect the government to do this even without any damned laws? I mean we all expect big brother to be spying on us anyways, how bout just expect it and use some encryption buddy.

Re:Thank god

[swtaarrs]

You do have a point, but under the PATRIOT act, there's no legal basis for us to challenge the eavesdropping. Without the law, we would have some sort of legal basis to challenge eavesdropping, however small that basis may be.

Re:Thank god

[Anonymous Coward]

Trivial. You don't need iChat, can be done with any client using stunnel.
Did it with Tik all the time.

Re:Thank god

[Anonymous Coward]

You think iChat looks bad, so you use GAIM?!

Ha. Hahaha. Haha. Ha.

Re:Thank god

[wan23]

I downloaded Ethereal, a packet sniffer, and it has built in filters for extracting AIM messages out of the packets AIM sends. And in an environment such as a college dorm where there might be plenty of people connected via hubs (i.e. anyone on the hub can snoop everyone else's packets), this is a good thing to have... not that I would know anything about that...

Re:Thank god

[StarKruzr]

Too bad WinGAIM is pretty and feature-rich but crashy as hell.

Honest. It really IS too bad. If it wasn't for the fact that it crashes constantly it'd be the only thing I used for IM.

Re:Thank god

[LimeColoredSloth]

Is packet sniffing against the DMCA?
Can an ISP catch someone using it?

Re:Thank god

[Anonymous Coward]

AIM is very insecure by nature.

AIM is a piece of crap by nature and a security nightmare from a number of different perspectives. As a network administrator, AIM's tendancy to go port scanning for open ports to get out of the firewall pisses me off to no end. AOL should've definitely hard coded it to one port and let the admins decide if they want to let the users use instant messaging. As it is we have to watch for traffic on any available port plus anything going over a web proxy. *sigh* And before anyone says I'm being a nazi, tough! That's our job!

Re:Thank god

[Lunastorm]

Although security for a tool such as AIM might seem trivial, it will definitely help those that might have stalkers.

Re:Thank god

[numark]

No and no. Packet sniffing is reading information that's deliberately exposed to the outside; the DMCA wouldn't prohibit you from viewing the contents of your own communications (well, at least in this case). And an ISP can't find out you're doing packet sniffing because all sniffing does is hook onto your networking layer and read the raw data coming from the packets. In most cases it's pretty much invisible.

Re:Thank god

[LuckyLeprechaun31]

Yeah, its kinda scary that anyone could "eavesdrop" on your AIM conversations so easily. This added encryption will make it more secure, no doubt.

Re:Thank god

[AndyAMPohl]

Just wondering then... I use gaim on linux so maybe it's different. My sister sets her font to dark purple on black (very hard to read) and I can't figure out how to override her settings with an easier to read font in Gaim. It's there, right? I use iChat on my laptop and that's one of the things I like about it.

Andy

Re:Thank god

[billatq]

downloaded Ethereal, a packet sniffer, and it has built in filters for extracting AIM messages out of the packets AIM sends. And in an environment such as a college dorm where there might be plenty of people connected via hubs (i.e. anyone on the hub can snoop everyone else's packets), this is a good thing to have... not that I would know anything about that...

Actually, you're not safe in a switched environment either. See dsniff for more information.

Re:Thank god

[Anonymous Coward]

Holy crap this thing is brilliant! Thanks! :-D

Re:Thank god

[Anonymous Coward]

I believe that iChat only uses SSL to authenticate you at login to accomodate sn@mac.com sn. Conversations do not go over SSL.

Gaim-E

[jonman_d]

Gaim already has such a project. Anyone use it? I've tried it in the past, but couldn't get it to work.

Re:Gaim-E

[Anonymous Coward]

Since most AIM users don't use Gaim, I guess "Gaim-E" will have to work on changing their encryption scheme to be compatible with the official client?

Re:Gaim-E

[Anonymous Coward]

Its actually quiet good. I do use the gaim encryption and it works perfectly. It implements it in an easy to understand way. Another reasion gaim, is more than just AIM!

Re:Gaim-E

[waytoomuchcoffee]

Actually, AIM already had this since last year, for corporate users. Also, the Hushmail has been doing this for a while now too.

Re:Gaim-E

[Anonymous Coward]

It doesn't work at the moment, because gaim changed the plug-in interface in version 0.64.

Re:Gaim-E

[szmccauley]

There are two encryption projects for gaim over on sourceforge. gaim-e and gaim-encryption. The former uses gpg while the later uses openssl. I've been using the gaim-encryption for about a month now, very easy to compile into gaim as a project. I found this to be a bit easier to use since the keys are generated automagically, but if you want to go a more secure route you would probably want to go with the gpg model, since you have better control over trust.

gaim-encryption

or

gaim-e

Re:Gaim-E

[mobets]

I use gaim now, but before I made the switch, I used Trillian. It has had encription for AIM and ICQ for quite some time now.

Re:Gaim-E

[CyberWolf]

Actually the plugin API changed in 0.63, and will change in 0.65; gaim-e has not been working since gaim 0.60 due to moving gaim to gtk2 (from gtk).

However, I am working with the gaim-e author to port it to the 0.6x versions of gaim...hope to have it done this coming week (work permitting)

Just my two cents worth

Re:Gaim-E

[CyberWolf]

Sigh...I will say it again....

gaim-encryption's licensce is not compatible with gaim's licensce. Until the issue is resolved, you have to stop using either gaim-encryption or gaim. The author of gaim-encryption is aware of the issue and is working to correct it. If you want to use gaim-encryption, wait unitl it releases a version that will not violate gaim's licensce.

Just my two cents worth

Re:Gaim-E

[CyberWolf]

Gaim's encryption plugins are protocol independant. The only requirement is that both users have to use gaim and the same plugin (gaim-e is not comaptible with gaim-encryption)

Re:Gaim-E

[CyberWolf]

You mean gaim-encryption? or gaim-e? Two different plugins, two different approaches to encryption.

Gaim-e uses GPG encryption. Currently does not work in 0.6x versions of gaim.
Gaim-encryption uses openSSL. Currently is not compatible with gaim's licensce, therefore, stop using gaim-encryption until the issue is resolved.

Just my two cents worth

Re:Gaim-E

[CyberWolf]

Sorry about the copy-and-paste, but it is easier thatn retyping everything.

Yes, gaim-encryption is nice, but it's licensce is not compatible with gaim's licensce.

Using gaim-encryption breaks gaim licensce (gaim uses Debian's interpretation of the GPL). It has been discussed by the gaim developers and, if asked about gaim-encryption, they will tell you to stop using it (or stop using gaim) until the author of gaim-encryption fixes the licensce issue (he is aware of it, and is working to resolve it).

Just my two cents worth

Re:Gaim-E

[greenrd]

Gaim-encryption uses openSSL. Currently is not compatible with gaim's licensce, therefore, stop using gaim-encryption until the issue is resolved.

The license incompatibility does not apply to users. Use is not restricted by the GPL or BSD licenses! Only distributors are affected.

Re:Gaim-E

[CyberWolf]

Or to software authors. The author of the gaim-encryption plugin had the best intentions (and he is working on fixing the license issue), however the plugin, they way it is written at the moment, creates the license problem.

Yes, you can use the plugin if you want, but that would be similar, but not quite the same as, using a bootlegged copy of windows. The choice is yours, just don't expect the gaim developers to be happy about you using a plugin that violates their license.

Start of something bigger?

[waytoomuchcoffee]

Why is this kick ass? Because of the following little gem on the on the beta description: "[m]essages sent between AIM members can be digitally encrypted and signed." This might be the first time a product for the masses will actually lead to people learning about digital signatures, and setting up their own. You can see where this is leading -- people will get interested, and start to look into encryption in general. This could be the start of mass acceptance of encrypted and signed email. I am tired of looking like a paranoid geek for signing my emails -- I do it for solidarity, and to raise the privacy/encryption consciousness of those getting my emails..

Re:Start of something bigger?

[SkArcher]

My main interest in digitally signing electronic messages is to stop pr0n-spam instant messages.

Re:Start of something bigger?

[Anonymous Coward]

I heard Phil Zimmermann speak a few months ago, and he described why he was very cautious about signing emails. With digital signatures now being recognized as legal in courts of law, do you really want to be legally bound to everything that you happen to say over email?

Re:Start of something bigger?

[Anonymous Coward]

Maybe people should be. If they were, we'd have less spam and fraud, or at least an easier time convicting people.

Re:Start of something bigger?

[Anonymous Coward]

E-mail contracts have always been legally binding in the same way that verbal contracts are.

Signatures don't really change anything. Don't make a promise you can't keep. Especially in writing.

Re:Start of something bigger?

[Anonymous Coward]

What I see is that this is only for the enterprise version of the product, have no fear we're still 100% protected from ourselves as well as terrorists because the regular AIM won't be encrypted.

Re:Start of something bigger?

[teslatug]

"I do it for solidarity, and to raise the privacy/encryption consciousness of those getting my emails."

You mean you don't actually do it to ensure the validity of the source of your emails?

Re:Start of something bigger?

[gathond]

No but the signature gives it more legal weight, since almost any idiot can write an email which appers to have been sent from your email (you could argue this in court). This is somewhat harder if your digital signature is on the email.

Re:Start of something bigger?

[Jellybob]

I hate to break it to you, but Outlook Express (everyone's favourite mail client) has supported digital signatures for as long as I can remember, and nobody seems to care about them there - why will this be any different?

Re:Start of something bigger?

[wirelessbuzzers]

Easy to deal with. Put in the default comment block for that key, "This signature is for authentication purposes only. It is not legally binding."

In fact, you probably don't have to worry about it anyway. You aren't legally bound to stuff you write in say a postcard, even if you sign it, unless you put in a bunch of legalese.

[Obligatory -- IANAL]

Re:Start of something bigger?

[mobets]

last I checked it only supported keys from Varisign or some other company that wanted way to much money for a limited time key. Maybe that is why no body used it.

Re:Start of something bigger?

[TC (WC)]

Sure you're legally bound to it... If I say, in a postcard, that I'll give you $500 when you give me your monkey, and then you communicate back that you agree, it'll quite probably hold up as a contract, as it's a meeting of minds. It'll probably hold up as the equivalent of a verbal contract, I've never looked into it, but it's definitely a form of contract.

Re:Start of something bigger?

[wirelessbuzzers]

Oop. you're right

Re:Start of something bigger?

[bheer]

Outlook Express (and Outlook and Netscape Mail) have supported S/MIME for ages. All support keys signed by any CA. Hell, they'll even accept a self-signed key (no one else will probably accept it, though). You can get a free trialware-grade S/MIME key from Thawte, if you want to try S/MIME out, go to www.thawte.com and look for "free personal email certificate".

Btw, if you want free keys, stick to PGP. Signing X.509 certs (which is what S/MIME uses -- supported in Outlook Express, Outlook and Netscape Mail IIRC) is a costly affair -- due diligence in identity verification costs money, and any CA which doesn't charge is probably not doing identity verification and shouldn't be trusted.

Incidentally, the whole reason of why S/MIME never took off is that not too many people were willing to pay for signed CA certs (which use a pure X.509 hierarchical-trust model) for secure email where PGP keys could be had for free using a web-of-trust model.

Re:Start of something bigger?

[Uart]

this is true, but the lack of a signature on an email won't prevent the same communication from being enforced. Assuming your offer meets all of the requirements to make it enforceable, then it would be better than a verbal contract, because it would be documented.

better, of course, in the sense that the courts don't have to dig through alot of "he said/she said" evidence in order to make a ruling, if it was disputed, of course.

trillian

[Anonymous Coward]

Trillian offers secure instant messagin, given that both sides have it enabled, which is rare.

Re:Trillian

[dunham]

When I last checked Trillian negotiated its 128-bit blowfish encryption key via 128-bit DH key exchange, which is not very secure. (It's about as secure as using a 128-bit RSA key.)

Re:Trillian

[sahrss]

I don't know enough about encryption to comment on this...but I'll look into it, thanks. :)

Also I forgot to include a link to Trill's SecureIM page, which shows that you're right about the encryption method:
"Trillian utilizes 128-bit Blowfish encryption with a Diffie-Hellman Key Exchange to secure your conversations. Keys are negotiated per session."

Re:Trillian

[Anonymous Coward]

Mod this up, it's important

Re:Trillian

[dunham]

Yeah, I got the 128-bit blowfish part from their web page. This would be fairly secure encyption, but their protocol weakens it by using 128-bit diffie-hellman (DH). Currently, the discrete log problem is about the same complexity as the factoring problem, for which conservative people recommend 1024 bits or better. (And never less than 512 bits.)

I determined that they used 128-bit DH from packet dumps. The DH negotiation is done in hex characters in the first few messages between the users. (Later, the actual encrypted data is sent in binary form.) It's also interesting to note that they appear to use the openssl code.

I believe this could be broken in about a day or two on modern machines, but I don't have exact numbers. So you can decode monitored trillian traffic without too much effort.

A second issue with their security is that the DH exchange is susceptible to man-in-the-middle attacks. So AOL wouldn't have to break anything, just intercept the communications. Without a certificate, you can't tell if you're exchanging keys with your AIM Buddy or AOL.

Finally, as Bruce Schneier frequently points out, it is unwise to use any security protocol that hasn't been publicly disclosed.

Re:Trillian

[Anonymous Coward]

Nice, thanks.

Re:Trillian

[apankrat]

However it is vulnerable to man-in-the-middle attacks, which renders it pretty much useless as a mean of any serious protection. The reason Trillian supports it only for ICQ/AIM is because the protocol allows announcing extra client 'capabilities'. Trillian messenger uses this feature to notify peers that they are capable of 'trillian encryption'. Note that this is done via AOL servers, which may at some point decide not to propagate this 'unauthorized' capability and Trillian's encryption will suddenly stop working.

New AIM encryption is not much better either -
* their backend is essentially their CA
* the clients can be forced to relay messages through the server
and these two combined mean that the backend is in the perfect position to launch m-n-m at will.

The transparency of the encryption is two-edged sword - on one hand it certainly provides no-hassle protection, but on other it can trick a user into false sense of security, if the former does not really understand underlying protection principles.

Re:Trillian

[Linknoid]

Ok, I don't claim to be an encryption expert, but I have studied the mathematics behind both Diffie-Hellman key exchange and RSA encryption (and implemented DH for a game and RSA as proof of concept: wow, 32 bit key :-) ), and I'm not sure why you would claim DH needs similar key sizes as RSA, maybe someone who knows could enlighten me. Anyway, here's what I know:

RSA private keys are two primes, and the public key is the product of the two primes. So in other words, if you have a 128 bit RSA public key, breaking the key is reduced to searching for two ~64 bit primes, and primes are much more sparse than composites.

But with Diffie-Hellman, as long as you use a Sophie-Germain prime for your modulo, the potential key size is the full 128 bits. In other words, to break a diffie-hellman key, you have to brute force through each 128 bit number to find the discrete log which is the rest of the key. To anyone who truly understands the pitfalls of these two schemes, is my reasoning off base? Is Diffie-Hellman really as insecure as RSA at the same keysize?

Re:Trillian

[slamb]

Finally, as Bruce Schneier frequently points out, it is unwise to use any security protocol that hasn't been publicly disclosed.

It's certainly unwise to depend on a security protocol that hasn't been publicly disclosed. In this case, I think that most users would send the same thing with or without encryption. Using a potentially-good/potentially-bad system is better than sending it in the clear.

Re:Trillian

[gad_zuki!]

Also, I believe Trillian was the first IM to provide end to end encryption. Its been a long while since my sessions with other trillian users have been plain-text.

Its nice to see a big company embrace encryption like this. Sure, they could just be slightly paranoid about various AIM sniffers out ther, including their own. I guess that idea didn't go too far.

Actually, I'm not too surprised. In an electronic world full of plain-text mail, plain-text passwords, plain-text just about everything short of SSL pages, VPN, PGP mail, and ssh tunnels theres going to be a breaking point. Are users going to force vendors into providing encryption? With the popularity of wireless networks and free "network administration" tools with GUI front-ends no less, then perhaps encryption will be the new industry buzzword in the near future.

Re:Trillian

[waspleg]

i have a bigger question for you

what happens when the FBI comes knocking and wants to see some aim chat in real time and AOL, known for law enforcement cooperation, has to have a way of decrypting the messages right?

makes you wonder just how private it will be (or is)

So that's what they did...

[Albanach]

with W.A.S.T.E.?

Trillian...

[swtaarrs]

Trillian has had this feature for as long as I can remember using it.

Re:Trillian...

[eddy]

But Trillian is bloated flashy-ware, while Miranda (nightlies here) is slim and nice.

Encryption supported via SecureIM (DH/KE + AES) or gnupg plugin

Re:Trillian...

[Anonymous Coward]

There are only 10 types of people in the world; those who understand binary and those who don't.

For Chirst sakes man get fucking original! Signatures' are too be unique, not a band-wagon!

Re:Trillian...

[ptbarnett]

Trillian has had this feature for as long as I can remember using it.

But, doesn't Trillian make the connection directly between the two clients, rather than sending it through the server?

It doesn't work well when either user has a firewall blocking incoming connections.

Re:Trillian...

[swtaarrs]

I'm pretty sure that trillian sends the encrypted data through the AIM server, because I've had encrypted sessions with both me and the person I'm talking to behind a router/firewall.

Re:Trillian...

[Trinition]

My understanding is that it does not, it uses the normal AIM channel (or direct channel if you happen to be connected directly). It just sends the encrypted data and handshaking as though it were the message itself. In fact, I believe it works not just with AIM, but with any of AIM's supported mediums (AIM, Yahoo, MSN, ICQ, soon to be Jabber, etc.)

Re:Trillian...

[Anonymous Coward]

I use Trillian constantl through my firewall, and my other friends firewalls, and it sets up an encryption layer just fine. No tinkering around required, just activate it and away it goes.

Re:Trillian...

[Telastyn]

But works much better when the third party server is owned by a mega-corp.

Re:Trillian...

[Anonymous Coward]

No, Trillian communicates over regular AIM (it uses OSCAR even, and not TOC, if that means anything to you). When using encryption, it sends the ciphertext over the same channel, and decrypts seamlessly on the other end.

You can do a client-to-client connection, though, just like with AIM, in which case, it wouldn't pass through the server, encrypted or not.

Re:Trillian...

[Anonymous Coward]

Tried Miranda, hated it. Tried Trillian, loved it. Different strokes, I guess.

One sizable difference between the two is that for AIM, Trillian uses the OSCAR protocol, just like AOL's client, and iChat, and *NOT* the TOC protocol that 'everybody else' uses. This means that it supports sending buddy icons, direct connections, file transfers, etc, etc, natively with other AIM clients.

Trillian

[sahrss]

Trillian already supports 128 bit encryption over AIM and ICQ between Trillian users.

Size of Key?

[webdevcoder]

Hopefully they will offer secure-level keys for their services.

Re:Size of Key?

[dknj]

So, how is AIM going to sell their Enterprise AIM Services? Something doesn't smell right

-dk

Re:Size of Key?

[Anonymous Coward]

From the link - I think they have some fundamental problems to fix before they start talking about key size...

What a Private Key encrypts, only the corresponding Public Key can decrypt, and vice versa. With AIM all of these sophisticated checks are performed without noticeable delays in speed of message exchange.

I personally thought the public/private key was the other way around. Public key encrypts, private key decrypts. Hope they can fix this before the spec is handed to the devs... Oh, and I saw another post somewhere about securely exchanging these keys. That's not required... you just distribute the public key to the sender and keep the private key to yourself. No need to keep that transaction secure (unless you wanted to hide the fact that you're sending your public key out.

Locking out clients?

[mkro]

Will they finally be able to make AIM incompatible with unauthorized (Read: Open source) clients?

Re:Locking out clients?

[s10god]

Now there is an underhanded method Trillian connot fight... Use special new encryption and claim DMCA protction. ... And AOL is enough of a bunch of bastards to do just that.

Re:Locking out clients?

[Anonymous Coward]

If they wanted to lock out clients, they probably wouldn't have written a plaintext protocol and released it under the GPL.

Re:Locking out clients?

[MankyD]

I suppose they'll have to give more details about the encryption methods used. But not every conversation is encrypted. You have to install a certificate (as does your counterpart) before the encryption goes into effect.

Re:Locking out clients?

[PotPieMan]

That is the TOC protocol. All new AIM clients use the Oscar protocol, which is not open.

Re:Locking out clients?

[anthony_dipierro]

Not if it's end-to-end encryption, which is the only kind that's useful anyway.

Re:Locking out clients?

[csnydermvpsoft]

Lots of OS clients, such as GAIM, use the Oscar protocol.

Re:Locking out clients?

[Anonymous Coward]

you have to enable encryption. They can't stop that.

Re:Locking out clients?

[jaavaaguru]

If that happens, why not use something better such as Jabber then?

Re:Locking out clients?

[Hanji]

Because as nice as Jabber may or may not be theoretically for whatever reasons (I don't know anything about it), AIM has one BIG advantage: EVERYONE USES IT. And if you try to get people to switch to a Jabber network from AIM, explaining that it's "open," you'll just get blank stares, and comments that "but all my friends use AIM!"

Technical superiority does not ensure success, unfortunately.

Re:Locking out clients?

[PotPieMan]

Yes, but they had to reverse engineer it. IIRC, it was reverse engineered first in libfaim.

What about Trillian

[Tensor]

Trillian has had SecureIM over the ICQ protocol for AGES.

I never realized that would make it an illegal product to use in some states :)

Prior Art

[Tuffnut]

SimpLite for AIM.

Acts as a proxy for your AIM client and allows encryption of your messages. Course the person you're talking to has to have this installed as well in order to have the convo encrypted.

Re:Prior Art

[Anonymous Coward]

What does prior art matter when they aren't saying "We're pattenting this and shutting down competing projects?"

Re:Prior Art

[Tuffnut]

im just saying there was something before this was out, and they're making an entire article about it, you clod.

AOL using encryption

[PirateDave -)]

It already is encrypted, isn't it?

foxy28uk192323342 says: h1 asl lol
brandon343jfdh says: lol brb fs

Maybe I'm just cynical :/

Re:AOL using encryption

[orthancstone]

LMAO - very true.

Gamers everywhere will just continue 1337-5p34k for encryption I suppose :).

Why?

[Tyrdium]

I don't know about other people, but my conversations on AIM usually go like this: Me: Hey Other guy: Hey Me: Anything interesting happening? Other guy: Not much. You? Me: Not much. Hey, wanna play Starcraft? Other guy: Sure. See you on in a few minutes. Usual channel. Me: Okay. See you there. Frankly, I couldn't care less whether or not anyone else was reading that, and I bet a lot of people feel the same way. It's a nice feature, sure, but it's not the most needed...

Re:Why?

[PirateDave -)]

But at least we're now safe to discuss our credit card numbers

Actually, this could have some ecommerce potential

Re:Why?

[Tyrdium]

Gaaa... Bad formatting... I don't know about other people, but my conversations on AIM usually go like this:

Me: Hey

Other guy: Hey

Me: Anything interesting happening?

Other guy: Not much. You?

Me: Not much. Hey, wanna play Starcraft?

Other guy: Sure. See you on in a few minutes. Usual channel.

Me: Okay. See you there.

*Other guy puts on away message*

*I put on away message*

Frankly, I couldn't care less whether or not anyone else was reading that, and I bet a lot of people feel the same way. It's a nice feature, sure, but it's not the most needed...

Re:Why?

[Lemuel]

That's pretty much how my personal usage goes, too. At work, though, we are loath to send company business over the wire in plain text, so this feature could be useful for businesses.

Re:Why?

[matttastic]

Because hundreds of people will flood to buy from PirateDave!

PirateDave - The name you can trust

Re:Why?

[kalidasa]

I have some pretty long and complex conversations over ICQ. So I'd say your mileage may vary.

Re:Why?

[sahrss]

Some users (like me) have fairly serious or business conversations over these chat networks. Using unsecure chat is like speaking in a room with hidden nooks and cracks in the walls leading to other rooms; anyone can sniff an unsecure chat.

I much prefer conducting my semi-private conversations in a high tower with thick walls, where strangers cannot overhear them.

Trillian is what I use right now to allow this, but it only works with Trillian users, not normal AIM users. It would be nice if AIM made their encryption scheme usable by other clients...although I agree with other posters that it may just be a plan to keep other clients off the network.

Re:Why?

[Anonymous Coward]

My conversations usually go something like this:

Me: Hey baby

Mistress: Hey lover

Me: what are you wearing?

Mistress: not much

Me: Gotta run, my wife just got home!

So, I'm all for encryption...

Re:Why?

[PirateDave -)]

It's funny because it's true

Re:Why?

[jspoon]

You mean you've never had conversations in which you idly speculated about assassinating the President or various members of the Cabinet? I must be the only one. Seriously, I ran a packet snuffer on my college network last year working on an unrelated project, looked at a couple packets from AIM and saw some things I wish I hadn't seen. If they'd been using encryption, my sanity and innocence would have been preserved.

Re:Why?

[exspecto]

You got me interested. What kind of "things" did you see?

Re:Why?

[carpe_noctem]

Even if you're talking about the most banal things in the world, using encryption is still necessary in an insecure world. Even though each conversation you have may be insignificant on its own, the sum of all conversations you have may provide enough information about your life to put you at risk.

Re:Why?

[secolactico]

It would be nice if AIM made their encryption scheme usable by other clients...

Well, maybe not other AIM clients (eg trillian), but remember that the deal with MS will allow the IMs to interact? It's a reasonably safe bet that MSN messenger will be able to exchange secure messages with AIM.

Re:Why?

[Lord Ender]

Yes, well, I have used a packet sniffer (ethereal) to see what my roommate was saying about me behind my back over AIM. It would suck to lose this power. Of course, it sucks that he could do it to me, but luckily, he is too damn dumb.

Re:Why?

[Daetrin]

My conversations frequently run along the lines of,

Me: Did you hear that Powell is claiming that the American populace is "quite assured" about the reports on WMDs in Iraq and only the media is claiming they're "bogus"? I'm glad to know that i'm convinced, aren't you? =P

Them: Where did you see this?

Me: Front page of CNN

Them: Didn't he try the same thing with the UN a few months ago?

Me: Maybe, but this is the first time i've seen him quoted as saying he knows what i think, and i'm really pissed off.

Note that if Bush gets elected again, the above conversation might become illegal and be punishable by having my citizenship revoked or something, so encryption on chat programs would be a very good thing.

Re:Why?

[Majik]

For [enterprise] business communications, your conversations should really move to Jabber using SSL. I've led a similar conversion at my job, and after a little end-user training people were quite happy. You free yourself from the coming standardization war, have the opportunity to implement new functionality etc.

Otherwise, gaim has a patch for GNU TLS support, it just hasn't been updated in *forever*. I'm sure trillian would recipricate and implement OpenSSL support for interop with gaim should gaim support tls anytime soon.

Also, I'm not entirely certain that the new AIM encryption features are aimed at home users. Business users are the target market I'm guessing (See Above).

Re:Why?

[Anonymous Coward]

Elected again? When was he elected for the first time. I seem to remember that the SC stepped in and stoped the counting of ballots in Flordia before they were finished (as instructed by the state SC which from my understanding is who actually has the power to decided how flordia EC votes are given). Not to mention thousands of blacks being scrubbed from the voter rolls for crimes they didnt commit. Not to mention.....

Re:Why?

[Anonymous Coward]

cybersex - for heavens sake.

for the sake of all those deprived girls in repressed countries - get it!

Re:Gaim-E? gaim-encryption

[kfort]

I find gaim-encryption to be very well done. It works transparently, using variable key sizes, and uses a security model similar to that of ssh. Kirk

Necessary?

[Blutarsky]

While I genuinely applaud the efforts to bring secure communications to the masses I am left wondering what kind of person requires a digitally encrypted AIM session...

Re:Necessary?

[spazoid12]

The kind of person that wants to believe that his/her AIM conversations are now secure, from say...his/her employer.

But, I think AOL just wants less competition in the field of software sold to employers.

How long until someone says AOL is enabling terrorists? Maybe a long time...maybe the encryption used is pretty weak.

Or, I wonder if AOL has a new office in Anguilla.

Re:Necessary?

[anthony_dipierro]

Are you kidding me? Haven't you ever sent passwords over AIM? Haven't you ever talked about last night's drug use?

Umm, neither have I. Drugs are bad, mmmkay?

Re:Necessary?

[The Creator]

I am left wondering what kind of person requires a digitally encrypted AIM session...

Any person with the right to private conversations perhaps. :)

Little late....

[jr87]

I think AOL is putting this out way too late. Other messanger servieces such as Gaim and Trillian have had encryption in for a while now. These services also have a lot of other features that make them superiour to the aim client. Why get AIM?

Re:Little late....

[angryLNX]

Because everyone else will be getting this client and you want your encryption to be compatible? ;)

Re:Little late....

[Anonymous Coward]

You do realize that there are people out there that use the official AIM client. Just because it's an advanced feature that Trillian and GAIM already had doesn't mean no one with the official AIM client will use it. -Tim

Re:Little late....

[Slack3r78]

Last time I tried, file transfers and direct connect don't work properly on the nonofficial clients. That could have changed (it's been a few months), but in the meantime, that's a good enough reason for me to use it.

Re:Little late....

[dknj]

Other messanger servieces such as Gaim and Trillian have had encryption in for a while now.

i'll bite. Gaim and Trillian are not services, they are clients that connect to the AIM service. Gaim and Trillian are used by a small portion of users. Personally, I prefer AIM over gaim or trillian mostly due to looks. Now if AIM has native support in their clients, then _all_ users can benefit, not a small handful

-dk

Re:Little late....

[Anonymous Coward]

I guess it's just me, but I've always thought that AIM was the ugliest of all the big players. Yahoo, MSN and ICQ official clients all look a lot better to me. Not to mention the absolutely horrible looking smileys.

The only reason everyone uses AIM is because everyone (in the USA) uses AOL and it comes with it. Up here in Canada, most people use MSN (and hardly anyone uses AOL for internet service, coincidentally or otherwise). If you turn off all the stupid toolbars, it's actually got quite a nice client, easily the best of the official ones. Miranda and Gaim are my favorites though.

As for your point about it benefiting everyone; it doesn't. It benefits users of AOL's official client only. Almost anyone with half a brain (ie. anyone who's not an aol sub) is probably using Trillian anyways.

My 2c.

A Little Suspicious

[Afbc0m]

Nullsoft, a subsidiary releases WASTE, a p2p files and chat client with encryption AOL pulls WASTE AIM, made by AOL, gets encryption Coincidense...?

Re:A Little Suspicious

[Afbc0m]

I swear I can Format
Nullsoft, a subsidiary releases WASTE, a p2p files and chat client with encryption

AOL pulls WASTE

AIM, made by AOL, gets encryption


Coincidense...?

sure hope Apple adds this to iChat

[SweetAndSourJesus]

Since iChat is one of the few "authorized" AIM clients, maybe it will get access to this.

Re:sure hope Apple adds this to iChat

[bedouin]

Actually, there's something I'm more interested in. Since MSN and AIM are supposedly going to merge, would that mean I could dump M$'s messenger client in OS X, and just use iChat? Unfortunately all my friends are on MSN . . .

Re:sure hope Apple adds this to iChat

[robertchin]

>Unfortunately all my friends are on MSN . . .

Looks like it's time to get some new friends.

Re:sure hope Apple adds this to iChat

[ball-lightning]

While AIM is (in my opinion) better than MSN Messenger, it has a few neat Quirks to it, like the ability to change your nickname, that sort of thign (does lead to confusion at times) It's relatively stable, and isn't (as far as I can tell) really bloated. The messenger I really can't stand is ICQ. Its just bloated, hate the interface, just horrible.

Re:sure hope Apple adds this to iChat

[Anonymous Coward]

Golly, one would hope so. It's not like "encrypted chat" was on the feature list for iChat at last year's World Wide Developer Conference in San Jose when they showed the program. Oh wait, yes it was...

The next step...

[yintercept]

...is to for someone somewhere to actually write something in AIM that is worthwhile to encrypt.

Personally, I think the original security of instant messaging was sufficient...that is, there is so much white noise, that the data stream just isn't worth tapping into.

Re:The next step...

[jellomizer]

Well IM is starting to become the most common form of electronic communication and it is generally taking the place of E-Mail for a lot of situations. Although most of the time now it is for personal communication. But IM can have more business application which needs encryption for Business to Business communication (to prevent corporate espionage) and also to do business over IM, such as customer support or placing an order over IM (say for some custom orders that normally have to be over the phone) so encryption is very important for IM. And it is worth it.

Re:The next step...

[orangesquid]

PotatoBob: Hey, can I place an order
AcmeCoSales: Of course. To where is this being shipped?
PotatoBob: 17 Applebrook Lane, Milwaukee
AcmeCoSales: What is your order?
PotatoBob: One Potato Gun, model XM-4201B
AcmeCoSales: Is that everything?
PotatoBob: Yes
AcmeCoSales: Your total is $134.99
PotatoBob: That can't be right.
AcmeCoSales: It is correct. That is the price in our catalog.
PotatoBob: No, it's not.
AcmeCoSales: Yes, it is.
*** You have warned user AcmeCoSales. His/her warning level is now 20%
*** You have warned user AcmeCoSales. His/her warning level is now 40%
*** You have warned user AcmeCoSales. His/her warning level is now 60%
*** You have warned user AcmeCoSales. His/her warning level is now 80%
*** You have warned user AcmeCoSales. His/her warning level is now 100%
*** User AcmeCoSales has Signed Off.

Re:The next step...

[Anonymous Coward]

Huh?

And you trust them?

[cperciva]

Quite apart from the issue of security holes, does anyone trust AOL-TW to even *try* to make this secure? I'd be extremely surprised if they weren't keeping AIM keys in "escrow" where the NSA^W FBI^W Department of Homeland Security can access them.

Re:And you trust them?

[gearheadsmp]

Here here! The idea of a major corp. distributing peer-to-peer encrpytion is somewhat odd in the Age of Ashcroft. I'd trust AOL's closed-source AIM solution about as much as the integrated "file encryption" that is in 2000 and in XP. Otherwise, AOL would find themselves under scrutiny for letting "terrorists" use AOL's software to share video clips of Ashcroft trying to dance at the Prom.

Re:And you trust them?

[anthony_dipierro]

The idea of a major corp. distributing peer-to-peer encrpytion is somewhat odd in the Age of Ashcroft.

https://dont.use.ie/

Re:And you trust them?

[The Lynxpro]

I trust AOL Time Warner far more than I do Microsoft. It was Warner Communications that funded Atari's rise...hence the prominence of video games in entertainment value today. Time Warner spent a fortune developing DVD and fought off Circuit City's attempts to corrupt the format. When was the last time a DVD crashed on you? AOL has funded Linux start-ups, spent resources on the development of the Mozilla web browser, funded TiVo and Palm, not to mention bringing email and internet access to the masses. Joe Consumer chose AOL as their internet provider. They really didn't choose Microsoft products; they were chosen for them...

Re:And you trust them?

[Traa]

Quite apart from the issue of security holes, does anyone trust AOL-TW to even *try* to make this secure? I'd be extremely surprised if they weren't keeping AIM keys in "escrow" where the NSA^W FBI^W Department of Homeland Security can access them

The alternative being that you don't encrypt your AIM messages and leave your 'secret-chat-sessions' visible for everyone.

What do you really have to hide from the governament?

Do you simply not trust your governament to recognize that your harmless chat wasn't a plot for terrorism? This is a valid concern and not nescecarily paranoia. But if you don't trust the governament, you surely don't trust large corporations and so by your own distrust wouldn't trust AIM encryption to start with.

or

Are you doing something ileagal, in which case you are a moron for using AIM (besides being a moron from doing something ileagal :-)

AIM adding encryption is going to be a BIG relief for all those 'secret love chat sessions' between the millions of anonymous people out there who are deadly afraid that there legal partner might stumble upon the un-encrypted chat session.

sad, but true.

Re:And you trust them?

[kaltkalt]

Yep, would be very Unamerican for them to not give ashcroft the keys in escrow. If they didn't do that, they'd be with bin laden.

Re:And you trust them?

[Anonymous Coward]

No, the alternative is to use one of the many open source alternatives. Gaim-E or gaim-encryption for instance. Nobody who takes security seriously is going to take this closed source unverified back-door ridden POS seriously.

Re:And you trust them?

[Anonymous Coward]

"Are you doing something ileagal, in which case you are a moron for using AIM (besides being a moron from doing something ileagal :-)"

Speaking of moron's, I can't stand the people who can't spell illegal correctly, the :-) does not justify it when you own a domain name.

sounds like

[acidrain69]

You've got !$$%!#13%$f#%^djh23r#R*ds*W@#HN

Really makes me wonder

[ONU CS Geek]

If AOL has any ties to Verisign, et al.? If it's using PKI (which it says it is), and the "About AIM Personal Certificates" page (Link Here) says it is (which really doesn't go into how they're implemented, or how you can get a certificate), who's to say that they're not going to charge you for getting a certificate? Yahoo integrated encryption in their Yahoo Messenger Enterprise, and other companies have done this in the past (I believe that even ICQ had a version of their server up so that companies could set their own ICQ servers up).

I honestly think it's all about the Money for AOL, and it's going to be prohibitive for Joe Sixpack to get this to work.

Re:Really makes me wonder

[PetWolverine]

--

I disable sigs [slashdot.org]...do you?

Is that a rhetorical question?

WASTE Controversy

[ipour]

This beta goes a long way to explaining the WASTE posting/unposting that went on last week. Clearly AOL wants to encourage the message encryption through AIM and not another program, and certainly not one under the GPL. Note that AIM is MORE than willing to provide you with a public key (at a nominal fee of course).

Re:WASTE Controversy

[PirateDave -)]

In all fairness, the two products are not related. WASTE was basically a p2p file sharing thing while this encrption is for AIM

The two events may be related, but I doubt that they are dependant.

Re:WASTE Controversy

[cristofer8]

Actually, WASTE wasn't really about file sharing at all. Sure, it could share files, but it was really about creating a small community within which everything, chat, filesharing, anything you needed to do with them, was encrypted. It didn't scale beyone 50 users, making it pretty useless for Kazaa/Gnutella style file sharing. But perfect for groups of friends or groups at a company who needed to be in constant communication and didn't want to be spyed on.

On the other hand, this is simple encryped IM over aol's servers. WASTE had no servers and was completely decentralized. This IS interesting, but I doubt AOL will make it easy to use. As it is in this beta, the options are buried in the already obscure preferences panel, and I still have absolutely no idea how to go about getting a certificate. It just tells me that I'm not "subscribed..."

we await silent tristero's empire

[discogravy]

would this be why W.A.S.T.E. was killed? I would guess so. Or...is this AOL's co-opting of WASTE itself? have they just taken the GPL code that was posted for that one day and slapped AIM on it?

Re:we await silent tristero's empire

[nounderscores]

and if so, can the FSF or Nullsoft or somesuch do a reverse SCO and sue for breach of licence?

_____________________________________
The Spiders are Coming. Episode 4: June 10,2003

Re:we await silent tristero's empire

[Omestes]

Very nice Pynchon... Very nice...

To bad I lack modpoints, and a new cat called "+4 clever pun"

(For those who don't grok, read Pynchon's Crying of lot 49)

Re:we await silent tristero's empire

[discogravy]

it's not a pun; or rather, it's not my pun. When you installed the software, the windows icon was a WASTE muted horn. not unlike the one at http://www.waste.org/pynchon-l/

I use AIM to deal drugs...

[Anonymous Coward]

You insensitive clod!

I don't believe it.

[TerryAtWork]

If it isn't completely open source then they are running a man in the middle scam and recording the entire encrypted session in the clear.

All for our own protection, of course....

Re:I don't believe it.

[Anonymous Coward]

you can do that even if it WERE open source- unless you've got the public key of the other party, and you trust that it IS their public key, any DH and RSA exchange is vulnerable to an active man-in-the-middle attack.

Re:I don't believe it.

[JDBrechtel]

They could be encrypting the data to two keys in all cases. One of the party you're speaking to and one they have access to.

Unless you can see the code doing the encrypting then you can't trust it 100%. But hey...even then you can't trust it 100% unless you compilied it.....and you compilied the compiler that compilied it...by hand...yea....

Re:I don't believe it.

[TerryAtWork]

Absolutly right, and thanks for pointing that out.

Hmm..

[CausticWindow]

Judging from the previous posts here, not many see this as a necessary feature.

Who do you think'll use this? Drug dealers will. Terrorists will. Is your privacy so important as to accomodate these groups?

Maybe the government ain't so far off anyway.

Re:Hmm..

[heff]

for my roomate, who we discovered liked to visit the aol gay and bi chat rooms in the wee hours of the morning and play cheerleader dress up, this would have been very useful.

Re:Hmm..

[abdulwahid]

I have been using Gabber a Gnome Jabber client with its gpg support for sometime. I have quite a few people on my roaster who I can speak to with that extra level of privacy.

I think that case for privacy is strong. I don't like thinking that my personal conversations go in plain text across peoples' coporate networks. I have nothing to hide. What I say though is still private.

Many people don't see it as being an important issue but then would they send all their snail mail by postcard? I think the reason why they don't consider it important is that they are not fully aware of the possible implications.

Re:Hmm..

[cdc179]

If you give up your right so fast, before long cops won't need any probable cause to enter your house.

They already trample on our rights and this is BS. if you volunteeringly give up rights can you say military control, because that's about the type of society we are headed in.

Lets give other countries freedom and then take away our own. What a good policy (load of crap!).

Re:Hmm..

[Anonymous Coward]

I see that terrorists have replaced child porn freaks as the reseaon government should monitor everything. There always seems to be a good excuse to end privacy.

Re:Hmm..

[ruronikenshin83]

Hell yes. My privacy is so important as to accomodate drug dealers and terrorists.

Why is that? Because when you exclude certain people from the basic privleges and rights afforded them by our Constitution, you open up a big 'ol can of worms.

Exclusion becomes a stepping stone on the road to complete disregard for those privileges and rights.

As Benjamin Franklin once said "Those who give away a little freedom for a little safety deserve neither freedom nor safety."

Re:Hmm..

[stevejsmith]

Yeah...you know, maybe some alcohol and girls would be very useful for you. You know, so that you don't spend all of your time snooping your room mate's packets.

Re:Hmm..

[ptbarnett]

Some(?) Jabber servers and clients also support SSL. You don't have the "signing" capabilities to verify a user's identity, but it would at least discourage monitoring by a third party, as long as you controlled the server.

I've toyed with setting up a Jabber server for my company and switching all our users (spread among MSN, Yahoo, and AIM) to it, so that it would be secure. But so far, no one seems to be concerned about the insecurity.

Re:Hmm..

[yppiz]

people on my roaster who I can speak to with that extra level of privacy.

HannibalLecter: With some fava beans and a nice chianti.

--Pat

Re:Hmm..

[heff]

he was an asshole, i have no regrets. We also uncovered that he was poisoning our leftovers in the fridge (scary as hell) and was planning to replace my gf's shampoo with nair.

Re:Hmm..

[karlm]

Nice troll. Terrorists, drug dealers, and pedophiles will use this. So will jaywalkers and speeders. Heck, even maybe a few of the more subversive PTA members will use it. They will probably also use SSL with stronger than 40-bit keys to buy stuff online! I for one, will only use 40-bit SSL and will not use encrypted IM. Furthermore, I will begin a curtian-burning campaign and push to make envelopes and non-transparent shipping packaging illegal. Terrorists will be less able to send bombs, drug dealers will be less able to mail E, and pedophiles will be less able to exchange smutt. Terrorists will be less able to mix nitrourea in their kitchens, drug dealers will be less able to set up meth labs in their bedrooms, and pedophiles will be less able to hide their dirty deeds.

Burn your curtains! Fight terrorists, drug dealers, and perverts!

Oohh! Let's make it illegal to manufacture or import a car that can go faster than 50 m.p.h. Sure, there a few places that have faster speed limits, but if you can go 70 on a highway, you can go 70 in a neighborhood. We better limit ourselves to 50 m.p.h.

I will also stop buying baking soda and Sudaphed so that Uncle Sam can better track down people making meth and crack in their garages. Better stop buying tinfoil, drain cleaner, oragnge juice, soap, nail polish remover, paint thinnner, peroxide, solid fuel tablets, asparin, bleach, wax, vaseline, deisel or kerosene, instant cold packs, model airplane fuel, ammonium nitrate or urea fertilizers, baby laxitive, amonia, toilet bowl cleaner, or weed killer because terrorists can use those to make incindiaries and explosives. Boycot anything mildly related to anything dangerous! Hard drives, video tape, cameras, film and camcorders are used by perverts! Oh, and lets make smutt sites publish their membership lists, so I'll know which school teachers should be fired as potential pedophiles. I think the American Communist Party should also be forced to publish its membership list, as well as the KKK, and the Freemasons. While we're at it, lets make every mosque, synagog, temple, and church publish lists of attendees online. Lets put webcams on every street light, and next year let's install vidscreens in every room in every building! Freedom is slavery!

If you want to boycott everything that's mildy related to something illegal, you'll have to live in a sod shack (wood is the main raw material in smokeless gunpowder) with no electricity (electrolysis can be used to make sodium chlorate from salt water) and wipe your ass with poison Ivy (natural gas, air, and toilet paper can be used to make nitrocellulose). You better eat snails cooked in solar ovens and vegetables, since knives, and guns (maybe arrows and spears too) are used for crime every day. Natural gas and wood gas can both be used in making explosives, and charcoal mixed with liquid air is a virtually undetectable explosive used by those evil Germans for mining in WWII. Solid fuel tablets can be used to make RDX, butane and propane can be used in fuel-air explosives and their canisters can make good improvised mortar bombs (ask the IRA). You pretty much can't cook without using something that can be made into an explosive. Hope none of your vegetables were fertilized with either of the two most economical fertilizers, as they are the raw ingredients for most car bombs worldwide. Salt, sugar, water, electricity and salt substitute can be used to make the bombs that were set off in Bali less than a year ago, IIRC. A steak knife and a tin can can be used for the annode and cathode in a sodium-chlorate producing electrolytic cell, so you better get rid of those too.

There a litterally thousands of things in your own home that a mildly intelligent person could use to injure dozens if not kill hundreds of people. Crypto is rather mild compared to things you use every day without thinking, and crypto has crime-detering qualites not shared by most of the potentially explosive chemicals in your home. The world is dangerous. Wake up and

Woh! Go AOL!

[Com2Kid]

Freaky to think that AOL is actually, you know, aiding freedom of speech, rather than restricting it through their idiotic TOS.

(I left AOL a looong long time ago when they started censoring their joke sites, bleck!)

Hmm, next thing you know, Time Warner will be offering streaming movies up online with a pay-per-view system in place!

Actually not all that unbelievable, with the cost of computers being so low, maybe the "net convergence" of TV and the Internet COULD come true, daring technology for once being created AND pushed by a big media corporation.

Hmm, video on demand would be nice as well, I know that there have been times that I would be willing to pay a few extra dollars to watch a TV show when ever and not have to wait for it to come on TV at its normally scheduled time. :)

I mean sure there is TV, but then there is "oh yah here is that one really good episode of The Simpsons that you wanted, a $1.50 has been deducted from your account."

But, ah, until then, I'll just enjoy encryption my IMs for, err, whatever reason. And using third party tools to encrypt my AIM logs as well, heh.

Here's how to get a free key

[Anonymous Coward]

Go to Thawte, get their Free Personal Email Certificate for your browser/email. Then, from your browser (it works in Mozilla/IE) export it as a .p12 file. Then go in to the Advanced option in AIM's Security preferences, and import the .p12 file. You'll start getting an extra password prompt and a little lock icon.

Re:Here's how to get a free key

[Anonymous Coward]

but it's already modded all the way up

Re:Here's how to get a free key

[mechaZardoz]

I would be all about it, except for this one little requirement:

"Please enter a national identification number for yourself and indicate the type of this identification below. We accept any official identification used in your country. This could be one of: drivers licence number, passport number, social security number or something else official. A student number or health club card number would not be acceptable. This identification number will be used in the Web of Trust when you wish to have your identity assured. " A quick google search doesn't return any other 'free' cert providers.

Does anyone know of any less restrictive sites?

Re:Here's how to get a free key

[Animats]

Yeah, right. Provide your name, address, date of birth, and social security number, and you get a key.

Thawte originally promised to move the database outside of the US if the US ceased to have adequate privacy protections in law. After the Patriot Act, they should have done so, but they didn't. Thawte today is just a front for Verisign, which, among other things, operates a national wiretapping service for law enforcement and others.

• Stepped-up concern over security has put the heat on carriers to ensure they can meet mandates under the FCC's 1994 Communications Assistance for Law Enforcement Act (CALEA), requiring telecom service providers to support the ability of law enforcement agencies to conduct lawful, authorized electronic surveillance of call content and call data.

  ... One company, VeriSign Inc., offers a one- stop, turnkey solution to help telecom carriers comply with CALEA.

  VeriSign's nationwide signaling network infrastructure, digital certificate technology and secure data centers enable it to provide a scaleable service bureau solution that saves carriers significant capital expense and virtually eliminates administration costs involved in meeting the legal, technical and operational requirements of CALEA.

  Using Verint Systems Inc.'s STAR-GATE, a solution that provides the means to access and deliver intercepted communications content and call data to law enforcement agencies, VeriSign offers a streamlined solution that meets the needs of wireline, wireless and cable telephony carriers. Puri explains that once contracted by the carrier, VeriSign becomes the primary point of contact for law enforcement. "Once we receive the order ... it's completely hands off for the carrier."

  Among the orders NetDiscovery processes are historical call records, pen registers or trap and trace (real-time call data as it occurs), as well as wire taps from both law enforcement and national security agencies. The company's personnel are set up to handle classified orders, having attained the appropriate government security clearances, Puri says.

  In addition to eliminating a carrier's need to maintain such personnel, NetDiscovery also eliminates the need to connect to the thousands of agencies with authority to request information.

  The solution supports circuit switches and beginning this quarter it will support packet-based gear, such as soft switches. The company is working with Cisco Systems Inc. to support its soft switches, routers and gateways. ...

  In addition to Cisco, VeriSign is working with four other "market-leading" vendors to ensure support for their packet-based offerings, it says. ...

  "Almost every provider has some sort of packet-based hardware, so support for packet under CALEA is critical. It cuts across all types of carriers from wireline to wireless to cable MSOs," he says.

  The company is looking also at solutions for ISPs and their gear (routers, gateways, etc.) although they are not included under CALEA, Puri adds.

Verisign just had a session on wiretapping for ISPs at Supercomm. Basically, Verisign runs the US's wiretapping infrastructure. They thus can't be trusted as a security provider.

Re:Here's how to get a free key

[Anonymous Coward]

Why blame them? Someone has to offer the services, or the government will just do it itself and probably at a higher cost. If you want to complain, complain to the lawmakers. Besides, it's frickin AIM.

Re:Here's how to get a free key

[Anonymous Coward]

"Provide your name, address, date of birth, and social security number, and you get a key."

Golly. You have to establish your identity to establish your identity? What's the world come to?

Re:Here's how to get a free key

[kootch]

Actually, I just did it and they ask me to either provide answers to the questions they supply OR supply my own questions and answers.

Your questions could be 1+2=3 for all it matters

Re:Here's how to get a free key

[toast0]

i put in the national identification number 'toast'

it seemed to like this (but it said 'none' was already in use)

Re:Here's how to get a free key

[MrBlue VT]

Actually you don't need to do that at all. I just generated my own CA and key using OpenSSL and plugged it into AIM. It gave the standard warning about how it wasn't signed by an official root, but after that one message, it worked perfectly.

Re:Here's how to get a free key

[toast0]

would you mind sharing your openssl command lines used to generate the stuff? I was able to generate a file using openssl that aim claimed to be importing, but then it refused to actually use it... giving me no help in getting something it'll use.

Re:Here's how to get a free key

[MrBlue VT]

Sure. I used the CA.pl script to do it. The man page is located at http://www.openssl.org/docs/apps/CA.pl.html. Here are the commands I used (make sure to have the openssl binary in your path):

/usr/local/ssl/misc/CA.pl -newca
/usr/local/ssl/misc/CA.pl -newreq
/usr/local/ssl/misc/CA.pl -signreq
/usr/local/ssl/misc/CA.pl -pkcs12

Just follow the prompts and it should generate a .p12 certificate, which you can then import into AIM.

Hope this helps.

Re:Here's how to get a free key

[toast0]

thank you, that worked... goodbye signing messages under the name 'thawte freemail user' :)

Wouldn't be this illegal under the PATRIOT act ?

[Krapangor]

Combined with PDAs/laptops and WLAN access, terrorists could savely use this to coordinate terroristic attacks, especially Al-Kadia's evergreen of equitemporal suidice attacks on free people.
The mighty PATRIOT act should prohibit such devices, won't it ?
I'm not sure if this would be really a bad thing. Dangerous tools are restricted very often to protect people, even if the are many good/peaceful uses.
Take e.g. guns which are restricted in many countries of the world due to their bad possibilities.

Well, it's a start

[randombit]

Realistically, replacing a protocol that uses plaintext with one that uses crypto is good. But I wouldn't trust encrypted AIM for planning any revolutions, folks. To quote one of the linked pages:

"AIM encryption goes beyond basic Secure Socket Layers (SSL) encryption" and "Although SSL is widely used, it does not provide the best security over a Public Instant Messaging network."

This is a big WARNING SIGN, especially considering that a) they provide zero details about what they are using (big no-no in the first place), and b) WASTE, the only other AOLish crypto I've taken a look at, had some fairly serious problems (this was not just my asessment - check the cryptography@metzdowd.com archives for a rundown). This is not exactly confidence inspiring.

Lastly, are they seriously suggesting rolling out a full PKI for all AIM users? Again, details are light so I'm not sure this is what they mean, but it does seem to be implied. If so, someone needs to inform them of the harsh realities of PKI. Certs for AOL users wouldn't be too hard, since they already have addresses, CC #s, etc to let them (at least with reasonable probability) check on people's identity. But everybody else - forget it.

Re:Well, it's a start

[ImpTech]

>Lastly, are they seriously suggesting rolling out a full PKI for all AIM users? Again, details are light so I'm not sure this is what they mean, but it does seem to be implied. If so, someone needs to inform them of the harsh realities of PKI. Certs for AOL users wouldn't be too hard, since they already have addresses, CC #s, etc to let them (at least with reasonable probability) check on people's identity. But everybody else - forget it.

Sounds like a new marketing campaign to me.... instant message securely, only when you sign up for AOL.

Re:Well, it's a start

[slamb]

Lastly, are they seriously suggesting rolling out a full PKI for all AIM users? Again, details are light so I'm not sure this is what they mean, but it does seem to be implied. If so, someone needs to inform them of the harsh realities of PKI. Certs for AOL users wouldn't be too hard, since they already have addresses, CC #s, etc to let them (at least with reasonable probability) check on people's identity. But everybody else - forget it.

None of that is necessary. They're not intending to verify that the holder of the certificate is John Doe; they're intending to verify that the holder of the certificate is doe0128935, which is a very different problem. Certificates held with pseudonyms are still useful.

Re:Well, it's a start

[randombit]

they're intending to verify that the holder of the certificate is doe0128935, which is a very different problem.

True, but still fairly spoofable - how to check, for example, that that certificate request actually came from doe0128935 anyway? I suppose they could modify the AOL client so that when they first log in, it generates a private key and a cert reques and sends it to an AOL CA or something.

But in addition, consider that (according to another post), you can also use a Thawte certificate. I wouldn't be suprised if ANY certificate was accepted, in which case I just go out and issue myself a certificate for doe0128935.

Re:Well, it's a start

[slamb]

I said: they're intending to verify that the holder of the certificate is doe0128935, which is a very different problem.

randombit said: True, but still fairly spoofable - how to check, for example, that that certificate request actually came from doe0128935 anyway? I suppose they could modify the AOL client so that when they first log in, it generates a private key and a cert reques and sends it to an AOL CA or something.

Yes, different != easy. That solution is about the best I could think of, either. I don't know how to grandfather existing users with any level of assurance.

randombit said: But in addition, consider that (according to another post), you can also use a Thawte certificate. I wouldn't be suprised if ANY certificate was accepted, in which case I just go out and issue myself a certificate for doe0128935.

Ugh. I hope not. If they don't verify the chain of trust, they've screwed up quite badly. (Not saying you're wrong, though.) But that's an implementation problem - I'm convinced that the concept is good, at least.

SecureIM

[ElOttoGrande]

SecureIM has been around for a while now. It basically acts as a proxy and you set your Aim to connect through it. Inside the proxy it encrypts everything with 256bit blowfish, then on the receiver's end reverses the process. The result is transparent encryption with the standard Aim client.

It's easy to install but since both parties need to have it running can be tricky trying to get non-geeks to understand why they should install it.

I used it for a while with the few(2) friends I could convince to run it but then kind of forgot about it...

feh.

[ErikZ]

What I REALLY want is AIM to automatically log all conversations. Like ICQ and IRC. Having to save to a chat file and come up with a name for the file every time is a step backwards.

Re:feh.

[SlashChick]

"What I REALLY want is AIM to automatically log all conversations..."

Er, Trillian does this. It also supports the ICQ and IRC protocols, though its IRC support is limited. (AIM, ICQ, MSN, and Yahoo support all work great out of the box.)

You can also use Trillian's built-in 128-bit encryption (as several others have pointed out.)

To add my own specific little plug for Trillian, I like that I can have three AIM accounts signed on at one time (and pick which one I want to use to send messages to others.) This is great.

Trillian works in Windows and also in Linux with the help of WINE.

Re:feh.

[generic-man]

AIM+ piggybacks onto the official AIM client, offering features like ad removal, automatic logging, and cloning (run two AIM processes at the same time). I use it with AIM 4.x, and all the other features in the official client work just fine.

Re:feh.

[Anonymous Coward]

The alpha versions of 4.4 had a log manager but they dropped it with future versions. It was pretty nice in that it also logged when people signed off and on and when people went away. Though the logging of people going away wasn't the greatest. I know there used to be a hack to activate the logger in newer versions but I think you couldn't view logs inside AIM without crashing it. You can download 4.4 and other old versions of AIM at AIM Filez.

Re:feh.

[dpete4552]

It's also noteable to mention that Trillian is closed source, and the cooler features aren't even free as in beer (e.g. Trillian "Pro"). Gaim supports Windows, and Linux out of the box, and every feature is both free as in beer and speech (including plugins). And I to can connect to multiple screen names of any medium and choose which to use to send messages to people with. Gaim also natively supports not only AIM, ICQ, MSN, IRC, and Yahoo, but Jabber as well, something the Trillian developers refuse to natively support. Gaim also has optional encryption abilities.

I choose Gaim :)

Re:feh.

[SniperGX1]

Use Trillian, it has the same format for AIM as ICQ and IRC. Its monumentally superrior to AOL made software in every sort of way. www.trillian.cc

Re:feh.

[zoloto]

http://gaim.sf.net

all the logging and encryption you need.

GPG plugin for Licq

[caluml]

I would like to see a GPG plugin for Licq. Some kind of ICQ user ID to GPG key id mapping file, so that I could say 12098242 = 0xe66d4af, and all communication from then on to that user would automatically be encrypted to that key. I know it has SSL encryption built in, but that doesn't work if you're both behind firewalls.
I started to try and work on it, but it was too tricky. Anyone interested in helping out?

Inter-operability

[Anonymous Coward]

They claim to use SSL (in TFA), does that mean it will be relatively trivial to write a compatibility layer for GAIM, Trillian et all?

It would be really nice to be able to securely IM with people who I really don't want to explain how to setup the programs and security settings, while I can stay in my favorite messenger myself...

(posted anonymous because I'm lazy)

Re:Inter-operability

[Anonymous Coward]

Oooops, I wrote that, but with my great reading skills I misread the page, it doesn't use SSL. This may not be the usual thing to say here on Slashdot, but please mod me (well, parent) down so it won't confuse anyone...

The usefullness of this

[iamdrscience]

For some reason a couple people have posted so far questioning the usefullness of this. I've used Trillian's SecureIM encryption a number of times and I'll try to give an example of a situation where encrypted IM was useful.

I needed a root password from my brother, we were both running Trillian so we just turned on SecureIM and he gave it to me. This was far easier than any other encrypted messaging we could have done. We've traded passwords a couple other times the same way.

Re:The usefullness of this

[Realistic_Dragon]

I'm a little bit more paranoid than that - I wrote a one time pad encoder/decoder and swap floppy disks full of randomly generated pads (say hellooooo WinTV card - ideal for picking up random noise).

This is considerably more secure than public key or even symetric encryption as there is no possible way to reconstruct the message without the key, which is scrubbed by the app off both disks as the message is converted. (The encoder chooses the next coherent free block of random numbers to encode with.) As long as you exchange the pad files via a trusted mechanism (handing over physical media) and you only send data to people you trust not to redistribute it, no one will ever get hold of a copy.

Not that I would ever give anyone my root passwords anyway - the very idea would make me go white and shake untill I had checked out my entire box for intrustions and rootkits ;o)

Re:The usefullness of this

[Anonymous Coward]

no one will ever get hold of a copy.

Unless they're using read-at-a-distance technology on, for example, those "securely swapped" floppies or a CRT the data appears on (at either end).

Re:The usefullness of this

[Realistic_Dragon]

And there was me thinking that the average Slashdotter lived in a faraday cage and had tempest hardened computers and media cases :o)

Re:The usefullness of this

[wirelessbuzzers]

Um. You know, it really doesn't matter what your keysize is after a certain amount, once the cheapest attack is to sneak into your house and boot in single-user or attach a keylogger. Or do you keep a smart-card under your pillow/in your pocket for that purpose?

Remember that for cheaper than the feds could break your key, they could subpoena you.

Re:The usefullness of this

[Anonymous Coward]

I generate my one-time keys with

dd if=/dev/urandom bs=1 count=16384

and pipe it straight to the encryption programs. That way, the encrypted data is fairly impossible to decrypt without that key. And by not saving the key, there is no way to decrypt--the data remains safe, even from me!

What??

[akorvemaker]

That's how *my* messages usually go! HAVE YOU BEEN SPYING ON ME?

I guess I do need that encryption thing...

Only businesses can use this feature

[Animats]

From the press release:

• Security credentials that enable these capabilities â" Personal Digital Certificates â" are an optional service available to enterprises as part of the Enterprise AIM Services offering.

That is so Bush Administration.

Re:Only businesses can use this feature

[bill_mcgonigle]

That is so Bush Administration.

Yeah, clearly.

The Clinton Administration has also developed and provided full or pilot funding for the following key initiatives designed to protect the Federal Government's computer systems: ....

• Piloting Public Key Infrastructure (PKI) Models.
  The Clinton Administration is funding seven PKI pilot programs in FY 2001 at different Federal agencies. ($7 million)

Trillian

[illumina us]

So now I have even less incentive to switch back to AIM seeing as that I use one program that allows SecureIM already and connects to multiple services.

Limitations of TOC?

[yerricde]

Can a program use the the TOC protocol to retrieve away messages? Or buddy icons? Or warn levels? Can it send or retrieve files?

And why doesn't AOL staff seem to care about availability (i.e. non-downtime) of the TOC gateway?

Re:Limitations of TOC?

[dknj]

because toc hasn't been used in their aim clients since 98?

-dk

This makes business sense.

[acherrington]

Here is how I see it, there is a lot of push from AOL-TW executives to turn this product, with a large user base, into a real cashcow. The only way that it is doable is by pushing the product into the corporate areana. The AOL-TW execs would like to push all of the infrastructure and software completely into a corporation, same as a mail system (like exchange server, and outlook on the desk). Many businesses were reluctant because it didn't offer the very basics of security. While general users don't care about this, try selling this to a CIO who has had security pounded into their head over the last two years. What question is he/she going to ask, "Would you mind telling me about security for your product?" So when they give this out to you, the public... it's just a mass test, so they can start doing corporate sales. Just my thoughts....

Licq can do SSL

[Domino]

Licq offers secure channels using OpenSSL for a long time. And somehow I trust that a lot more than some strange AOL encryption solution :).

Its nice to see though that this will be supported natively by the protocol. Right now I can only securely IM other Licq users. Also, Licq encryption only works with direct client-to-client connections.

Re:Licq can do SSL

[caluml]

Only works if you can establish a TCP connection to one or the other of the parties direct.

Also, how do you know there isn't a MITM attack going on. GPG plugin for Licq, I say. (And to all the others - don't go on about Trillian. Some of us only use Linux here.)

If only Jabber were more widespread...

[GeekDork]

Jabber can use GPG. The only downside is that a two-character message like "no" gets blown up to quite a big chunk. The thing AIM is doing reads like something similar (encrypted message body with world-readable routing information) according to the section "Advantages of Digital Certificates over SSL for encryption" (see the "details" link). Only they won't be using an open scheme for this.

Re:If only Jabber were more widespread...

[Phantasmo]

Well, some Jabber clients (such as Tkabber and gabber) will integrate with GPG, and the messages do balloon up.

At work I use Exodus to connect to jabber.org using SSL, which ensures that my messages aren't being read by my boss/the IT department/the organization's ISP. Once they hit jabber.org, however, anyone can read them. Still, it's better than nothing, and it works for any legacy IM system that I connect to (ICQ, AIM, Yahoo!).

'bout time

[Fry-kun]

Well, it seems that AOL has finally realized that it's losing too many of its "customers" to other AIM network clients like Trillian, Miranda, GAIM, et.al., which already have encryption capabilities and are ACTUALLY FREE - no ads, and often even open source.
As for those of you who don't care about encrypting your IMs... just leave the option turned off XD
I guess you just don't care that your dorm-mates can effortlessly read every word you say to .
If that wasn't enough for me, I have friends who, for the lack of a better description, "know too much". Thus, I never know which way a conversation can turn... better have it encrypted or else :P

Re:'bout time

[nuggetman]

I used Trillian, it can't do IM images properly or half the time file transfers won't work either, and it sucks up major memory. Uninstalled it.

I keep trying GAIM. IM images are still extremely flaky and that buddy list dragging issue is still there on WinGaim (because of the GTK+ port to Windows)

Miranda support for AIM is lackluster to say the least.

They aren't in any immediate danger of losing a signifigant user base to these clients.

geeze

[nomadic]

Get over yourself. Nobody's going to read your AIM conversations. Nobody cares. You're not that interesting.

Hell, the person you're AIMing probably doesn't want to read your messages either.

Re:Wouldn't be this illegal under the DMCA

[Anonymous Coward]

What about the DMCA? This project would be must better served if it used open source p2p with bayesian filters running with AMD optimizations on GNU/Linux.

Dead AIM

[prestomation]

DeadAIM does it. It's like AIM+ in that it latches on to the regular aim client. There's other nice features, tabbed messenger windows, cloning so you can run more then one s/n at once. Stuff like that

Re:Dead AIM

[The_Unforgiven]

Yeah, I came across DeadAIM a while ago, and love it. Very convient and seamless with the regular client.

Re:Wouldn't be this illegal under the PATRIOT act

[ruronikenshin83]

This probably sounds a lot more inflammatory than I intend for it to sound, but would you like to delineate any of those "good/peaceful" uses for guns?

Cuz I'm comin' up blank on that one...

It's For Business Use

[Random Truth]

Companies are starting to buy IM not only for internal communications, but for fast and cheap communications with customers, such as for customer service or alerts. With encryption, a broker can comfortably talk to clients about stock trades over IM.

BTW - GAIM and Trillian might have it as well, but they illegally draft off the big 3 networks (they have no license to tap in), so expect them to be under some serious pressure now that money is starting to flow to the big 3 for enterprise-class IM.

Re:It's For Business Use

[joshki]

but they illegally draft off the big 3 networks

Care to explain why it's illegal?
Why should they have to have a license to connect to a public server?

Re: It's For Business Use

[Random Truth]

The big 3 IM networks are private communities. They don't run on public servers at all. AOL, MSN and YHOO all have extensive server farms that handle everything from presence to buddy lists to message routing, and in all cases their terms of use expect that it is their client on the desktop, cause that's the only way they can maintain an affinity with the end-user and offer them other services, etc.

Trillian and some of the open source client software efforts have reversed engineered the protocols for these systems and are tapping into these infrastructures without running their own servers, nor licensing this access (like Apple has licensed use from AOL). This is equivalent to hacking into AT&T to make phone calls w/o paying, or stealing cable.

I understand that the lack of interoperability sucks, but using products that illegally side-step the problem is unethical IMO.

Re: It's For Business Use

[Anonymous Coward]

I still fail to see how this is illegal. The servers are entirely public, no attempts are made to restrict access to them. You're not circumventing any type of control. If you put a computer on the internet, and intentionally run a service on it, fully expecting people to utilize it...what make it illegal for someone to reverse engineer the communication protocols and use their own client. It's not a copyright violation becuase reverse engineering is covered under fair use. It's not trespass because the machine is intentionally open to the world. What other crime applies here?

If they want a private network, they have two choices: Either they can restrict access to the network by ip address or some similar metric, or they can require you sign up on a web page that presents you with a click through licence for using the service, that explicitly states that you can't use a non AOL client.

Any service you put online, with no security, is fair game for people to use, provided they're not circumventing some sort of access control.

Re: It's For Business Use

[Random Truth]

They are not public servers. They are not behind firewalls, but their use is restricted and protected by a registration and authentication interface, along with a set of terms that users agree to when they setup an AOL, MSN or YHOO IM screen name and use the services.

As a result, these IM communities are similar to private email or phone systems. Trillian users are using the servers of the big 3 IM communities w/o their permission to do so with a Trillian client. It's the equivalent of using someone's email server w/o permission. The laws that are being broken are wiretapping, violation of terms of use, and copyright infringement (the protocols are proprietary and the terms of use prevent reverse engineering or copying).

Here's an ethics test for you:

If your neighbor has Wi-Fi at their house is it ok for you to tap in w/o their permission?

Is it ok for you to tap into a phone or cable line at the pole and use it w/o permission?

Is it ok for you to copy and use someone else's code w/o their permission?

Re: It's For Business Use

[joshki]

The big 3 IM networks are private communities. They don't run on public servers at all.

But they're not -- and they do... In the same sense that my website, while it runs on my private server in my house, is freely available to you, no matter what browser you choose to use to view it. All of these services are freely available to the public!

I've used gaim and trillian for years, so I don't know what the EULAs say for the other programs these days (not that it really matters), but if you publish something on the internet and make it freely available, I don't see that you can regulate what other people use to access it. At the very least, I don't think there are any laws that give you that right -- if I'm wrong, I'd be interested to hear what section of the US Code it violates, and I suspect AOL would as well. I'm sure they'd be suing like crazy if there were any legal foundation for them to do so.

Your comparison to stealing cable or phone service is really disingenuous -- you have to pay to get phone and cable, you don't have to pay to access the AIM servers.

Re: It's For Business Use

[Random Truth]

You're confusing free with public. Just because the services are free does not make them open to the public to use how they please. They are free when used under the TOS of the provider, which you are bound to because you must have a username/pwd from the service providers you use. Even to use Trillian you have to have atleast one username/pwd from AOL, MSN or YHOO, and that puts you directly under their terms of service.

This is even further accentuated by the fact that when you use Trillian with an AIM screen name, for example, you are using AOL's servers to host your presence and route your messages. Those servers are paid for by AOL dial-up subscribers in conjunction with an ad/sponsorship model - i.e., you do pay for AIM, just like you pay for phone or cable service. Using Trillian bypasses that model and violates AOL's TOCs.

I'm sure AOL would sue Cerulean Studios if they could do it cheaply. Litigation is expensive and not worth it if the other company has no money. That's why they've used technical methods to try to shut down Trillian use, and did the same with MSN when Microsoft originally launched MSN Messenger and tapped into AOL's IM system. I'd bet that they sent a cease and desist letter to Microsoft, but decided that fighting in court would be much more expensive than just screwing with the protocols every few weeks.

Browsers, web servers and page publishing are not quite the right metaphors for comparison. It's more like having an account with a webmail provider who offers the service for free because it includes ads, and then you create a client that scrapes their webmail pages and pulls your messages into Eudora.

BTW - I truly believe IM should be interoperable and am hoping the FCC will keep up the pressure on AOL.

Re: It's For Business Use

[Anonymous Coward]

> You're confusing free with public. Just because the services are free does not make them open to the public to use how they please.

One thing that is far too often overlooked is that the internet is an inherently public network. In attaching your computer to the public network, you have to accept reasonable (non-malicious) network traffic. You don't have to respond - but you can't complain if, say, some search engine crawler sending the string "GET /" to port 80 causes your computer to crash. It's more like a storefront - if you hang an open sign on the door and unlock the door, you can't sue people just for walking in.

> Those servers are paid for by AOL dial-up subscribers in conjunction with ...

Wasn't that one of the big lessons from the dot-com era? There is no entitlement to a successful business model. There are limited protections for intellectual property, but noone ever guaranteed that a particular scheme should be entitled to work.

Re: It's For Business Use

[Random Truth]

>> You're confusing free with public. Just because the services are free does not make them open to the public to use how they please.

> One thing that is far too often overlooked is that the internet is an inherently public network. In attaching your computer to the public network, you have to accept reasonable (non-malicious) network traffic. You don't have to respond - but you can't complain if, say, some search engine crawler sending the string "GET /" to port 80 causes your computer to crash. It's more like a storefront - if you hang an open sign on the door and unlock the door, you can't sue people just for walking in.

We're not talking IP-level traffic, we're talking about application-level use. These are specialized servers that open and maintain socket-level persistent connections, store a username and password, store a user's buddy list, allow them to find buddies, view webcams, join chat rooms, and send messages. If Trillian we're a peer-to-peer (client-to-client IM service, then it would be fine.

>> Those servers are paid for by AOL dial-up subscribers in conjunction with ...

> Wasn't that one of the big lessons from the dot-com era? There is no entitlement to a successful business model. There are limited protections for intellectual property, but noone ever guaranteed that a particular scheme should be entitled to work.

This is not about business model. Whatever their biz model, using their infrastructure outside their terms is putting a load on their servers and costing them money w/o the ability to recoup it via said biz model.

What a W.A.S.T.E

[nounderscores]

Now that the source is closed (and that they've definitely modified it to scale for so many users) we can be told that there's encryption at both ends, but can you trust them not to go sniffing in the middle?

____________________________________
The Spiders are coming. Episode 4: June 10,2003

Jabber.

[porter235]

Jabber offers SSL.. and if you pick your clients well, JAJC for example, you can even use full PGP protection. Go for the OPEN standard. Go Jabber!

Safemessage

[Anonymous Coward]

There's a product already out there called SafeMessage (safemessage.com) which has done this for some time. Even Bruce Schneier thought it was too paranoid for everyday use.

Re:Safemessage

[AceM2]

I think the whole point of AOL doing this is so that people (like me and most people I know in real life) can use encryption without downloading a seperate application that we'd have a hell of a time getting anyone else to use ;)

is it a coincidence

[kfort]

that you can't spell either?

Jabber has PGP-support

[Anonymous Coward]

The Jabber protocol has supported PGP for a while, and quite a few clients support it. It's used both for end-to-end encryption and for signing both your presence and messages. I'm running a development version of Psi with GPG currently.

Re:Jabber has PGP-support

[hey]

Also Jabber supports SSL connections to the server.
Which isn't end-to-end but doesn't hurt.

Wrong market

[Anonymous Coward]

I'm sure CuDdLES49128 and her 12 year-old friends were behind this 'innovative' feature.

I mean, honestly, most of AIM users don't even know what encryption is, much less think they need it.

guns

[ldspartan]

I don't really want to enter into this debate, but, Good / Peaceful uses for guns:

Good & Peaceful:
- Sports / Marksmanship.
There are a multitude of Olympic sports based around marksmanship; you may never hear about them because they're boring as all hell to watch (Look how still that guy is being! and so forth) and are never covered, with the exception of the biathlon.
- Hunting.
Whether this fits your definition of 'peaceful' is up to you, but its still a legitimate form of recreation in the states.

Good but not necessarily peaceful:
- Enforcing the law.
Most police cars I've seen in the past five years has a shotgun or rifle mounted between the front seats, there's probably a reason for that.
- Self protection.
If Bad Guys can (and do) have firearms, I would like the option of being at least as well armed as the Bad Guys.
- Protection of property.
I like it that there are armed gaurds inside and out of nuclear power plants. The same goes for military basis, weapons depots, water supplies, and so forth.

There are more arguments and uses, but if you really wanted to find them, you'd be able to on Google in less than a minute.

AOL's choice encryption algorithm?

[carpe_noctem]

Pna nalbar fnl ebg13?

Re:AOL's choice encryption algorithm?

[Anonymous Coward]

V jbhyq guvax gung NBY hfr ebg26...

Re:AOL's choice encryption algorithm?

[Blain]

Hz, "ebg13."

Qb V trg n cevmr?

Re:AOL's choice encryption algorithm?

[karlm]

Pna nalbar fnl ebg13?

Jura qvq gurl gnxr ebg13 bhg bs Argfpncr'f gbbyf zrah?

Re:Wouldn't be this illegal under the PATRIOT act

[Anonymous Coward]

Ooh, a computer! How dangerous!

Ooh, a cell phone! How dangerous!

Ooh, a steak knife! How dangerous!

Ooh, a nail clipper! How dangerous!

You get the picture.

I sure as hell don't.

[SHEENmaster]

1 Sharp zaurus
+
1 copy of kismet
==
1 transcription of the entire chat session

Any decent packet sniffer will reveal all that is said. I suspect that they are offering this not to make it safer or get more subscribers, but rather to cover up certain activity.

AOL's servers record chat sessions of members, I'm not certain as to whether or not they do it for non-members. The point is that anyone over there with the requisite access rights can spy on these things. End-to-end encryption will not be default, might require a subscription charge, and might mean end-to-end(AOL)-to-end.

Forgive my pessimism, but I don't trust AOL in any situation. They screw over their members, they screw over those of us with smaller servers, they screw over friends of members. I think they are realizing that they cannot mainttain their current empire in the face of broadband, this may just be a feeble attempt to profit from their other markets. Subscription Netscape anyone?

GPG

[krokodil]

I am using Fire (MacOS X multi-protocol IM client) and it has GPG encryption for long time.

The way they done it, it is quite easy to make it work with other IM clients: they just use GPG to sign/encrypt each message and then send it plain text in ASCII armor. The client on other side can detect such messages and decode them.

No protocol extensions required. I wish somebody address support for such mechanism in standard Yahoo and ICQ clients and other clients.

I guess if more open source IM clients will support it, it could become de-facto IM encryption
standard...

I use IM a lot for work and some information I exchange there could considered business secrets.

Re:GPG

[gbooker]

As a Fire developer myself, I thought that I could contribute a little more to this. We have started to participate in a discussion on the best way to do encryption over IM protocols. This discussion can be found here: http://www.chat.solidhouse.com/smsn/. The GAIM-E author has even contributed to this discussion.

Also, we have drastically improved the way that the GPG encryption is handled. It now works on more protocols and will be more consistent. My favorite is that we now correctly recognize a gpg installed by fink.

Here is how I invision this in the end. Assuming that AOL didn't use PGP (or GPG), then we (OS Client Authors) should try to support their protocol, along with PGP (or GPG) which would be considered more secure.

Glad to run across another satisfied Fire user.

Re:GPG

[Anonymous Coward]

http://samopal.org/soft/pgpicq/
Pretty Good Privacy for ICQ is open source and free.
I've not used GPG so I don't know how well the two programs would interact.
I don't use it though because some time ago I purchased Top Secret Messenger for ICQ.
http://www.encrsoft.com/

Re:GPG

[Art Tatum]

Have you guys ever considered making Fire portable between OS X and GNUstep platforms, like GNUMail.app? I'm sure you'd get cooperation from the GNUstep folks to reduce the effort required on your part.

Well, it could have advantages...

[Anonymous Coward]

I'm sure CuDdLES49128 and her 12 year-old friends were behind this 'innovative' feature.

Look on the bright side, though... When you try to pick up CuDdLES49128 for a date and she turns out to be Special Agent Bob Flannigan, you can avoid charges by accusing the FBI of circumventing your digital protection device!

Soon, "pleading the DMCA" will be as common as "pleading the 5th" ;)

It's good for business

[drig]

I've found that business groups could really use instant messaging, but don't want to broadcast their IP over the net without some sort of protection. I think it's a better idea to run the IM server locally, but AIM requires no setup and has very nice clients. I can see, for instance, a sales team talking with the engineers using encrypted AIM.

Re:It's good for business

[CausticWindow]

That "Your computer is broadcasting an IP" thing is a hoax.

I know for a fact that all packets (benign or otherwise) have your IP in them.

Re:It's good for business

[Anonymous Coward]

Intellectual Property.

Re:AIM illegal

[Anonymous Coward]

ummm.. It wasn't a troll, I was serious.

Re:Thank bob

[davesag]

Try using Fire then, it has built in support for GPG to provide end to end encryption - works a treat, supports all the major IM protocols, and is developed under the GPL for those of you that care about such things.

Re:Wouldn't be this illegal under the PATRIOT act

[LordK2002]

Actually, the last I heard was that the Sept 11 terrorists used unencrypted email from internet cafes. I do not believe that there is a terrorist incident in human history that would have been prevented by banning legitimate privacy technologies such as encryption.

I can use a hammer and chisel to crack open people's skulls - should we ban carpentry tools as well? Don't believe the government's propaganda, banning legitimate technologies "to prevent terrorism" is nonsense, it is just an attempt to gain more power for the various government departments and the corporations that bribe^H^H^H^H^Hcontribute to them.

Remember: "those who would trade freedom for security deserve neither freedom nor security".

K

The danger lurking...

[Eudial]

The problem with this kinds of things is that it makes people feel secure without actually being secure. God knows what backdoors AOL might have included in the code. A good rule of thumb is to not trust anything you can't see the sourcecode of. If you want something said, either GPG encrypt it (not recommended as it is breachable) or deliver the information physically.

Re:The danger lurking...

[Anonymous Coward]

And never trust a mailman whose background you haven't checked and never trust a shopkeeper who you haven't stalked for at least a month?

are they then using waste?

[linuxislandsucks]

Ars they then using Waste as the basis of the implementation?

Setting the record straight ..

[the_dreadnought]

Many of these replies are misleading or totally incorrect.

Trillian does *NOT* do the "same thing" .. This AOL beta, in addition to encryption using a certificate, is signing based on the certificate. Trillian does not have an option (as far as I can tell from the free version) to use certificates and/or sign messages.

Also, you do not need "Enterprise" services to use this functionality. I just tested it, and it works fine with the free client. Just get a free Thawte certificate, import it, and begin IM'ing with a friend who has done the same.

Hope this helps clears things up somewhat.

Re:Wouldn't be this illegal under the PATRIOT act

[KrispyKringle]

Just because you think it should be does not mean it is illegal under the PATRIOT Act.

The PATRIOT Act, as far as I know, does not ban any sort of encrypted communication; the Supreme Court has ruled, if I'm not mistaken, that private and anonymous speech is a fundamental component of the First Amendment right to free speech.

Furthermore, this is truly not different from encrypted e-mail or anything else, which, as a prior poster pointed out, was not used by any of the September 11 terrorists.

Guns are restricted, sure. An irresponsible person with a gun is quite dangerous. Even a responsible person with a gun can be dangerous. But the right to encryption technology is not about the right to bear arms in order to prevent a dictatorship (a necessity which is a bit outdated at this point). The right to private speech is not only still necessary, perhaps even more so, with groups like the NSA who intend to be able to intercept any communication worldwide (and have historically given little regard to constitutional restrictions). The right to private, free speech is a fundamental intellectual right which is always crucial no matter what the need or consequence.

---
Anyone who needs to join an organization for those with high IQ's has self-esteem problems, intelligence problems, or both.

Key storage

[bobthemuse]

How will this work? I mean, if AIM is just generating keys prior to each conversation, then it's not really a digital signature. If you use the same key pair for all your conversations, how will you use your screen name at other computers? One of the big advantages of AIM over other clients is that it is already installed everywhere. If I need advice, I can login and talk to my contacts. OTOH, if it's stored w/ AOL, and messages are passing through AOL.... how is this better than generated per-conversation keys?

Re:Key storage

[slashkitty]

it's out, download and look at the program. You need to have a personal certificate for this to work. It doesn't currently offer the creation of this cert within aim, I imagine this would be provided only by the enterprise version of aim. You can however go and create a personal cert. somewhere else and import it. It will ask for the cert password everytime you start up AIM. It puts a lock beside your screenname, then, automatically when two people with the capability talk to each other, it moves up to secure the conversation. Pretty slick. The only real problem is the generation of the certs. Looking back on previous /. article on PKI, there was a lot of problems. No one seems to be doing it right. (www.thwarte.com has a good 50 step process to get one) Does anyone know an easier way to get a personal cert to work w/ aim in fewer steps?

Re:Key storage

[Anonymous Coward]

Keys are generated when you get a cert with a CA. If the CA allows you to generate the keys on your machine then you have a guarantee that they're not escrowed. I think that Thawte doesn't escrow the keys (i.e., you generate them, sign the public key with your private key and thawte then mails you the cert to the email specified in the cert request.)

The keys are persistent (for the validity of the cert).

This is good for business

[Punk Walrus]

We use AIM extensively at work, and we have a rule that no security information, like server IPs, mapped drives, proprietary info, or passswords of any kind are allowed to be used on an open-end IM or non-ecryoted e-mail. Often, we send half-and-half:

IM > See e-mail on the usual server. Password is "Fn68bX4" and the IP is 10.4+
E-mail> The IP to login to is +.10.120, and add "g6h0" to the password.

But really, often we just go to the office and tell them.

_______________________________________________
www.punkwalrus.com - Benny rated, Benny non-approved!

Re:This is good for business

[Anonymous Coward]

And thanks for telling all of Slashdot about your super-secure transmission scheme. I'm sure your boss will thank you for that one after... well never mind :-D

Re:Thank bob

[carpe_noctem]

Actually, I did try Fire, and I was pretty impressed with the GUI, but it kept crashing, so I figure I'll check it out again in 6 months or so. ;)

Re:Gaim-E? gaim-encryption

[null-sRc]

when i first read the headline,

my brain filled in the starting g...

hence i was confused, thinking... this is news?!

What about chat rooms?

[the_dreadnought]

Today is the first time I've ever used the native AIM client, so I'm not sure if this option is supposed to have anything to do with the new certificate functionality .. but,

What does "Secure Chat" do when setting up a chat room? I don't see any docs on the website or in online help. Does this mean certificates are being used for encryption and signing between members of the chat room, in the same fashion as for the IM's?

I realize it's beta .. but if anyone knows, fill us in!

Re:What about chat rooms?

[Anonymous Coward]

Chat is encrypted using s/mime, but a session key is generated by the sn initiating the secure chat session (session key is generated on the client). The session key is encrypted with the public key of the sn's invited to the chat (each one of them receive an invitation and that invitation contains the session key encrypted with their own public key).

Free software ahead of the game

[debrain]

This is an example of where free software is certainly ahead of the commercial equivalents. Both Kopete and Gaim have had options to encrypt using PGP for quite some time. (Gaim for significantly longer, iirc)

By delegating the authentication and validation to PGP, they are potentially as-secure-as PGP. By doing in-house certification, ala. Trillian & AIM, the identification and encryption is an internal mechanism, and I would argue (successfully) that it is more difficult to prove its potential to be secure.

Not only does open source appear to have the feature first, it seems to do it provably better.

Re:Free software ahead of the game

[evilviper]

This is an example of where free software is certainly ahead of the commercial equivalents. Both Kopete and Gaim have had options to encrypt using PGP for quite some time. (Gaim for significantly longer, iirc)

Interesting... So, having several crates of camel dung months earlier, is better than waiting a few months for useful materials?

Sure, there's all sorts of GAIM incryption options, and I think I've tried them all. Each one takes a small army of programmers just to get it to compile, are incredibly unstable, and when the software just barely works, don't expect security of any kind...

The state of GAIM encryption sucks... I think I'll spend 10 minutes to turn out a perl script that can do the job better than anything out there...

WASTE

[jake666]

If secure transmissions is really that important to you, go with what you know is secure. You can use it for small companies, the extremely paranoid, or just those who want to swap 'legal' files..... Ask me if you need the client (although I don't have it myself *wink wink*)

Re:WASTE

[Anonymous Coward]

WASTE is not secure. Also, it scales even worse than vanilla Gnutella. It is of very little practical use, even without considering the Justin/Nullsoft split over its release. The next protocol up might be, though. Please help develop the next generation of this type of software, but DO NOT regard WASTE as secure.

PGP

[robertchin]

They should really just allow you to import your PGP key, and then all of you messages will be encrypted if the other user also has their PGP key imported. Plus, when using the direct connect aim feature, you could actually verify the authenticity of the remote person...

SIMP Already Does This

[Spad]

SIMP offers IM encryption for AIM, ICQ, MSN and Yahoo - either individually for free or SIMP Pro which supports all four IM systems and costs $25.

I was part of the beta program for SIMP Pro and I have to say it's an excellent little program, it even supports encrypted file transfers.

Re:Thank bob

[davesag]

Actually, I did try Fire, and I was pretty impressed with the GUI, but it kept crashing

I find it pretty reliable. there are a few small glitches but it's not crashed on me in months.

They use CMS (PKCS #7)

[Anonymous Coward]

Secure AIM uses CMS (RFC 3369), a descendant of PKCS #7. It's the same thing that S/MIME uses.

Currently you can use any certificate with Secure AIM, including one from Thawte, as was pointed out by a previous poster.

Use gaim dude

[Anonymous Coward]

Does it, has several encryption plugins, fully open source, runs well on both windows and linux. There's absolutely no reason to use AIM whatsoever. Get Gaim here, and the gaim-encryption plugin here

Not new, but needed

[nurb432]

Many other IM clients do this natively ( such as trillian, or LICQ ), but its great AOL is 'seeing the light', as they are perhaps the biggest client generator out there ( between ICQ and AIM ).

These days everything must be encrypted or needs to be pretty much relegated to "how's the weather"..

I guess that means the other clients are already illegal in Michigan I suppose. I'm sure my ssh connection between work and home would be.. Good thing i dont live there :)

Gaim + Encryption

[bleak sky]

There's a plugin called Gaim-Encryption for Gaim that uses OpenSSL (and yet another, gaim-e that uses GnuPG) for encryption.

I believe Gaim-Encryption comes stock with the 0.6x prereleases.

Re:Gaim + Encryption

[CyberWolf]

Neither gaim-e or gaim-encryption is included in the gaim packages. They are optional plugins that you can get.

Some distributions include the gaim-encryption plugin and install it as part of gaim. However, gaim-encryption's implementation/usage of openSSL is not compatible with gaim's GPL licensce (gaim uses Debian's interpretation...see Debian's site for more info). The author of gaim-encryption is working of resolving the issue, and it works with the 0.6x versions of gaim (except version >= 0.65) even though it violates gaim's licensce.

Gaim-e uses GPG, and has no licensce issues with gaim. However, gaim-e currently works on gaim version 0.60. A gaim-e version that works with gaim 0.6x is currently in the works.

Both of this plugins only work if both users are running gaim with the same encryption plugin.

Just my 2 cents worth

Re:Gaim + Encryption

[botik32]

Moreover, Gaim-Encryption uses public/private keys generated for each user, which is (slightly) better security than encrypting to server. This way your boss cannot snoop on you if you're using the local chat server : )

On the weird side, I noticed significant delays in encrypted ym messages compared to non-encrypted ones... makes one wonder...

Re:Thank bob

[Anonymous Coward]

You assume it's made any major updates in the last 6 months. It hasn't. It's all little fixes, and some localisation.

I prefer Proteus now. At least its UI is decent. Single window messaging is like single window browsing; you can't go back to something without it.

MOD PARENT UP YOU UNEMPLOYED FUCKS!

[Anonymous Coward]

What else do you have to do? Besides masturbate, I mean.

Re:Tranny Whore

[atomm1024]

Uh... I don't get it, why do people post things like this? Oh well, at least it makes /. fun, in an absurd way. Absurdity is good.

Re:AIM illegal

[akpcep]

Try posting under a username. Saying that, it's unlikely to help. Scratch that.

Establishing Trust?

[SCHecklerX]

Neat.

I hope there is a dialog or something to the effect of "User foo is sending you their identification credentials so that you can be certain messages in the future are really from this user. Accept Credentials?"

At least then you could be reasonably sure it is really them, if they are right beside you or on the phone when you do this. If it's automatic, then what is the point? There is no real way to trust that you have the real public key of that user then.

Of course, the private and public keys are all likely stored on AOL's servers, which again defeats the purpose. Unfortunately without it being automatic, people won't use it. But automatic just isn't the way to properly authenticate.

Re:Establishing Trust?

[Anonymous Coward]

I don't think they're using the technology for authenication as much as for encryption between users so it can't be intercepted.

milkbone

[batkins]

The obvious solution is to use milkbone. Sure, it doesn't have encryption yet, but it's still the solution. :-)

ICQ and PGP

[216pi]

PGP delivers an icq plugin that uses your key-ring to cummunicate pgp-encrypted if your vis-a-vis has installed pgp/icq/that plugin, too.

PATRIOT Act

[Anonymous Coward]

I wouldn't trust this. I'm fairly certain that the PATRIOT Act requires the provider to be able to log all messages on a per user basis when requested by law enforcement agencies with the proper warrants and such. I would suspect that AOL built the system such that they can decrypt messages at the server. I know of at least one Jabber client which uses gpg for end-to-end encryption, that I would trust (because the encryption depends on data I control).

Re:PATRIOT Act

[Anonymous Coward]

Please cite the relvent portions of the Patriot for us.

Re:Tranny Whore

[lostchicken]

Karma Whores. That's what it's for. They post thinking "+5 Funny", you know like a cartoon, with one of those thought bubbles over their heads. Picture it. Now. See what I mean.

Just like what I'm doing right now. The thought bubble reads "+5 Insightful"...

Sure it's encrypted.

[veddermatic]

But only if you use "Algorithm 8.0! So easy, anyone can encode!!"

Oh, and with the recent settlement with M$, all your encryption has to be Micrshaft approved. And Time-Warnder approved, so it will search for watermarked video/audio/image content the studio owns.

And they don't wan't to piss off the RIAA or MPAA and lose those keyword contracts, so you cna;t encrypt anyting that has binary content.

Oh, and thanks to the PATRIOT act, any key you generate is backdoored and given to the NSA.

2003? Feels like 1984 =P

Re:Sure it's encrypted.

[Clockwurk]

But only if you use "Algorithm 8.0! So easy, anyone can encode!!"

Oh, and with the recent settlement with M$, all your encryption has to be Micrshaft approved. And Time-Warnder approved, so it will search for watermarked video/audio/image content the studio owns.

And they don't wan't to piss off the RIAA or MPAA and lose those keyword contracts, so you cna;t encrypt anyting that has binary content.

Oh, and thanks to the PATRIOT act, any key you generate is backdoored and given to the NSA.

"Reading is the basics for all learning" -- 'President' G.W. Bush

The irony of your sig is beautiful.

Re:Tranny Whore

[atomm1024]

That wouldn't explain why an Anonymous Coward would post that, but it at least explains why it seems that every other +5 Funny modded post in the SCO-related articles uses the same joke ("omg look, I found teh stolen code: 'for (i=0; icount; i++)'! hahaha, mod me +funny please!").

Re:Tranny Whore

[Anonymous Coward]

> That wouldn't explain why an Anonymous Coward would post that

Actually, I use that post and others like it for one of two purposes:

1) Posting extremely lame comments, or
2) Being Karma whores.

In this case, the parent was extremely lame and thus deserved the post. I recommend you all punch yourselves in the balls for not realizing this.

Not quite...

[wirelessbuzzers]

Your reasoning is off-base. You're correct that if you choose a "co-Sophie Germain prime" (you want p=2q+1, not q), the discrete logs problem becomes much nastier, because you have a group of order q, instead of smaller groups for each factor to break.

But there are much faster ways to do discrete logs than by brute force. They use quite advanced math, but the current best attacks on factoring use methods which can be applied to discrete logs with very little modification. Google "index calculus."

For pretty much exactly the reason you mentioned, DH is harder to break than RSA at the same keysize, but not nearly as hard to break as RSA at twice the keysize. And remember how quickly RSA-129 (a 426-bit or so key) was factored by distributed.

You could break DH-128 on a PC if you had to, or in a lab more quickly with some clever programming. It might take them a while, but even if it took weeks running as their PC screensaver, they'd have your whole conversation if they needed it. It'd be enough to keep the jackass down the hall from listening in on your cybersex, but not enough to hide your plan/idea/whatever confidential data you might send over IM/? from a hacker.

Re:Not quite...

[dunham]

And remember how quickly RSA-129 (a 426-bit or so key) was factored by distributed.

You could break DH-128 on a PC if you had to, ...

Note this isn't 128-digit DH, rath 128 bits. That works out to about about 39 decimal digits. I can't find exact numbers for modern hardware, but in 1991 LaMacchia and Odlyzko published Computation of Discrete Logarithms in Prime Fields , describing how they broke a larger, 192-bit key using about 1200 machine hours of a 25MHz R3000 chip, 40 hours on an unspecified machine (probably the SGI), and a few hours on a VAX. They conclude (over a decade ago) that using less that 200 bits is "very insecure".

The author states that the implementation could be improved upon, the 128-bit problem is smaller, and modern machines are much faster, so I was guessing a couple of days on modern desktop hardware.

Trillian does appear to change the prime, so the computation could only be used for one intercepted conversation.

Have you checked buddyzoo lately?

[wirelessbuzzers]

Most of my AIM friends fall into fairly large cliques. I mean, what's to stop them from using a PGP-like (non-)structure, where you just get introduced by your friends? Or are the masses too stupid to make this model practical (check fingerprints etc). Maybe those who actually need secure messaging will do this...

Re:Gaim-E? gaim-encryption

[CyberWolf]

Yes, gaim-encryption is nice, but it's licensce is not compatible with gaim's licensce.

Using gaim-encryption breaks gaim licensce (gaim uses Debian's interpretation of the GPL). It has been discussed by the gaim developers and, if asked about gaim-encryption, they will tell you to stop using it (or stop using gaim) until the author of gaim-encryption fixes the licensce issue (he is aware of it, and is working to resolve it).

Just my two cents worth

Re:Gaim-E? gaim-encryption

[kfort]

Honestly I don't really know what you are talking about, could you explain more? The gaim-encryption I have is under the GPL, although there is some cryptic note on the project page about licensing issues and the Windows build.

problems?

[Anonymous Coward]

Has anyone actually tried using this? I get an error message when I try to import a pfx that disappears too fast for me to read it.

Re:problems?

[Anonymous Coward]

Importing a .p12 file worked for me.

Re:Gaim-E? gaim-encryption

[CyberWolf]

yes, gaim-encryption is under GPL, but openSSL (used by gaim-encryption) is not, it uses BSD...the advertising clause in the BSD license conflicts with the GPL in the Debian's view; gaim uses this interpretation as well.

Follow this link for more information about the openssl/gpl problem.

encryption.....

[222]

Ive been using the encryption add-on at http://www.johnytech.com for quite some time and dont have any complaints.... It works fine and integrates with all the major IM clients, although im not sure about the All-in-one offerings, ie: trillian.

Re:Gaim-E? gaim-encryption

[anthony_dipierro]

It has been discussed by the gaim developers and, if asked about gaim-encryption, they will tell you to stop using it

Whatever, the RIAA tells me to stop using Kazaa, too. Fuck copyright.

Trillian

[waspleg]

supports 128 bit encrypted messages between 2 trillian users, and it auto-establishes the session

it rocks in case you haven't heard of it

Re:Gaim-E? gaim-encryption

[CyberWolf]

it is not a copyright issue....it is a license issue...two different things.

next time make sure your analogies are on topic.

Re:Gaim-E? gaim-encryption

[anthony_dipierro]

What are you talking about? It most certainly is a copyright issue. It's also a license issue. But the only reason you need a license is because of the copyright. As for whether it's the license of openSSL or that of gaim which the gaim developers are concerned about, I really can't figure it out. Presumably using gaim-encryption violates both.

remember, end-to-end is good.

[Anonymous Coward]

1) What makes this 'End-to-end' solution better than all the other 'SSL' based solutions? Most other 'security' solutions merely encrypt the message between you and the server system. With the new AIM, not even AOL can read your messages.

2) The message format is S/MIME, now defined in RFC 2630. It's been used for years to send secure email messages in Netscape and Microsoft mail programs. It's not some new encryption scheme that AOL dreamed up.

3) Judging from the binaries in use, the new AIM uses the NSS crypto library (used in Mozilla-based software). This code has been around for a long time, and has really stood the test of time.

9 out of 10

[m1chael]

terrorists use AYM.

DUH!

[vancleve]

They pulled WASTE last week, now they are using it privately for AIM

Illegal in Michigan

[Quixadhal]

It might be, but I'm not sure we can talk about it under the DMCA, since knowing it's encrypted is the first step towards circumvention... :)

Help me out here

[smartfart]

RSA private keys are two primes, and the public key is the product of the two primes. So in other words, if you have a 128 bit RSA public key, breaking the key is reduced to searching for two ~64 bit primes, and primes are much more sparse than composites.

What's to stop someone from caluclating the product for all possible combinations of primes in the aforementioned range and dumping this to a database? Wouldn't this eliminate the hassle of having to otherwise deduce the 2 primes used to generate said product?

///

Bleh, it should be painfully obvious to everyone reading this post that I Am Not A Crytpologist :-/

Re:Help me out here

[Linknoid]

The main problem is size. The prime number theorem tells us the number of primes less than n is about n/ln(n). So a quick calculation on my calculator tells me that there are somewhere on the order of 10^19 64 bit primes. A terabyte is approximately 10^12, so you would need somewhere on the order of eighty million terabytes just to store all the 64 bit primes. I shouldn't have to mention that that kind of storage capacity is somewhat out of reach of most individuals, although I suppose a government or large corporation would be able to handle something of that magnitude (if you figure $1/gig, that's $80 billion, just for the drives themselves). Now if you're going to store the product of each of these, you're going to have the square of that number of primes to deal with. So 10^19 squared is about 10^38 different products of 128 bits. Now we're talking on the order of 100 million million million million million million primes: 100,000,000,000,000,000,000,000,000,000,000,000,00 0. If were put that in terms of terabytes, that's 10^26 terabytes. That's on the order of 100,000,000,000,000,000,000,000,000 terabytes. Actually, it's even slightly worse: since we're storing 128 bit numbers, that's another 16 to multiply by the number of bytes, so we just added another order and a half of magnitude.

So to answer your question of what's to stop someone from doing this? It's physically impossible, and will be for the foreseeable future. Well, I guess if we assume that the increase in drive capacity can continue as it has (1000 fold in 10 years), in 200 years, it should be in reach of a large corporation or government :-) But I think there's a lot of limits to be run into during that time that will prevent hard drive growth from continuing on like it has indefinitely. There are much more valuable things to do with our resources than calucalating all 128 bit products.

Re:Gaim-E? gaim-encryption

[CyberWolf]

Sorry, I guess I was not too clear on my point.

Gaim-encryption plugin violates gaim's license by DIRECTLY linking openSSL to gaim. The simplest way to solve this is to have the plugin call, not link, a helper program that is linked to openSSL (by making a system() call or something similar).

That is why this is not a copyright issue, gaim has not problems in you writing a plugin that uses openSSL, just how it interfaces with gaim (hence a license issue).

I have not read the license included in gaim-encryption, but I believe that it includes an exception clause (allowing it to be linked to openSLL) in the GPL. Gaim does not have that exception clause and it will be too difficult to add it in (the developers would have to contact ALL the source code contributors, past and present, to gaim and get their approval to include theexception clause).

Hope this helps clarify the confusion I created.

Re:I don't believe it. - prove it to yourself

[MisterSSL]

AIM uses the mozilla open source crypto libraries. You can see the same
crypto DLLs in AIM as in mozilla 1.3 or 1.4. You should be able to build
your own mozilla crypto DLLs from the open sources and substitute them for
the AIM ones. Then you know your AIM crypto is open source.

The encrypted messages are PKCS7/CMS messages, the same format used by
mozilla's S/MIME secure email (look for smime3.dll). The messages identify
each public key that was used to encrypt the message.

Re:I don't believe it. - prove it to yourself

[TerryAtWork]

That's great! Thanks!

Re:Gaim-E? gaim-encryption

[anthony_dipierro]

That is why this is not a copyright issue, gaim has not problems in you writing a plugin that uses openSSL, just how it interfaces with gaim (hence a license issue).

Why do they have a problem with it?

Regardless, it is both a license issue and a copyright issue. You don't need to follow the license, except for the fact that the program is copyrighted.