Slashdot Mirror
New Secure IM Client from NTT Due this Year
An anonymous reader writes "NTT in Japan has developed a new TLS-based
secure instant messaging system that it says will comply with corporate compliance regulations, such as the post-Enron Sarbanes-Oxley Act. There's a PC version, as well as a Java one for i-Mode cell phones."
OTR doesn't use TLS, but it does a great job encrypting conversations. Much better approach than SecureIM by Trillian or gaim-encryption.
This is just one more attempt, IMO, to realign privacy and security values to where they were before new technologies. Where IM is replacing conversations around the water cooler in the workplace, securing it from snooping is an okay thing. Logging it as official corporate communications is getting into, perhaps, dangerous territory. There is the part where it is a company resource, but when it comes close to being thought police, it is dangerous.
I think that modern society is still trying to find a place of 'normalcy' in the midst of new technology. I don't believe that there is an equivelant of IM prior to the advent of IM, other than private conversations. Recording private conversations is still not an okay thing to do. Comparing this to text based conversations that deaf/mute people have with text based phones, it all gets a bit confusing as to what is okay to record and what isn't.
Until it is clearly understood what is okay to snoop and record and what is not, people will make mistakes in what they allow to be recorded, and why, and how those recordings are used. No manner of encryption will fix the real issues. It seems that the only secure mannner to communicate is whispering so that no one can hear what is being said.... very low tech!
Support NYCountryLawyer RIAA vs People
If I can't look at the source.. it ain't secure.
..don't panic
Whether email or IM, writing anything controversial is a really bad idea. Say it face to face or on the phone instead.
Of course the question arises of what to do when you receive a verbal order to do something against company policy. You could comply, and take a small chance of later reprecussions, or else refuse or demand the order in writing, and face smaller but almost guaranteed reprecussions over time.
Our company uses something called Lotus Sametime. Ever heard of it? Me neither until I joined. I've heard of Lotus of course, but not Sametime. Basically it's an AIM-a-like for corporate environments. Now you ask why they use it... because (and this are the only reasons as far as I can see) it has some screensharing / whiteboarding capabilities, its authentication can be tied into your corporate id & password and the directory hooks into LDAP. If there were something available in open source which was comparable, as robust and included a web-based UI for screenshare meetings, I am pretty certain they would consider switching. As there probably isn't, that's your answer.
I don't particularly like Sametime but it does do what it's meant to do, more or less. It's certainly not flashy, is Windows-only and more insidiously requires IE Java to do the screen sharing but it works. I expect that site licences also plays a part in its continuing favour in our org. IMHO a site licence is a great way to chain a company to your tech - once they bought it, they're scared to switch away for fear of losing "value" on the deal.
There is another unwritten advantage of a proprietary IM system. It stops your employees wasting time chatting to all their buddies on AIM, jabber etc. instead of doing work.
The XMPP RFC describes the useage of SASL and TLS:
http://www.ietf.org/rfc/rfc3920.txt
TLS can be used on client-sever connections and on sever-server connections.
JEP 27 describes the useage of OpenPGP for encryption:
http://www.jabber.org/jeps/jep-0027.html
RFC 3923 describes S/MIME useage:
http://www.ietf.org/rfc/rfc3923.txt
JEP 116 describes Encrypted Sessions, which seems to be somewhat reminiscent of SSH:
http://www.jabber.org/jeps/jep-0116.html
I don't know that anyone implements this yet.
BTW Can someone tell me whether the connection between the two people chatting with Jabber is P2P or whether it is routed via the server?
Normal chatting at least is all client-server. File transfer can be p2p (normal case) or client-server, while Jingle Audio is p2p.
Climate Progress - Hell and High Water
You can do whiteboarding over Jabber using Coccinella.
jabberd2 can use your LDAP for authentication, data storage and maybe as a directory. I don't know about a web-based UI.