Off-the-Record (OTR) Messaging [$1,000]

[wanderer]

There is a $1,000 open bounty on this issue. Add to the bounty at Bountysource.

[charlieman]

You mean beyond https?

[wanderer]

it would be nice if it has some OTR for direct messaging

[sampaiodiego]

the idea of OTR implies in not saving the message on db?

[engelgabriel]

Off-the-Record (OTR) Messaging

Allows you to have private conversations over instant messaging by providing:

Encryption

No one else can read your instant messages.

Authentication

You are assured the correspondent is who you think it is.

Deniability

The messages you send do not have digital signatures that are checkable by a third party. Anyone can forge messages after a conversation to make them look like they came from you. However, during a conversation, your correspondent is assured the messages he sees are authentic and unmodified.

Perfect forward secrecy

If you lose control of your private keys, no previous conversation is compromised.

[kumavis]

I don't know if this implementation has been audited or not but https://github.com/arlolra/otr

[Calinou]

Warning

This library hasn't been properly vetted by security researchers. Do not use in life and death situations!

[kumavis]

And further reading on the state of otr arlolra/otr#59

[comigor]

I think otr is the best option we have, audited or not, cryptocat uses it.

As said on arlolra/otr#59, pointed by @kumavis, just few other implementations are available, and otr4-em and node-otr4 aren't well compatible with Meteor, because we can't use client-side node packages.

[comigor]

It's indeed very easy to implement OTR using arlolra/otr.
Just made a simple PoC Igor1201/otr.

[engelgabriel]

Looks like this feature has more people interested than I expected. I'll raise its priority. 👍

[engelgabriel]

Can any of you guys do a Pull Request or create a fork with a proposed implementation?

[engelgabriel]

Hi @Igor1201 can we work together to get your PoC to work on Rocket.Chat?