Changes between Version 6 and Version 7 of PlainTextPasswords
- Timestamp:
- Jun 26, 2007, 5:46:40 PM (17 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
PlainTextPasswords
v6 v7 1 1 = Plain Text Passwords = 2 2 3 Purple does not now and is not likely to encrypt the passwords in the 4 {{{accounts.xml}}} file, nor is it likely to be encrypted in a 5 future release. This is somewhat controversial in Windows, especially Windows 6 98 due to its weak file protections, but that's the way things are. 3 Purple does not now and is not likely to encrypt the passwords in the {{{accounts.xml}}} file, nor is it likely to be encrypted in a future release. This is somewhat controversial in Windows, especially Windows 98 due to its weak file protections, but that's the way things are. 7 4 8 5 The reasoning for this is multi-part. 9 6 10 Instant messaging is not very secure, and it's kind of pointless to 11 spend a lot of time adding protections onto the fairly strong file 12 protections of UNIX (our native platform) when the protocols themselves 13 aren't all that secure. The way to truly know who you are talking to is 14 to use an encryption plugin on both ends (such as OTR or 15 gaim-encryption), and use verified GPG keys. Secondly, you shouldn't be 16 using your instant messaging password for anything else. While 17 some protocols have decent password security, others are insufficient 18 and some (like IRC) don't have any at all. 7 Instant messaging is not very secure, and it's kind of pointless to spend a lot of time adding protections onto the fairly strong file protections of UNIX (our native platform) when the protocols themselves aren't all that secure. The way to truly know who you are talking to is to use an encryption plugin on both ends (such as OTR or gaim-encryption), and use verified GPG keys. Secondly, you shouldn't be using your instant messaging password for anything else. While some protocols have decent password security, others are insufficient and some (like IRC) don't have any at all. 19 8 20 9 There are basically four approaches to password storage.[[BR]] 21 10 22 * '''Store a password(s) behind a password.''' Basically this means that we require you to type in some passphrase as P urple starts in order to read the {{{accounts.xml}}} file, and, to be truly secure, require you to type it again if you write to it. Winicqdoes something very similar to this if you set it to its highest security settings.23 * '''Obscure a password.''' This means we do something to store the password in some format other than plain text, but we automatically convert it for you. This is security by obscurity, and is a Very Bad Thing^TM^ in that it gives users a false sense of security . A false sense that we (Purple developers) believe would be worse to have than to let informed users deal with the password issue themselves. Consider that a naive user might think that it is safe to share his or her accounts.xml, because the passwords are "encrypted".[[BR]]24 * '''Store the password in plain text and control access to the file.''' This is what Purpledoes: the password is in {{{accounts.xml}}} in plain text, but the file itself is only readable by its owner. We allow the user to determine under what conditions sensitive files should be opened (if at all), and what constitutes a breach of security.11 * '''Store a password(s) behind a password.''' Basically this means that we require you to type in some passphrase as Pidgin or Finch starts in order to read the {{{accounts.xml}}} file, and, to be truly secure, require you to type it again if you write to it. Windows ICQ does something very similar to this if you set it to its highest security settings. 12 * '''Obscure a password.''' This means we do something to store the password in some format other than plain text, but we automatically convert it for you. This is security by obscurity, and is a Very Bad Thing^TM^ in that it gives users a false sense of security that we (Pidgin, Finch, and libpurple developers) believe would be worse to have than to let informed users deal with the password issue themselves. Consider that a naive user might think that it is safe to share his or her accounts.xml, because the passwords are "encrypted". 13 * '''Store the password in plain text and control access to the file.''' This is what libpurple (and therefore Pidgin and Finch) does: the password is in {{{accounts.xml}}} in plain text, but the file itself is only readable by its owner. We allow the user to determine under what conditions sensitive files should be opened (if at all), and what constitutes a breach of security. 25 14 * '''Lastly, you can not store passwords at all.''' This is Purple's default, and by far the most secure of all of the options. 26 15 27 If you really wanted to, you could write a script to wrap Purple that 28 would decrypt {{{accounts.xml}}} and re-encrypt it when Purple exits. 29 You wouldn't be able to encrypt it while Purple is running, because Purple 30 writes to {{{accounts.xml}}} for things like info change. This would 31 minimize your exposure time unless (like me) you run Purple nearly 24/7. 32 Personally, I feel that on any decent operating system, if someone can get to 33 your files you should either be able to trust the person to not touch 34 them, or you shouldn't be storing sensitive information there at all. 16 If you really wanted to, you could write a script to wrap Pidgin or Finch that would decrypt {{{accounts.xml}}} and re-encrypt it when the application exits. You wouldn't be able to encrypt it while they are running, because libpurple clients write to {{{accounts.xml}}} for things like info change. This would minimize your exposure time unless (like me) you run Pidgin nearly 24/7. Personally, I feel that on any decent operating system, if someone can get to your files you should either be able to trust the person to not touch them, or you shouldn't be storing sensitive information there at all. 35 17 36 18 == "But other programs don't store my password in plain text!" == … … 38 20 That's true. But few of them store it in a way that's any safer. A Google search for [http://www.google.com/search?q=im+passwords "im passwords"] shows a bunch of hits for getting the passwords out of other IM clients just as easily as Pidgin. 39 21 40 The very first link is a clear indication that none of: 41 42 ICQ and ICQLite, AOL Instant Messenger and AIM Triton, AIM Pro, Yahoo! Messenger, Excite Messenger, MSN Messenger, Windows Live Messenger, Microsoft Office Communicator 2005, Google Talk, Odigo, Trillian, AT&T IM Anywhere, T-Online Messenger, Match Messenger, Praize IM, ScreenFIRE, ACD Express Comunicator, Imici Messenger, Prodigy IM, PowWow Messenger, Jabber IM, Kellster IM, PalTalk, Indiatimes messenger, Miranda, Tiscali, Ya.com Messenger, Rediff Bol, Sify Buzz, Devil, Tencent QQ, QQ (Africa Version), &RQ, Ipswitch Instant Messenger, Eighth Wonder Catax, Simple Instant Messenger, Vista IM, GAIM, Global-IM, Psi Jabber client, Messenger2, Picasa Hello, iWon, Blowsearch, MessageMate, Meca Messenger, Qnext, Bubbler (Five Across), InterComm IM (Five Across), Easy Message, QIP, Gizmo, MySpace IM, Exodus, Gadu-Gadu, Mail.Ru Agent, ScatterChat, Just Another Jabber Client, Maple Messenger, Pandion, IMVITE Messenger, Oyco Messenger. 43 44 provide any sort of real password security. 22 The very first link is a clear indication that '''''__none__''''' of these IM applications provide any sort of real password security: 23 * ICQ and ICQLite 24 * AOL Instant Messenger and AIM Triton 25 * AIM Pro 26 * Yahoo! Messenger 27 * Excite Messenger 28 * MSN Messenger and Windows Live Messenger 29 * Microsoft Office Communicator 2005 30 * Google Talk 31 * Odigo 32 * Trillian 33 * AT&T IM Anywhere 34 * T-Online Messenger 35 * Match Messenger 36 * Praize IM 37 * ScreenFIRE 38 * ACD Express Comunicator 39 * Imici Messenger 40 * Prodigy IM 41 * !PowWow Messenger 42 * Jabber IM 43 * Kellster IM 44 * !PalTalk 45 * Indiatimes Messenger 46 * Miranda 47 * Tiscali 48 * Ya.com Messenger 49 * Rediff Bol 50 * Sify Buzz 51 * Devil 52 * Tencent QQ and QQ (Africa Version) 53 * &RQ 54 * Ipswitch Instant Messenger 55 * Eighth Wonder Catax 56 * Simple Instant Messenger 57 * Vista IM 58 * GAIM 59 * Global-IM 60 * Psi Jabber client 61 * Messenger2 62 * Picasa Hello 63 * iWon 64 * Blowsearch 65 * !MessageMate 66 * Meca Messenger 67 * Qnext 68 * Bubbler (Five Across) 69 * !InterComm IM (Five Across) 70 * Easy Message 71 * QIP 72 * Gizmo 73 * !MySpace IM 74 * Exodus 75 * Gadu-Gadu 76 * Mail.Ru Agent 77 * !ScatterChat 78 * Just Another Jabber Client 79 * Maple Messenger 80 * Pandion 81 * IMVITE Messenger 82 * Oyco Messenger. 45 83 46 84 == "But surely something is better than nothing, right?" == … … 54 92 When people propose inefficient security, it's because they prefer a false sense of security to a false sense of insecurity. File systems, in general, do a very good job of keeping your information private. For most people, there is no insecurity inherent in plain-text passwords. There's only the perception that, because they can read their passwords with ease, that perhaps others can too. Obfuscated passwords are no more secure than plain text; they can be read, about just as easily with the aid of certain programs. It provides a false perception of security. 55 93 56 We're 100% fine with people having false perceptions of how insecurely Pidgin handles your passwords. We are not okwith sacrificing actual security for false security.94 We're 100% fine with people having false perceptions of how insecurely Pidgin handles your passwords. We are not, however, fine with sacrificing actual security for false security. 57 95 58 96 == "Is that the final word?" ==
