Repository navigation
Off-the-Record (OTR) Messaging [$1,000] #36
Description
There is a $1,000 open bounty on this issue. Add to the bounty at Bountysource.
{{ message }}
There is a $1,000 open bounty on this issue. Add to the bounty at Bountysource.
Activity
charlieman commentedon May 29, 2015
You mean beyond https?
wanderer commentedon May 29, 2015
it would be nice if it has some OTR for direct messaging
sampaiodiego commentedon May 30, 2015
the idea of OTR implies in not saving the message on db?
engelgabriel commentedon May 30, 2015
Off-the-Record (OTR) Messaging
Allows you to have private conversations over instant messaging by providing:
Encryption
No one else can read your instant messages.
Authentication
You are assured the correspondent is who you think it is.
Deniability
The messages you send do not have digital signatures that are checkable by a third party. Anyone can forge messages after a conversation to make them look like they came from you. However, during a conversation, your correspondent is assured the messages he sees are authentic and unmodified.
Perfect forward secrecy
If you lose control of your private keys, no previous conversation is compromised.
[-]Does it Encrypt Messages?[/-][+]Off-the-Record (OTR) Messaging[/+]kumavis commentedon Jun 1, 2015
I don't know if this implementation has been audited or not but https://github.com/arlolra/otr
Calinou commentedon Jun 2, 2015
kumavis commentedon Jun 2, 2015
And further reading on the state of otr arlolra/otr#59
comigor commentedon Jun 3, 2015
I think otr is the best option we have, audited or not, cryptocat uses it.
As said on arlolra/otr#59, pointed by @kumavis, just few other implementations are available, and otr4-em and node-otr4 aren't well compatible with Meteor, because we can't use client-side node packages.
comigor commentedon Jun 3, 2015
It's indeed very easy to implement OTR using arlolra/otr.
Just made a simple PoC Igor1201/otr.
engelgabriel commentedon Jun 3, 2015
Looks like this feature has more people interested than I expected. I'll raise its priority. 👍
engelgabriel commentedon Jun 3, 2015
Can any of you guys do a Pull Request or create a fork with a proposed implementation?
engelgabriel commentedon Jul 6, 2015
Hi @Igor1201 can we work together to get your PoC to work on Rocket.Chat?
85 remaining items
PanderMusubi commentedon Aug 23, 2018
You can add this line at the top of the issue description, it will update itself
and look like
sscotth commentedon Oct 9, 2018
It is still listed on BountySource, but #10094 was released with v0.70.0. So I assume it has not been claimed yet. Either way this issue should be closed.
@mrinaldhar @geekgonecrazy @wanderer @jespow
ccoenen commentedon Oct 9, 2018
Is that pull request really OTR, though? From the commits alone I can't tell. E2E and OTR are very different things.
geekgonecrazy commentedon Oct 9, 2018
@RocketChat/core can someone address the concerns here.
Technically OTR has been in for a while. Now we have E2E encryptions with #10094
Does this issue need to stay open for some specific tasks for OTR? Maybe refactoring OTR to go on top of the e2e?
cc: @engelgabriel
sscotth commentedon Oct 9, 2018
#36 (comment)
sscotth commentedon Oct 9, 2018
@LemonAndroid I don't think the issuer is responsible for submitting the completion claim.
Merge pull request RocketChat#36 from WideChat/ear_real_user_name_invite
Neustradamus commentedon Mar 30, 2020
Any news on it?
gustavorps commentedon Jun 18, 2020
Bountysource decided to update their Terms of Service:
https://www.bountysource.com/issues/18684038-off-the-record-otr-messaging
HLFH commentedon Jun 18, 2020
@gustavorps Withdrawn. https://twitter.com/Bountysource/status/1273406549252177920
But RocketChat needs to migrate to another bounty platform.