2
$\begingroup$

I am using Adium and wondering how secure it is.

I believe it uses AES-256 (I do not understand what that means) by default. It also requests that users exchange fingerprints with each other before encrypted conversations can occur, and that a unique key is used for each conversation. Logging can be turned on or off, depending on user preference.

Does this allow users that suspect snooping to breathe easier, or is it all show?

Improve this question
$\endgroup$
3
  • $\begingroup$ What you are describing is the OTR protocol, which Adium uses. I edited to make the question about the protocol rather than the particular software, so it is more generally applicable. $\endgroup$
    – otus
    Commented Apr 28, 2016 at 5:56
  • $\begingroup$ Known attacks or their lack would not be too broad here, IMO. $\endgroup$
    – otus
    Commented Apr 28, 2016 at 14:41
  • $\begingroup$ @otus Hmm, we already have a "yes, if the implementation is secure" answer, without much further depth. I'm still not sure if this question isn't too broad. I'll leave it be, but people may want to consider the value of the answers provide below. $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 29, 2016 at 13:01

1 Answer 1

Reset to default
2
$\begingroup$

If you ask about the protocol itself, as a theoretical construct, then it is safe. In theory it indeed provides all the feature that it promises.

And now for the "but..." part. When you use a protocol to communicate, you are actually using one implementation of the protocol. The implementation tries to do exactly what the protocol says. However you can never be sure that there are no bugs in the source code.

What i am trying to say is that OTR is definitely not all show. Theoretically it provides everything that it promises, and practically the libotr library (which i think adium uses) is a good implementation of the protocol with active development and security audits (i believe). So it definitely is better than no encryption at all and if you suspect snooping you should definitely use it.

Lastly if you want even more security dont rely only on otr.You must learn how to use crypto properly, use other protocols for anonymisation, obfuscate you traffic etc.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.