Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

on the ISP level, how can someone monitor messenger talks? isn't the p2p architecture immune to such surveillance? and how do different instant messaging clients compare in that sense?

share|improve this question
up vote 5 down vote accepted

Yes, they can be monitored by anyone along the path of the conversation. There are steps that can be taken to mitigate this. For example, Pidgin with either the Pidgin Encryption or OTR plugins can be used to setup encrypted channels between the two endpoints. It also works with chat services such as GTalk, AIM, MSN, etc where the infrastructure is managed by a third party.

share|improve this answer
isn't any of the chat services secure? does SSL encryption mitigate any of this? as far as I know it should – ouais Apr 27 '11 at 22:19
SSL terminates at the server/provider. So in theory an inside person could still monitor it. OTR is the only truly secure method. – Keith Apr 27 '11 at 22:29
could u please explain what does "terminates at the server" means? – ouais Apr 28 '11 at 18:44
It basically means that the server decrypts the communications. For example, on a client/server chat network, the client sends the chat text to the server, which the relays it to the other end of the conversation. If the service offers SSL encryption, then each client maintains an independent encrypted session. The server in the middle decrypts and re-encrypts. You can overcome this with something like Pidgin Encryption or OTR which in essence inserts another layer of encryption that only the two people can decrypt. – Xenoactive May 7 '11 at 3:20

All of your outgoing traffic goes through your ISP's wire. Unless that traffic is encrypted with pre-shared keys that have never been exchanged over that wire, your ISP can monitor anything. Indeed, all the routers that your traffic goes through can do so.

If the chat server offered an SSL service, your traffic would be encrypted using its certificate. However, since the chat service can decrypt your traffic (because it's the one encrypting it), it can monitor your chat traffic. This takes your ISP out of the loop but forces you to trust your chat server and also the issuing authority of the SSL certificate.

p2p isn't inherently secure because your outgoing traffic is still hitting your ISP's wire, unless it is encrypted with pre-shared keys that have never been exchanged over that wire. p2p encryption relies on a key or "certificate" offered by the other peer you are connecting to. Takes your ISP out of the loop, but forces you to trust the other peer.

TL;DR: Listen to @Xenoactive.

share|improve this answer
Secure key negotiation over an open wire is completely possible. The problem is with authenticating who you're actually talking to. – Ben Voigt Apr 27 '11 at 23:50
See Diffie-Hellman key exchange. – Hello71 Apr 28 '11 at 0:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .