on the ISP level, how can someone monitor messenger talks? isn't the p2p architecture immune to such surveillance? and how do different instant messaging clients compare in that sense?
2 Answers
Yes, they can be monitored by anyone along the path of the conversation. There are steps that can be taken to mitigate this. For example, Pidgin with either the Pidgin Encryption or OTR plugins can be used to setup encrypted channels between the two endpoints. It also works with chat services such as GTalk, AIM, MSN, etc where the infrastructure is managed by a third party.
-
isn't any of the chat services secure? does SSL encryption mitigate any of this? as far as I know it should– ouaisApr 27, 2011 at 22:19
-
SSL terminates at the server/provider. So in theory an inside person could still monitor it. OTR is the only truly secure method.– KeithApr 27, 2011 at 22:29
-
-
It basically means that the server decrypts the communications. For example, on a client/server chat network, the client sends the chat text to the server, which the relays it to the other end of the conversation. If the service offers SSL encryption, then each client maintains an independent encrypted session. The server in the middle decrypts and re-encrypts. You can overcome this with something like Pidgin Encryption or OTR which in essence inserts another layer of encryption that only the two people can decrypt. May 7, 2011 at 3:20
All of your outgoing traffic goes through your ISP's wire. Unless that traffic is encrypted with pre-shared keys that have never been exchanged over that wire, your ISP can monitor anything. Indeed, all the routers that your traffic goes through can do so.
If the chat server offered an SSL service, your traffic would be encrypted using its certificate. However, since the chat service can decrypt your traffic (because it's the one encrypting it), it can monitor your chat traffic. This takes your ISP out of the loop but forces you to trust your chat server and also the issuing authority of the SSL certificate.
p2p isn't inherently secure because your outgoing traffic is still hitting your ISP's wire, unless it is encrypted with pre-shared keys that have never been exchanged over that wire. p2p encryption relies on a key or "certificate" offered by the other peer you are connecting to. Takes your ISP out of the loop, but forces you to trust the other peer.
TL;DR: Listen to @Xenoactive.
answered Apr 27, 2011 at 22:37
-
Secure key negotiation over an open wire is completely possible. The problem is with authenticating who you're actually talking to. Apr 27, 2011 at 23:50
-