<div dir="ltr"><div style>Thanks for identifying this issue Florian. I'll gladly accept patches to fix this in weechat-otr and I'm going to look at it myself as well.</div><div style><br></div><div style>It does seem like there are some potential security issues so maybe the default should continue to be encrypt everything unless the user opts-in.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Dec 17, 2012 at 8:43 AM, Florian Bruhin <span dir="ltr"><<a href="mailto:me@the-compiler.org" target="_blank">me@the-compiler.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Heya,<br>
<br>
I apologize if someone in the CC is already on this mailinglist.<br>
<br>
There are currently some plugins for IRC clients to use OTR, the<br>
official one for pidgin[0], one for weechat[1], and one for<br>
irssi/xchat/weechat[2].<br>
<br>
Potentially this could also affect Adium[3], CenterIM[4], Kopete[5]<br>
and Miranda[6], which all speak IRC, but I did not test them. If<br>
someone could take the time to test this and submit a bug report if<br>
it's also broken, I'd be glad.<br>
<br>
Today I encountered a problem when using OTR: IRC CTCPs[7] seem to be<br>
broken in all the clients I tested (weechat/irssi/pidgin). This means<br>
outgoing CTCPs are sent encrypted (because they are just PRIVMSGs as<br>
well), but ingoing encrypted CTCPs are not handled correctly (i.e. you<br>
get a literal \001VERSION\001 as a message, for example).<br>
<br>
Furthermore I encountered a problem when using weechat with the<br>
weechat-otr plugin with bitlbee[8] (IRC to IM gateway) and the<br>
bitlbee_typing_notice[9] plugin: The plugin signalizes to bitlbee the<br>
user is currently typing by sending a CTCP TYPING, which is parsed by<br>
the bitlbee server and sent in the respective way to the messenger<br>
protocol. Now since the CTCP is OTR-encrypted, the server can't handle<br>
it and it gets passed to the other client, the result is this:<br>
<br>
<a href="http://the-compiler.org/tmp/bitlbee_otr_ctcp.png" target="_blank">http://the-compiler.org/tmp/bitlbee_otr_ctcp.png</a><br>
<br>
IMHO, this is how CTCPs should be handled:<br>
<br>
- When sending a CTCP TYPING, pass it unencrypted since it's probably<br>
directed to bitlbee and won't arrive at the other end. (At least<br>
this applies to irssi and weechat, since they both have scripts to<br>
do the CTCP TYPING messages, I doubt anyone would want to send them<br>
by hand)<br>
<br>
- For any other CTCP, send it encrypted like it is now (it could be a<br>
CTCP ACTION aka. "/me" after all)<br>
<br>
- When recieving a messsage which is a CTCP (any part enclosed in<br>
\001 inside a PRIVMSG or NOTICE according to [10]) there should -<br>
if possible in the plugin APIs - a "fake" CTCP be sent to the<br>
client. For "/me" maybe some special action is neccessary.<br>
<br>
For weechat-otr, I'll probably send a pull request somewhere after<br>
christmas. For the others, would be nice if this could be fixed, as at<br>
least /me and CTCP VERSION are used from time to time.<br>
<br>
Florian<br>
<br>
[0] <a href="http://www.cypherpunks.ca/otr/" target="_blank">http://www.cypherpunks.ca/otr/</a><br>
[1] <a href="https://github.com/mmb/weechat-otr" target="_blank">https://github.com/mmb/weechat-otr</a><br>
[2] <a href="http://irssi-otr.tuxfamily.org/" target="_blank">http://irssi-otr.tuxfamily.org/</a><br>
[3] <a href="http://adium.im/" target="_blank">http://adium.im/</a> (OTR builtin)<br>
[4] <a href="http://www.centerim.org/" target="_blank">http://www.centerim.org/</a> (OTR builtin)<br>
[5] <a href="http://kopete.kde.org" target="_blank">http://kopete.kde.org</a> (OTR builtin)<br>
[6] <a href="http://code.google.com/p/mirotr/" target="_blank">http://code.google.com/p/mirotr/</a><br>
[7] <a href="http://en.wikipedia.org/wiki/Client-to-client_protocol" target="_blank">http://en.wikipedia.org/wiki/Client-to-client_protocol</a><br>
[8] <a href="http://www.bitlbee.org/" target="_blank">http://www.bitlbee.org/</a><br>
[9] <a href="http://www.weechat.org/scripts/source/stable/bitlbee_typing_notice.py.html/" target="_blank">http://www.weechat.org/scripts/source/stable/bitlbee_typing_notice.py.html/</a><br>
[10] <a href="http://www.irchelp.org/irchelp/rfc/ctcpspec.html" target="_blank">http://www.irchelp.org/irchelp/rfc/ctcpspec.html</a><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
() ascii ribbon campaign - stop html mail <a href="http://www.asciiribbon.org" target="_blank">www.asciiribbon.org</a><br>
/\ <a href="http://www.the-compiler.org" target="_blank">www.the-compiler.org</a> | I love long mails <a href="http://email.is-not-s.ms/" target="_blank">http://email.is-not-s.ms/</a><br>
A fool and his honey are soon parted.<br>
</font></span></blockquote></div><br></div>