<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><br><span>Sadly I don't have a great idea to solve the problem either, but I experienced similar problems (and solutions) with authentication. I used as well the "2 Words, all lowercase"-like workaround, nevertheless I and the other person often failed. The best way I found is to set up the authentication in real live and to tell "now write [these characters]". <br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><span>It is a great improvement to have the
shared answer-question instead of having to read the keys itself. But at least in my experience authentication is not done even by technology and security-wise actually well educated individuals. E.g. most computer scientists I know have not done it (but use the encryption part of OTR), not to speak of "non-nerds" who don't understand at all what I want them to do and who are not very enthusiastic anymore once we failed 1 or 2 times to get the shared secret answer right. <br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><span>- Jan<br></span></div><div style="display: block;" class="yahoo_quoted"> <br> <br> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial,
Lucida Grande, sans-serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> Ian Goldberg <ian@cypherpunks.ca> schrieb am 15:43 Dienstag, 10.Dezember 2013:<br> </font> </div> <div class="y_msg_container">On Tue, Dec 10, 2013 at 03:34:09PM +0100, Daniel Brendle wrote:<br clear="none">> Hello, OTR-people<br clear="none">> <br clear="none">> <br clear="none">> //Edit. As i read through my email again, i recognized that it would be<br clear="none">> more readable writing "person A" for the person that wants to<br clear="none">> authenticate someone by question-and-answer and "person B" for the<br clear="none">> person who is to answer the secret question.<br clear="none">> <br clear="none">> I have a question regarding the question/answer-authentication-process<br clear="none">> in OTR. It often happens, that me and friends, who i try to convince to<br clear="none">> using OTR end up doing the
authentication several times because of mere<br clear="none">> typos or upper-/lowercase stuff. In other cases, person B knows the<br clear="none">> right answer to the question but expresses it in an other manner that<br clear="none">> person A the question expected.<br clear="none">> <br clear="none">> When i understand OTR right, the communication (also the<br clear="none">> verification-process) is already done under the protection of<br clear="none">> encryption.<br clear="none">> Wouldn't it be possible to send the question to person B, wait for the<br clear="none">> answer and let person A interpret the result, not the machine, without<br clear="none">> losing strength of security?<br clear="none">> <br clear="none">> As i see it, it would even increase security as well as usability:<br clear="none">> <br clear="none">> 1. We could utilize much more complicated questions that require much<br
clear="none">> more complicated answers, which were, as it currently is done,<br clear="none">> impossible to do because there are differences in the version of person<br clear="none">> A and person B.<br clear="none">> 2. It would increase usability of OTR and thereby acceptance by more<br clear="none">> normal not-geeky people.<br clear="none">> <br clear="none">> Maybe i am missing something. Why is OTR not working the way i<br clear="none">> described?<br clear="none">> <br clear="none">> Regards, Grindhold<br clear="none">> <br clear="none">> Kudos to the OTR-Devs. You are doing marvellous work. <br clear="none"><br clear="none">Unfortunately, that would be fatal to security. The purpose of the<br clear="none">authentication protocol is to distinguish the case where Alice is<br clear="none">talking directly to Bob over an encrypted channel (the desired case)<br clear="none">from the case where Alice is
talking to an eavesdropper over an<br clear="none">encrypted channel, and the eavesdropper forwards the messages to Bob<br clear="none">over another encrypted channel (the man-in-the-middle case). See<br clear="none"><a shape="rect" href="https://otr.cypherpunks.ca/help/4.0.0/levels.php" target="_blank">https://otr.cypherpunks.ca/help/4.0.0/levels.php </a>for a picture.<br clear="none"><br clear="none">If Bob just typed his answer and it was sent to Alice, then in the<br clear="none">second case, the eavesdropper would *also* see the answer, and indeed<br clear="none">Alice would accept the answer. This would be very bad.<br clear="none"><br clear="none">What I typically do is ask the question, and also put something like "(2<br clear="none">words, all lowercase)" at the end of the question.<br clear="none"><br clear="none"> - Ian<div class="yqt2813310128" id="yqtfd10284"><br
clear="none">_______________________________________________<br clear="none">OTR-users mailing list<br clear="none"><a shape="rect" ymailto="mailto:OTR-users@lists.cypherpunks.ca" href="mailto:OTR-users@lists.cypherpunks.ca">OTR-users@lists.cypherpunks.ca</a><br clear="none"><a shape="rect" href="http://lists.cypherpunks.ca/mailman/listinfo/otr-users" target="_blank">http://lists.cypherpunks.ca/mailman/listinfo/otr-users</a><br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>