[OTR-users] Opinions on proposed "unknown fingerprint" behaviour?

[Ian Goldberg]

On Fri, May 20, 2005 at 10:51:26AM -0400, Jason Cohen wrote:
> I like the idea of having the "private connection established" dialog
> box as an in-conversation message with the abiliity to get the session
> id and fingerprint by clicking the OTR Private button. However, I think
> there should still be an option to keep the old system in place with
> regard to accepting new fingerprints. The system is only secure if the
> fingerprint is authenticated out of bounds. Otherwise, you don't know
> who you're talking to. I understand that some users might not want to do
> this so they should have the option of auto-accepting new keys. I still
> think a dialog box should come up asking if you want to accept the
> fingerprint so that you can override the automatic choice without
> needing to access the known fingerprint list.

Right.  So there would be something like a "Require explicit
confirmation of new fingerprints" option, default off.

If it's off:
    - When a new fingerprint comes in, it's auto-accepted, so that the
      conversation can proceed.
    - A dialog box showing the new fingerprint is displayed, with "Yes"
      and "No" buttons.
    - The "Yes" button simply dismisses the dialog box.
    - The "No" button ends the private connection, forgets the
      fingerprint, and dismisses the dialog box.

If it's on (the current behaviour):
    - When a new fingerprint comes in, it's not auto-accepted.  Messages
      that come in at this point will generate errors.
    - A dialog box showing the new fingerprint is displayed, with "Yes"
      and "No" buttons.
    - The "Yes" button accepts the fingerprint, and dismisses the
      dialog box.
    - The "No" button simply dismisses the dialog box.

> I also like getting the "private connection established" dialog box as
> it clearly informs methat a private conversation has been started even
> if gaim is minimized. Could we have the option of keeping the "private
> connection established" dialog box, while setting the default as an
> in-conversation message?

A "Display 'private connection established' dialogs" checkbox, default
off.

If it's off, you get the behaviour I decribed in the other message.

If it's on, you get the current behaviour (but clicking the "OTR:
Private" button would still bring up the window, and you'd have to click
a button on *that* window to refresh the private connection; this seems
ugly, though; if someone's got a better UI suggestion for how to (a)
bring up the session id information, or (b) refresh a private
connection, please speak up!).

> Also, I was wondering if gaim-otr 2.0.2 is going to be released on
> debian sid. libotr 2.0.2 is already in sid but the newest version of
> gaim-otr is 2.0.1 which conflicts with gaim-encryption.

You'll have to ask Thibaut, the debian maintainter, about that.

   - Ian