[OTR-users] Re: automatic end-private on logoff?

[Chad Perrin]

On Mon, Oct 29, 2007 at 01:51:47PM -0500, Robert Eden wrote:
> On 10/29/2007 1:32 PM, Paul Wouters wrote:
> >
> >A) Some logoffs hapen without sending a message (network disconnect)
> >B) no clear text may ever flow if we expect crypted.
> >C) there is no security on "log off" message, so an attacker could try
> >   and force you to disable crypto.
> >
> >The proper way to "log off" is to select "end private conversation", which
> >does what you edpect it to do. I am unsure why this is not done when one
> >actively sends a "log off" (go offline) with pidgin. Ian?
> >  
> Well, the disconnected side is already gone.. the problem is the side 
> that stays up.  I can see the problem with faking a logoff message.  
> Does Pidgin provide that sort of thing separate from the message 
> stream?  If it does, auto end-conversation  would be a nice feature. If 
> it doesn't, I agree that it's not worth the security risk.

Is there any reason this can't be handled in part on the side that
doesn't have the problem?  For instance:

  Foo and Bar are talking to one another in a "private" conversation.

  Foo loses its connection, then reconnects.

  Bar, unaware that Foo had a momentary network hiccup, blithely sends
  its next encrypted message.

  Foo receives the message and goes "Woah, this is encrypted."

  Foo contacts Bar, saying "Hey, you, reconnect with me to start a new
  private conversation."

  Bar responds, saying "Holy cow, didn't realize you dropped off.  Here's
  the reconnect stuff.  How many encrypted messages did you receive after
  reconnecting?"

  Foo says "One that I've noticed."

  Bar resends it.

Voila, everyone's happy.  Obviously, this is a very high-level view of a
re-handshake approach, and would require the clients to be able to
recognize the difference between encrypted and unencrypted messages.

-- 
CCD CopyWrite Chad Perrin [ http://ccd.apotheon.org ]
John Kenneth Galbraith: "If all else fails, immortality can always be
assured through spectacular error."