[OTR-users] pidgin-otr doesn't handle multiple connections/resources to same account

[Daniel Perelman]

On Wed, Jul 7, 2010 at 16:39, Brian Parma <freecode at cox.net> wrote:
> Hey, I have a question/idea/feature request?
>
> When two accounts are communicating over a program like pidgin, say 'client
> A' and 'client B', but one of them is connected twice, from two separate
> computers/locations, say 'client A/home' and 'client A/work', OTR doesn't
> handle this situation well.
>
> If 'client B' tries to initiate an OTR session with 'client A', both 'client
> A/home' and 'client A/work' get the message and try to initiate an OTR
> session.  When the first one to respond estables a session, the other
> connection gets garbled messages and tries to refresh the OTR session.  When
> that succeeds, the first connection does the same, and session just bounces
> back and forth between the two connections producing lots of OTR message
> spam.
>
> Shouldn't it be possible for OTR to identify itself based on connection, so
> in this situation 'client B' can establish two separate OTR sessions, one to
> each connection of 'client A'?  XMPP uses a 'resource' identifier to
> distinguish between separate connections to the same account, but even for
> protocols that don't it seems like OTR can generate a connection id itself.
>
> This is the only problem I have when using otr over pidgin, it's very useful
> for cross platform secure comms.

The problem has been discussed on this list previously. A fix has
apparently been designed and at least a beta has been coded up
according to this mailing list post
http://lists.cypherpunks.ca/pipermail/otr-users/2009-October/001739.html
but it has not been released yet.

A reply to that post mentioned that development versions can be found
at ftp://ftp.xelerance.com/libotr/ /
ftp://ftp.xelerance.com/pidgin-otr/ . As that is prerelease code, the
new protocol version might still be changed.

  - Daniel