back to article Critical flaw in Pidgin, Adium's Off The Record chat lib. Patch ASAP

Security researchers have discovered a critical vulnerability in libotr, a software library used in chat apps to send and receive encrypted messages. Several instant messengers – including ChatSecure, Pidgin, Adium and Kopete – are affected by the remote-code execution bug in libotr, which was discovered by Markus Vervier at …

  1. Voland's right hand Silver badge

    Can we have that fast network connection please?

    Sending such a message to a pidgin client took only a few minutes on a fast network connection

    I was going to comment about it being unrealistic. However a quick back of the fag packet calculation shows under 7 minutes at modern Cable network or FTTH speeds, so the speed part is not unrealistic as it seems. With congestion, overheads, etc - you are looking at 20-30 mins which is not unrealistic. Now, eating 8G RAM on the client without it being "noticeable" is slightly different. That is probably easier to notice.

    1. Anonymous Coward
      Anonymous Coward

      Re: Can we have that fast network connection please?

      likely being swapped to disk, so unlike to be noticed.

  2. This post has been deleted by its author

    1. Gene Cash Silver badge

      > write your own code

      Sure... the security analysts will be happy to have a chance to find lots of new vulnerabilities in brand new unvetted code.

      "Go fer it, d00d!"

  3. Anonymous Coward
    Anonymous Coward

    plugin

    Isn't OTR a plugin for pidgin, thus only need to patch if you have the plugin installed, and then only on 64 bit systems?

  4. Unicornpiss

    5.5 GB...

    Is one hell of a chat message!

    But I have to admit that when we're all busy, do we even notice what our chat software is doing for up to an hour at at time?

  5. Fungus Bob

    Good thing I don't use computers for any sort of communication...

  6. MNGrrrl
    Holmes

    Point missed.

    That whooshing sound is the point going over the previous posters' comments. I used OTR when I had a friend in China, who worked for their telecom company. He helped install parts of the 'great firewall of china', but being an ex-pat, still wanted to talk to his buddies at home. Said firewall does a lot of keyword searching and other such, but it isn't exactly an intelligent beast. Much like the Great Transparent Proxy that the USA uses (funny, nobody considers that...), it is designed for bulk collection and processing and when we were using it, OTR was a very niche thing nobody really knew about -- thus the GFOC wouldn't notice or flag encrypted communication over a protocol and configuration that it was looking at as plain text: It would just see a long stream of random characters that wouldn't match any of its filters.

    Software like this isn't just for 'criminals' or 'terrorists'... it's also for the people who are well aware of the surveillance in the world and simply want to be left alone. My friend wasn't engaged in some clandestine intelligence operation... mostly, we just talked about video games, caught up on what people were doing back here he knew when he was state-side... very ordinary stuff. But in an era where bringing a fingernail clipper on a plane can get you years in prison, even the most mundane things can become a danger when an overzealous government thug sees an automated alert and, lacking any higher level brain function, roflstomps his way all over some innocent person's face.

    We don't live in civilized society anymore. We need tools like this. Everyone does -- because even if you are the kind of naive idiot who thinks your government is the best simply because *you* were born under it... there's over two hundred other governments filled with the same kind of naive idiots, and very likely think *you* are the enemy. Unfortunately, this level of stupidity is exceedingly common... and while I'd love to put them in a room together and let them wallow in their mutual stupidity -- I have to live on this planet too.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like