agl / xmpp-client

An XMPP client with OTR support
BSD 3-Clause "New" or "Revised" License
365 stars 76 forks source link

Sending content to wrong resource after starting OTR conversation. #51

Open rubin110 opened 10 years ago

rubin110 commented 10 years ago

I've got a hyper-paranoid as hell friend (his name is @leif ) using your client. I'm using Pidgin with OTR on my laptop through Debian and Xabber on my Android device with OTR disabled because OTRs multi-client design is completely messed up and no one implements it right. Your client on Leif's machine initiated OTR with my Pidgin client but then any new actually containing content messages from Leif got directed to Xabber on my Android device as pure OTR vomit. The only way I was able to get the messages over into Pidgin was to kill the client on my Android device.

My friend Leif is obnoxiously paranoid, could you please fix this before I fly to Berlin and punch him in the face for inconveniencing all of his friends through is hyper-paranoid-tin-foil-hat-annoying-as-fuck-hacker-fanboy-mannerisms? Hopefully now that I've totally de-anonymised him he'll drop by here and provide more info to this bug. Thanks!

SuperQ commented 10 years ago

I've also experienced this with different clients. Multi-client functionality is handled better in OTRv3 protocol. (libotr 4.0)

It looks like this implementation only supports OTRv2 and OTRv1

agl commented 10 years ago

I would imagine that this is something to do with Jabber's complex ID system. If anyone knows XMPP well enough to explain how servers actually implement this I'd be happy to do what they expect.

ageis commented 9 years ago

@rubin110 copying your otr.private_key between clients can alleviate some of the problems associated with multiple simultaneous sessions

https://guardianproject.info/apps/keysync/

isislovecruft commented 9 years ago

@ageis I believe @rubin110's setup includes keeping separate keys for separate devices (i.e. because a smartphone or work computer is not considered as secure as one's personal laptop, or that a compromise of one shouldn't effect another), so copying private keys around won't actually help them much. Either way, one shouldn't have to switch to another device mid-conversation just because that's where the messages accidentally went to. :)

For what it's worth, I've run into @rubin110's bug, though I cannot reliably reproduce it.

sternenseemann commented 9 years ago

Maybe it would be easiest to remember the resource the OTR conversation was inititated with and the send it to the specific resource.

@rubin110 does your xabber have a higher priority than pidgin on your desktop?