search

openfaux / openfaux-server

Browser add-on for encrypting and masking internet traffic.
https://openfaux.org
GNU Affero General Public License v3.0
72 stars 18 forks source link

OTR #40

Open nb333 opened 10 years ago

nb333 commented 10 years ago

Based on the feedback we've received from multiple people regarding our current structure, we are trying to implement OTR, instead of the custom protocol we had in mind.

Please let me know if you're interested in helping. :)

tarqd commented 10 years ago

See my comment on #51 (https://github.com/openfaux/openfaux-client/issues/51).

OTR Libaries: Pure JS (Emscriptlen Compiled): otr4-em Native Bindings (Node.js bindings to the native library used by pidgin, adium and others): otr4

elimisteve commented 10 years ago

Implement OTR in what language? You can find the libotr C source here: http://sourceforge.net/p/otr/libotr/ci/master/tree/

elimisteve commented 10 years ago

The README mentions Python as the server-side language. There's this Python OTR implementation: https://github.com/afflux/pure-python-otr

nb333 commented 10 years ago

@elimisteve JavaScript for client-side and Python for server-side.

louismullie commented 10 years ago

Cryptocat has a good implementation at https://github.com/cryptocat/cryptocat/blob/master/src/core/js/lib/otr.js

It's maintained by @kaepora and has been very well reviewed. I would advocate for this implementation on the client side.

nb333 commented 10 years ago

@louismullie @kaepora Thanks for the mention! I'm very familiar with Cryptocat. Quick question though, can OTR be repurposed for HTTP?

mischief commented 10 years ago

what's the goal here with using OTR? if the goal is perfect forward secrecy, tls already offers ciphersuites which have pfs.

Fohlen commented 10 years ago

Still doesn't that lead to relay traffic using a proxy-sided server? You made any thought about resolving this issue so far? @nb333 Note there's a pure python implementation of OTR - https://github.com/afflux/pure-python-otr Please also note that OTR is designed for encrypting conversations, although it is a strong e2ee encryption this leads to make OTR less usable for large texts (such as images, videos!)