After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 545347 - Empathy should support OTR encryption
Empathy should support OTR encryption
Status: RESOLVED OBSOLETE
Product: empathy
Classification: Core
Component: General
2.28.x
Other All
: Low enhancement
: ---
Assigned To: empathy-maint
empathy-maint
: 636483 641617 729709 738762 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2008-07-29 17:27 UTC by Fionn Behrens
Modified: 2018-05-22 13:12 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Fionn Behrens 2008-07-29 17:27:56 UTC
The only reason that keeps me from switching from pidgin to empathy is that
at my company OTR is mandatory for IM. It is the only IM encryption model so
far that works across many different platforms and protocols, so most people
can stay with their favourite IM client and still communicate safely. Most
people, but empathy users are not in the club.

Please note that I filed this request for the telepathy framework as well
(https://bugs.freedesktop.org/show_bug.cgi?id=16891). But since OTR goes on top of the IM layer it could as well be implemented in the application layer. It is up to you to decide if you want to wait for them (potentially forever) to implement this quasi-standard of IM encryption.

As mentioned, there is an OTR plugin for pidgin for reference and an OTR library (libotr, written in C).
Comment 1 Fionn Behrens 2008-07-29 17:29:08 UTC
Addendum, just for reference: http://www.cypherpunks.ca/otr/
Comment 2 Tobias Florek 2008-11-16 11:57:30 UTC
having no experience in empathy's codebase, i might implement this, if i can get some pointers, as to where to start. (i guess for the empathy-part i will not need real mentoring, just a start)

Comment 3 Frederic Peters 2008-12-10 11:16:08 UTC
https://bugs.freedesktop.org/show_bug.cgi?id=16891
Comment 4 Karl G 2009-01-25 22:23:11 UTC
This is very important! Especially for users of ICQ and all other IMs with forced Servers (all but XMPP) - just read ICQs EULA!
Comment 5 northa 2009-07-27 09:27:26 UTC
Second this. We have users on otr at work, and there's no way we could make a switch before otr support is implemented in empathy.
Comment 6 Eric Hopper 2009-08-03 07:25:05 UTC
I refuse to use Empathy until there is OTR support.  If the developers want to implement a better way to handle OTR over XMPP, they can go right ahead.  But it had better have OTRs deniability features as well.  My IM conversations are not, as a general rule, binding contracts.  And it should still support the old way so that it interoperates with older clients.
Comment 7 Xavier Claessens 2009-08-03 17:04:02 UTC
Eric, please stop flaming. We know you refuse to use Empathy.

Please use another IM client and stop squating Empathy/Telepathy bugs.
Comment 8 Karl G 2009-08-03 17:39:46 UTC
Xavier: Yes and i know the developers refuse OTR. Is there any posibillity to add a OTR plugin to empathy/telepathy, like pidgin offers?
Comment 9 Xavier Claessens 2009-08-03 18:13:36 UTC
There is no plugin system in Empathy.
Comment 10 Guillaume Desmottes 2009-08-28 12:30:44 UTC
As lot of people seem to want this feature, I think it could make sense to implement it as a plugin. There is no plan to add a plugin system to Empathy for now (#547208) so that probably won't happen soon though.
Comment 11 Matěj Cepl 2009-09-23 08:57:44 UTC
Just for the record ... there was a development in OTR world, so now the current fashion is OTRv3 and support of the Socialist Millionaire Protocol. See parallel bug for Adium (http://trac.adium.im/ticket/9768) for more info.
Comment 12 Sumana Harihareswara 2009-10-27 16:42:06 UTC
Recently, Telepathy & Empathy developers started working on API sketches for encrypted channels and OTR.

http://lists.freedesktop.org/archives/telepathy/2009-October/003936.html

It might be most productive for discussion about this issue to take place as replies to the telepathy mailing list.
Comment 13 Sumana Harihareswara 2009-10-30 02:26:43 UTC
*** Bug 594081 has been marked as a duplicate of this bug. ***
Comment 14 Leslie Nooland 2010-06-10 22:05:56 UTC
http://lists.freedesktop.org/archives/telepathy/2009-October/003936.html

I was just interested in the progress of this work? Never heard anything about it since then. Now that empathy is the default client in ubuntu, I am VERY interested in it.
Comment 15 Timo 2010-08-25 13:13:17 UTC
I am also wondering if there is any progress on this issue that was appearantly added to this list on 2008-07-29 17:27:56 UTC, thus being more than two years old.

Since OTR is spreading by the minute among friends, coworkers, partners and customers, it might be admirable how strongly one might stick to principles, but it keeps this client from doing something essential: working.
As the days pass more and more of the people I get aware of the need for at least basic security from spying. (I'll spare you the new/article references)

An OTR plugin is severly needed. 

Why a plugin and not in telepathy or another implementation of encryption further up? Because it keeps the rest of the system clean, is not-confusing and most importantly: can get done without waiting for someone else to write an UI or backend.

An optional plugin would also allow for the basic dependencies of empathy to remain as small as possible.

Nevertheless, it all comes down to one basic line:
Chatting with people must work.

I don't like posting "me too" posts. But this is getting old. Really.
Comment 16 André Klapper 2010-08-25 13:18:33 UTC
patches welcome; the date when this was filed is quite uninteresting (I do naively believe that open source must have unlimited manpower to fix everything immediately though as I try to avoid reality); see comment 12 for the status and a good place to get involved in technical discussions; that's it; thanks for bugmail and the fish; bye; andré
Comment 17 jfisher 2010-08-25 14:43:20 UTC
I'll add my name to the list of people who would love for this to work. Now that empathy is so heavily featured in Ubuntu, included automatically in the default panel set, I think it's beyond time for this support. Philosophy is one thing; practicality is quite another.

I, too, dislike the "me too" comments. But it seems that's the only good way to show demand for something that is clearly needed.

Back to pidgin I go, crossing my fingers empathy developers will be more open to the requests of their users. If it weren't for this, I'd be on empathy in a heartbeat.
Comment 18 André Klapper 2010-08-25 14:59:53 UTC
No, it's not a good way to show demand. In fact "me too" comments just demotivate developers. But that's offtopic for this report too.
(If you feel an urgent need to respond to me, do it by private email instead of adding even more technically useless comments here).


And as it seems to be not totally clear yet:

***************************************************************************
* Try not to comment on a bug report if your comment does not provide any *
* technical information for developers. There are forums for this type of *
* communication. And deliberately ignoring this request is rude. Thanks!  *
***************************************************************************
Comment 19 kxra 2010-08-25 15:58:07 UTC
Enough. I am not a developer...

...but this needs to end. 

Sorry to throw in one last non-technical information, but i feel i should get to the root of this problem and explain to people *why* these comments are counter-productive. 

<<I, too, dislike the "me too" comments. But it seems that's the only good way to
show demand for something that is clearly needed.>>

Well, apparently people know that "me too" comments aren't appreciated, but they don't understand why they are entirely unhelpful. 

Let's stop and think. The #1 cited reason against switching to Empathy (which uses Telepathy) on Ubuntu, was lack of OTR. Understandable, it's an important feature for those who care about privacy, but it wasn't activated by default anyways, so the people who would benefit from it would already have to know about it, and if they already know about it, they can just install pidgin, which still receives full support. 

Still, that's besides the point. I'd love to see encrypted chat, and so would the developers, and after all that has happened, they are acutely aware that all of you would too, and they won't not hear the end of it until it's finally supported. So, does anyone still think they need to let the devs know that there is a demand? 

Demand isn't what is going to get this accomplished. An investment will. A personal investment of time and effort by someone with the abilities to help contribute directly, or an investment of money or other compensation from someone to sponsor that development. And no, you can't just demand that someone else make their own personal investment. Developers' time is valuable, and they will hack if and when they can on what they want to, but they're more likely to work on the features that will put food on the table and a roof over their heads.

If we want this fixed, we should be putting our money where our mouth is or finding someone else (a company) to do it for us, otherwise help look for volunteer contributors. If we'd still like to demand slave labor, don't do it on the bug report. I once did this often, but if you just consider what it must be like for the developers who work their asses off, you might think twice before doing it again. 

I'm sure the devs appreciate all the interest in Empathy, but they're not listening to this bug report because it's entirely full of spam. I've hung out on the #telepathy channel and the devs are working on encrypted chat, and progress has been made. In the meantime, you may use the OTR plugin for Pidgin, or a VPN, or I2P, or Tor, or some other anonymizing/encrypting technology. Please be patient unless you can help make this happen faster.
Comment 20 Timo 2010-08-25 16:28:00 UTC
Actually I always found interest in what I do rather motivating.

Glad to hear about any progress taking place, though. 

To get even more productive and motivational: Is there an official donation system for the project? Or a wishlist? Or any up to date, informative page that is sponsor-viewable? 
One cannot expect a potential source of sponsorship to go into an irc channel, after all. Well one could, but that might not end well.

I am well aware of how failing the "please donate" button system is, partially from own experience. Sadly many many persons seem to think that this kind of software is written by some geeks in their spare time, and still expect the results of a full featured software project. 

However, since every tiny bit helps pay the pizza: I'd suggest a "donate for empathy encryption support development" webpage, that has some newsfeeds and a draft, and a please donate button with big friendly letters on it. Obviously this should be findable with google. Yes, that is timeconsuming web-stuff. The time factor again. :/

Another spot to find support might actually be ubuntu/Canonical. In Canonicals case there might actually be some interest in the functionality of their ubuntu's default chat client, especially if this is needed quite often in business related communication. After all, if done right, this CAN be a strong sales argument.

And if anyone is visiting the summit: http://uds.ubuntu.com/ (I'm not, unfortunately) there might be an opportunity to get in touch with some people who could offer support.

Just a few progressing thoughts.
Comment 21 Guillaume Desmottes 2010-08-26 07:45:04 UTC
Please stop commenting here if you are not going to actually work on OTR support in Empathy/Telepathy.

To be clear, we are well aware that OTR is an important feature for some users. We are not against implementing, we just don't have the man power to do it at the moment.

Rob recently commented on this subject on http://lwn.net/Comments/400871/
Comment 22 Guillaume Desmottes 2010-08-26 10:25:47 UTC
Removing the dep on bug #547208 as OTR should be implemented in Telepathy and not as an Empathy plugin.
Comment 23 Guillaume Desmottes 2010-12-06 10:46:38 UTC
*** Bug 636483 has been marked as a duplicate of this bug. ***
Comment 24 Brian Pepple 2011-02-05 17:41:59 UTC
*** Bug 641617 has been marked as a duplicate of this bug. ***
Comment 25 Christoph Anton Mitterer 2011-08-17 23:34:33 UTC
Perhaps even better would be something that just exchanges OpenPGP conform messages.

This is rock solid cryptography and one could benefit from a large web of trust.

Features like secondary singing/encryption keys should also wipe away any concerns on how such a massive usage could impact the security of the primary key.

It should be even possible to get kind of an deniable communication, by using subkeys that are not published publicly but just used for one certain communication partner.
Comment 26 Matěj Cepl 2011-08-18 09:03:55 UTC
(In reply to comment #25)
> Perhaps even better would be something that just exchanges OpenPGP conform
> messages.

Please, before commenting on this educate yourself what exactly OTR is and why you actually don't want to use PGP (unless you are a stock-broker on Wall Street closing contracts over IM or something similarly rare). Read https://secure.wikimedia.org/wikipedia/en/wiki/Off-the-Record_Messaging and especially http://www.cypherpunks.ca/otr/otr-wpes.pdf (don't worry, it is really not that long).
Comment 27 Christoph Anton Mitterer 2011-08-18 16:53:09 UTC
Yeah well,... I knew that... and therefore I made the notes on deniability above...

Perhaps it is you who should thing first (or better educate on OpenPGP), which also allows this.
Comment 28 André Klapper 2011-12-11 14:48:34 UTC
*** Bug 665920 has been marked as a duplicate of this bug. ***
Comment 29 kxra 2012-03-28 16:02:56 UTC
Any revival of these efforts after the successful UI updates?
Comment 30 André Klapper 2012-03-29 08:03:54 UTC
Danny: Patches to the telepathy bug in bugs.freedesktop.org are welcome.
Comment 31 Luke 2013-06-16 22:24:59 UTC
I think we can all agree with the recent events that this is not even an optional feature. All modern chat clients are supporting OTR and many people/organizations would love to read your private messages.

Some good news some of you may be unaware of, the project of porting OTR was partially started in 2011 here - 
https://gitorious.org/jprvita-repos/telepathy-gabble

Alas the project is dead and incomplete, but the code may be of use to someone revisiting the idea.

Either by Plugin or just built-in to the protocol you need OTR. 
You could also take an OpenShot Video Editor approach to this and I'm sure people would pay for implementation... 
+1 for increasing level of importance to Medium/High. :)
Comment 32 André Klapper 2013-06-16 23:08:38 UTC
No, we don't all agree, and I don't like if people speak for me.
Weasel words like "all modern chat clients" or "many people" don't help either. See http://en.wikipedia.org/wiki/Wikipedia:WEASEL

Plus it's been explained a few times in this report that https://bugs.freedesktop.org/show_bug.cgi?id=16891 needs to get fixed first.
So I don't see the news in the last comment.

> Alas the project is dead and incomplete, but the code may be of 
> use to someone revisiting the idea.

Be that someone! Just do it instead of commenting! Thanks.

> +1 for increasing level of importance to Medium/High. :)

You can even set it to megaurgentimmediate but it won't change a thing or convince any developer if nobody fixes https://bugs.freedesktop.org/show_bug.cgi?id=16891 first. That's been explained several times here.
Comment 33 Fionn Behrens 2013-06-17 21:24:53 UTC
As the original reporter of this bug (and many other unresolved ones) back years ago, I feel obliged to give a heads-up to all those who kindly tried to express their opinion about the importance of this request and got slapped. Thank you for trying.

I myself have pretty much given up on Gnome entirely since - to exaggerate it slightly - all they seem to have done in the last ten years or so was to remove important functionality from all parts of gnome in the name of "Usability" that had already been there, destroying the latter in the course, and convert the sad remnants to something that I no longer feel at home in.

Me and most people I know of have resorted to some Mate- or Cinnamon-based solution now, still constantly looking for alternatives that seem to be worth a try. I think I didnt even start Empathy once more during all the years, since the reactions to my reports made clear that there would be no progress. This bug report clearly shows that there are insufficient resources available to make it a viable alternative to Pidgin so I'll probably stick with that until the IM concept has vanished in the Oblivion of outdated Internet technologies.

So there, thanks for reading and supporting my ideas. Dont take things too serious and just keep reporting. Some bugs might get fixed at last and thats worth all the slapping you get on the other ones.
Comment 34 André Klapper 2013-07-01 08:21:44 UTC
Again, this is NOT high priority as long as https://bugs.freedesktop.org/show_bug.cgi?id=16891 is not fixed.
Comment 35 Vulcain 2013-09-09 11:11:17 UTC
With the NSA's surveillance, this function must move low priority to high.
Comment 36 André Klapper 2013-09-09 11:31:48 UTC
And for the billionth time I write: You need to fix https://bugs.freedesktop.org/show_bug.cgi?id=16891 first before somebody can work on it. 
Was it so hard to read comment 34 first before adding comment 35?
Comment 38 Vulcain 2013-11-08 14:22:08 UTC
Does someone know if this fonction could be add to Friend of Gnome? Whose goals is :
" We want people to be safe, in control, and enriched by the software they use. The GNOME community was inspired by the keynote delivered by Jacob Applebaum on the topic of privacy at this years' GUADEC and was reminded of our mission. To this end, GNOME is working on a new campaign focused on privacy. Through this campaign, we aim to enhance GNOME 3 so that it offers one of the most secure computing environments available "

http://www.gnome.org/friends/
Comment 39 Guillaume Desmottes 2014-05-07 13:48:38 UTC
*** Bug 729709 has been marked as a duplicate of this bug. ***
Comment 40 elias 2014-10-18 14:43:02 UTC
It seems that KDE Telepathy now supports OTR.
http://blog.davidedmundson.co.uk/blog/ktp_0.9_beta
Empathy uses Telepathy as well so maybe that helps.
Comment 41 André Klapper 2014-10-19 13:30:34 UTC
*** Bug 738762 has been marked as a duplicate of this bug. ***
Comment 42 GNOME Infrastructure Team 2018-05-22 13:12:38 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to GNOME's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.gnome.org/GNOME/empathy/issues/22.