Which Instant Messaging services use or allow secure protocols, and what do those protocols cover?

Question

We all know there's a myriad of Instant Messaging (IM) services out there. But, which of these services uses or permits protocols that actually secure your communications? For those that do, what part of the communications is secured?

Hopefully, all services will encrypt the authentication process by default. But are there any that allow for full encryption of the IM sessions as well?

Answer 1

Some random thoughts...

Pidgin provides a lot of security features and support a lot of sec protocols and it provides strong encryption. It is Free and Open Source.

Features include

• Automatically creates a public/private key pair for you upon loading the plugin.
• Automatically transmits your public key to other users.
• Supports 512 - 4096 bit keys.
• Saves keys of known users, and warns you if their public key has changed.
• Embeds all encryption and keys inside HTML, so if the other user doesn't have the plugin, they will get a little message telling them about the plugin, and won't get a screen full of garbage.
• Stores keys in human readable files in your .gaim/.pidgin directory, in case you ever need to copy/edit them by hand. Which you really shouldn't have to do.
• Automatically recognizes if you are chatting with someone who has the plugin- see the Preferences dialog.
• Available for the Windows version of Pidgin.
• Modular and extensible. If you want to define a different type of encryption, you can use this plugin as a wrapper to take care of transporting the encrypted binary over the IM pipe.

And also it provides Off-the-Record Messaging. Off-the-Record (OTR) Messaging allows you to have private conversations over instant messaging by providing:

Encryption No one else can read your instant messages. Authentication You are assured the correspondent is who you think it is. Deniability The messages you send do not have digital signatures that are checkable by a third party. Anyone can forge messages after a conversation to make them look like they came from you. However, during a conversation, your correspondent is assured the messages he sees are authentic and unmodified. Perfect forward secrecy If you lose control of your private keys, no previous conversation is compromised.

OTR can be used by Pidgin and Adium

Also Extensible Messaging and Presence Protocol (XMPP) (previously named as Jabber), is used by A LOT of clients, and provides strong security. You can see some of the security of XMPP here and here. You can also choice from a very long list of clients that support Jabber. Off-the-Record Messaging is also provided by many Jabber clients. And if you are paranoid enough you can run your own Jabber server ( see here, here and here)

If you user VoIP IM clients, you may also want to have a look at Zfone. It is created by Phil Zimmermann, the creator of the PGP encryption software. Zfone has been tested with the following VoIP clients: X-Lite, Gizmo5, XMeeting, Google Talk VoIP client, and SJphone.

AESPad is browser-based, so you dont have anything to install.

And finally Torchat has some unique features:

• TorChat just runs from an USB drive on any Windows PC.
• Nobody will be able to find out where you are.
• If they are already observing you and sniff your internet connection they will not be able to find out
  • what you send or receive (everything is end-to-end encrypted)
  • to whom you are sending or receiving from
  • where your contacts are located

Answer 2

Here is what I know:

• AIM/.Mac/ICQ (Oscar): supports optional SSL for client-server encryption.
• Jabber/GoogleTalk (XMPP): supports optional SSL for client-server encryption. Supports PGP.

On these and other networks (MSN, Yahoo, GaduGadu), you should be able to use OTR messaging which provides simple, easy to use encryption. Both parties must have the OTR software installed.

Answer 3

Since most protocols are proprietary, it's hard to tell in some cases. Most IM services don't employ secure communication, actually encrypting communication can be a huge issue in many countries.

Most 3rd party IM clients support transparent encryption on top of the protocols.

The only IM protocol that employs encryption that I know of is Jabber (and all jabber based services).

Answer 4

I stumbled on this today. https://project.crypto.cat/ It looks like a pretty good alternative for those that are security minded.

Answer 5

If your client supports OTR messaging, it is irrelevant what the protocol supports. Besides, the SSL connection for Jabber only protects the communication to/from the server, but it doesn't stop Google from reading your IMs!

Answer 6

You can try irssi and the OTR addon for it as well.

Answer 7

It ganerates every time unique URL.Nobody can just hop on your URL if you dont post it to somewhere. If you look how this chat is written then you see that your browser is not going to send decryption keys to the server. Even when someone manages to steal the private key of the https://chatver.com SSL certificate, the messages are still encrypted by chatver with AES-256 encryption and are still not accessible. Havent seen anything written like that before. Please let me know if you have seen better solution for IM with no sign up and where you dont need to trust chat owner.