Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We all know there's a myriad of Instant Messaging (IM) services out there. But, which of these services uses or permits protocols that actually secure your communications? For those that do, what part of the communications is secured?

Hopefully, all services will encrypt the authentication process by default. But are there any that allow for full encryption of the IM sessions as well?

share|improve this question

migrated from Jan 14 '11 at 13:33

This question came from our site for computer enthusiasts and power users.

up vote 22 down vote accepted

Some random thoughts...

Pidgin provides a lot of security features and support a lot of sec protocols and it provides strong encryption. It is Free and Open Source.

Features include

  • Automatically creates a public/private key pair for you upon loading the plugin.
  • Automatically transmits your public key to other users.
  • Supports 512 - 4096 bit keys.
  • Saves keys of known users, and warns you if their public key has changed.
  • Embeds all encryption and keys inside HTML, so if the other user doesn't have the plugin, they will get a little message telling them about the plugin, and won't get a screen full of garbage.
  • Stores keys in human readable files in your .gaim/.pidgin directory, in case you ever need to copy/edit them by hand. Which you really shouldn't have to do.
  • Automatically recognizes if you are chatting with someone who has the plugin- see the Preferences dialog.
  • Available for the Windows version of Pidgin.
  • Modular and extensible. If you want to define a different type of encryption, you can use this plugin as a wrapper to take care of transporting the encrypted binary over the IM pipe.

And also it provides Off-the-Record Messaging. Off-the-Record (OTR) Messaging allows you to have private conversations over instant messaging by providing:

Encryption No one else can read your instant messages. Authentication You are assured the correspondent is who you think it is. Deniability The messages you send do not have digital signatures that are checkable by a third party. Anyone can forge messages after a conversation to make them look like they came from you. However, during a conversation, your correspondent is assured the messages he sees are authentic and unmodified. Perfect forward secrecy If you lose control of your private keys, no previous conversation is compromised.

OTR can be used by Pidgin and Adium

Also Extensible Messaging and Presence Protocol (XMPP) (previously named as Jabber), is used by A LOT of clients, and provides strong security. You can see some of the security of XMPP here and here. You can also choice from a very long list of clients that support Jabber. Off-the-Record Messaging is also provided by many Jabber clients. And if you are paranoid enough you can run your own Jabber server ( see here, here and here)

If you user VoIP IM clients, you may also want to have a look at Zfone. It is created by Phil Zimmermann, the creator of the PGP encryption software. Zfone has been tested with the following VoIP clients: X-Lite, Gizmo5, XMeeting, Google Talk VoIP client, and SJphone.

AESPad is browser-based, so you dont have anything to install.

And finally Torchat has some unique features:

  • TorChat just runs from an USB drive on any Windows PC.
  • Nobody will be able to find out where you are.
  • If they are already observing you and sniff your internet connection they will not be able to find out
    • what you send or receive (everything is end-to-end encrypted)
    • to whom you are sending or receiving from
    • where your contacts are located
share|improve this answer
Since you mention ZPhone, you might as well mention Silent Circle since that includes the IM implementation of PGP based IM – LamonteCristo Feb 10 '13 at 3:18
Those XMPP links you posted don't sound like it provides strong security. It rather sounds like you get the most basic security(point to point TLS), and only if you're lucky and that they'd like to write something better. So XMPP seems only secure if you use OTR on top of it. – CodesInChaos Feb 10 '13 at 16:38

Here is what I know:

  • AIM/.Mac/ICQ (Oscar): supports optional SSL for client-server encryption.
  • Jabber/GoogleTalk (XMPP): supports optional SSL for client-server encryption. Supports PGP.

On these and other networks (MSN, Yahoo, GaduGadu), you should be able to use OTR messaging which provides simple, easy to use encryption. Both parties must have the OTR software installed.

share|improve this answer

Since most protocols are proprietary, it's hard to tell in some cases. Most IM services don't employ secure communication, actually encrypting communication can be a huge issue in many countries.

Most 3rd party IM clients support transparent encryption on top of the protocols.

The only IM protocol that employs encryption that I know of is Jabber (and all jabber based services).

share|improve this answer
I presume for the 3rd-party client support to work, that the person you're communicating with needs to also be using a compatible client? – Iszi Jan 13 '11 at 16:00
@Iszi yes, some use unique formats but there are some common PGP based – Let_Me_Be Jan 13 '11 at 16:02

I stumbled on this today. It looks like a pretty good alternative for those that are security minded.

share|improve this answer

If your client supports OTR messaging, it is irrelevant what the protocol supports. Besides, the SSL connection for Jabber only protects the communication to/from the server, but it doesn't stop Google from reading your IMs!

share|improve this answer
Are you referring to Google Talk in particular or ANY client? Google is in the "way" when you use Gtalk in Gmail, and their option "go Off the record" has nothing to do with OTR as we know it. They just dont keep records of what you and the other person are typing. Or at least they say so. – labmice Jan 19 '11 at 11:14
@labmice from here "Chats that have been taken off the record aren't stored in your Gmail chat history, or in the Gmail chat history of the person you're chatting with". They say that participants will not have access to history of "otr" chats in Gmail, but don't say that they are not storing it on their servers anyway :) – Hess Jul 5 '13 at 17:20

You can try, an open source, end to end encrypted messaging app. It also supports voice and video calls in addition to instant messaging.

Subrosa uses RSA for key exchange and AES for message encryption.

Disclosure: I'm the developer of Subrosa :)

share|improve this answer

You can try irssi and the OTR addon for it as well.

share|improve this answer

It ganerates every time unique URL.Nobody can just hop on your URL if you dont post it to somewhere. If you look how this chat is written then you see that your browser is not going to send decryption keys to the server. Even when someone manages to steal the private key of the SSL certificate, the messages are still encrypted by chatver with AES-256 encryption and are still not accessible. Havent seen anything written like that before. Please let me know if you have seen better solution for IM with no sign up and where you dont need to trust chat owner.

share|improve this answer
sry wrong place – Mihkel Feb 10 '13 at 16:29
You still need to trust the server with not sending you malicious javascript. In principle one can verify it, but few will do it in practice. – CodesInChaos Feb 10 '13 at 16:44

protected by Community Jul 9 '13 at 8:08

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.