Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for an easy way to set up a simple IM infrastructure that protects messages in transit as well as avoids having logs in places that neither I nor someone I trust controls. I'm based in Germany and according to Mr. Snowden, my traffic actually gets sifted through and analyzed, and I'm not comfortable with that at all. IM is something that bugs me a lot in that regard.

I'm thinking about having an isolated XMPP server with accounts for everyone in the group of people who needs this, and to require SSL with self-signed certificates. I'm running an XMPP server on my raspberry pi anyway, so why not pimp it with some SSL security. It's configured to not write any logs except for errors and diagnostics, so the log issue is fixed there already. The people in question know how to use Pidgin, but anything overly annoying wouldn't fly with any of them. Mobile would be a requirement as well, Facebook's just too convenient. I think XMPP has that covered.

I'm not so fond of OTR, as the Pidgin plugin requires a decent bit of technical literacy, crashes Pidgin every once in a while and takes 10+ seconds to initiate a conversation (for me) during which Pidgin completely freezes. Also, as far as I know there's only IM+'s plugin for mobile platforms and is quite pricey. Relying on a self-hosted server and SSL certificates should work for all conceivable platforms (I guess?), be relatively easy to set up on the client side and provide a decent improvement in security.

The question is, would that be safe enough? At the very least I aim to keep my communication over this infrastructure out of the NSA databases. I'm not aiming to withstand any directed attack by trained experts or the like, I'd just like to have private conversations that actually are as private as a phone call once was, and not archived and analyzed somewhere else as a matter of routine.

If it is, another side question, any recommendations on how exactly to generate the certificates to make them secure? I read that some algorithms may have been compromised, I'd like to avoid those if possible. I've seen a few threads on here on that, but none (that I understoof) with that NSA-proofness spin.

share|improve this question

2 Answers 2

Self-signed certificates are just as good as certificates signed by another entity. The only thing that they're not is in the Public Key Infrastructure. Every modern computer comes with a list of known, trusted root certificates. Any certificate signed by one of these trusted roots is automatically trusted by your computer. Your self-signed certificates are not part of this trust chain, so it's up to you to trust these certificates. Clients will typically prompt you when encountering a certificate which cannot be traced back to a known root, so it's up to you to confirm that prompt.

The problem in this is that if you confirm this prompt every time by hand, it's very easy to be compromised by a man in the middle, since human verification of a certificate is very error prone. So you will have to establish trust in your self-signed certificate once initially and then let your client handle it. How to do this depends on the client and platform, but most/all platforms have some way of adding arbitrary certificates to the trusted certificate store.

share|improve this answer
    
Thanks! I believe that wouldn't be much of a problem. As you say, adding certificates to the key store isn't much of a problem on most platforms, either the system or the IM software should allow for this. Verifying this manually a single time would be ok, and even if this weren't done, the likelyhood of a man in the middle attack on me should be pretty slim. The objective of this is to avoid the big fishing nets, not targeted attacks by experts (let them experts know I just ordered cookie cutters, if they want to so much!). –  Stegosaurus Dec 16 '13 at 15:23

OK, phone calls were never private. The phone company has always had the ability to tap and record your calls. The system was designed in such a way as to aid law enforcement and government spying from early on. The idea that phone calls are personal and cannot be violated is a fallacy.

It sounds like you are trying to put together a system which is easy for technically illiterate people to use, in which case I'd suggest just using existing tools rather than rolling your own. I mean do you really think your personal communications are really of interest to the spy agencies that it is worth re-inventing the wheel, especially when it makes the system harder to use?

Delf-signed certificates are not a great option because they don't offer any assurance of the identity of the certificate holder unless you specifically configure your own pool user-key associations, which is a load of administrative overhead. If a user wants to log into the tool from multiple systems he/she must either associate each private key from each system with their identity, or export-transfer-import the same self-signed key to each machine. Most literate computers users wouldn't want to bother with that, asking a novice to do those things would just make your tool unusable. So it just makes things difficult without any security benefit.

share|improve this answer
    
I meant private in the sense that my calls most likely never were heard by anyone else, I've never been a target for spy agencies or police. It's different with internet traffic nowadays, I gather. My communication is of no interest to any of them, so they won't come looking, and that's what I'd like to have back. I'm not fond of knowing there's permanent record of my conversations somewhere in a data center, leaks do happen. Also, I'm trying to use existing tools, and to keep it as hassle-free as possible for maybe 5-10 people. No need to have perfect security, just some privacy. –  Stegosaurus Dec 16 '13 at 15:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.