Ted, thanks for your explanations and point of view. I think the reason we think differently about whether or not this is a security issue is that you are argumenting from a protocol and implementation design point of view while I'm argumenting from a user experience point of view, assuming the user does not know the inner workings of the protocol but sticks to the graphical user interface and, ideally, to available documentation.
It is my impression that the current user interface design causes an unsuspecting user to assume that any message sent to a remote contact whose connection she has set to be encrypted with OTR will be transferred encrypted. Basically it is the same as for an SSL/TLS encrypted connection (to the server), where the user would likely make the same assumptions about message security. Based on my findings and the technical explanations you have kindly provided, not all messages sent to a contact whom an OTR setup exists for (keys have been exchanged and identities confirmed) is always actually encrypted. In my opinion this property of OTR sessions is not currently adequately presented to users, enticing them to falsely assume that any message they send to an OTR contact will be encrypted. It is my opinion that the lack transporting this special property of OTR is not currently adequately presented on the GUI. Nor is it currently documented (by what I could tell). To me, this still means it is a security bug, since it leads unsuspecting users to send possibly sensitive information as cleartext over the wire. I also agree that the improvement you suggest (adding a configuration option to try to set up OTR sessions before the first message is sent) would be a good way to handle this, if it either defaults to on or it defaults to off and a warning indicating that messages may be sent unencrypted is displayed on first use. Finally, I will also notify upstream. Thanks for the hint about notifying them. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/794453 Title: First message is sent unencrypted To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pidgin-otr/+bug/794453/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
