Secure Instant Messaging

I may have mentioned this before, but if you are ever interested in communicating with me by instant message, please get Skype. Not only is the voice calling encrypted, but so is everything else. I'm on yet another wireless network today, and not especially thrilled with the idea of sending my IMs in the clear.

Comments

[Alex Krupp]

What's so special about Skype though? There is an encryption plugin for gaim, and the next version of adiumx will make this available also. Also, Jabber features automatic encryption and it is an open format.

[Dan Gillmor]

GAIM? I use a Mac, for one thing.

[Alex Krupp]

Dan: AdiumX.com, it's AIM, Jabber, MSN, ICQ, Napster, etc using the gaim library with a front end that goes nicely with the mac environment. In version .8 (currently in beta), it will support the encryption plug-in.

The advantage of Skype is that of course you can have voice and encrypted text in the same account. However, the open source community has pretty much thrown it's weight behind Jabber, so the advantage of using Adium on mac is that you can chat with encryption to people in the know using Jabber, and still be on AIM and ICQ talking to everyone else. That still doesn't solve the voice problem, but I have a feeling that there are going to be some major changes in the IM world after Apple comes out with it's h.264 video protocol and makes video conferencing practical for home use.

[Robby Russell]

Gaim for OSX + Encryption

[jerry]

Hmm, I don't even get IMs, much less ones so kewl they need to be encrypted!

[Simon Phipps]

Keeping in mind who makes Skype and their track record for privacy, a closed-source IM encryption system from them seems very unappealing. Like Alex I'm using AdiumX beta 0.8 which offer OTR encryption over all IM services and works on OS X. OTR also works on GAIM and for anyone else there is an OTR proxy that non-plugin-able clients can route through.

[Alex Krupp]

Jerry, maybe the reason you don't get more IMs is because you don't give people the option to send you encrypted ones.

This reminds me, I found out the other day that a friend of mine shares their email account with another person. To me this seems very disrespectful, to share your email account with someone without letting the people emailing you know. I definitely will not be emailing that person anymore.

[Neil T.]

As has been said before, Jabber is encrypted from end to end, and AdiumX works well on OS X - my former boss used it on his PowerBook all the time.

[Dan Gillmor]

The voice quality of Skype is also incredible. (They're using technology from a company called Global IP Sound, which really has nailed it in this regard.)

But I'll give Addium a try as suggested.

[Tris Hussey]

Yeah, I think the combination of Skype being a VoIP solution that is also encrypted--including flie transfers--is great. The problem I've had wtih Gaim, and Jabber, and others is that it isn't easy for non-techies. Skype is easy. People can "get" it. Eventhough it isn't the best IM client out there--they still need a typing indicator--it is my preferred one. It lets you switch from secure voice to secure IM and push a file...very smooth.

I have SkypeVM and tried SkypeOut as well. I've been very satisfied with them both. Both as a solo consultant and as part of another software company Skype has become essential for communications..if nothing else it's helping us cut costs on phone calls!

[D Henkel-Wallace]

OS X Tiger's iChat will support Jabber.
You can then run Jabber over a VPN or ssh.

But do you know the person you're talking to will be doing the same?

[Flack]

Skype saves my office & clients a lot of $$ in long distance calls. Also, the IM feature is preferable to AOL (which most of my colleagues feel is for HS kids.)

Only downside is the strange foreigners who contact me via Skype wanting to be friends or business partners.

Does anyone else have this problem??

[Brendon J. Wilson]

Hmm, from Skype's own site:

Is the source code for Skype available? Can I have a copy? No. Skype is proprietary and closed-source software.

So, how do you know that the encryption is doing what you think it's doing? Without peer source code review, the answer is simple: you don't.

If you're serious about AIM encryption, I'd suggest you check out the new PGP Desktop 9.0 beta instead - source code will be available on the PGP web site, as always, once the product is released.

Of course, I could be biased - after all, I work for PGP ;-)

[Larry Rosenstein]

I read Dan's comment as related to security. Another approach entirely is to get some sort of VPN service. This will let you create a secure tunnel back to your ISP, which protects all your Internet communication while using a wireless connection.

I have my home DSL connection through sonic.net in Santa Rosa (a much better alternative to SBC), and this is included for free. On my PowerBook, I use Cisco's VPN client to connect. IIRC, Earthlink recently started offering this (extra charge) to its broadband customers.