Forum Ubuntu-it

zorro23 ha scritto: ubuntu gutsy e ancora in alpha 5 sono normali dei bug piu o meno gravi

Purple does not now and is not likely to encrypt the passwords in the accounts.xml file, nor is it likely to be encrypted in a future release. This is somewhat controversial in Windows, especially Windows 98 due to its weak file protections, but that's the way things are.

The reasoning for this is multi-part.

Instant messaging is not very secure, and it's kind of pointless to spend a lot of time adding protections onto the fairly strong file protections of UNIX (our native platform) when the protocols themselves aren't all that secure. The way to truly know who you are talking to is to use an encryption plugin on both ends (such as OTR or gaim-encryption), and use verified GPG keys. Secondly, you shouldn't be using your instant messaging password for anything else. While some protocols have decent password security, others are insufficient and some (like IRC) don't have any at all.

There are basically four approaches to password storage.

    * Store a password(s) behind a password. Basically this means that we require you to type in some passphrase as Pidgin or Finch starts in order to read the accounts.xml file, and, to be truly secure, require you to type it again if you write to it. Windows ICQ does something very similar to this if you set it to its highest security settings.
    * Obscure a password. This means we do something to store the password in some format other than plain text, but we automatically convert it for you. This is security by obscurity, and is a Very Bad ThingTM in that it gives users a false sense of security that we (Pidgin, Finch, and libpurple developers) believe would be worse to have than to let informed users deal with the password issue themselves. Consider that a naive user might think that it is safe to share his or her accounts.xml, because the passwords are "encrypted".
    * Store the password in plain text and control access to the file. This is what libpurple (and therefore Pidgin and Finch) does: the password is in accounts.xml in plain text, but the file itself is only readable by its owner. We allow the user to determine under what conditions sensitive files should be opened (if at all), and what constitutes a breach of security.
    * Lastly, you can not store passwords at all. This is Purple's default, and by far the most secure of all of the options.

If you really wanted to, you could write a script to wrap Pidgin or Finch that would decrypt accounts.xml and re-encrypt it when the application exits. You wouldn't be able to encrypt it while they are running, because libpurple clients write to accounts.xml for things like info change. This would minimize your exposure time unless (like me) you run Pidgin nearly 24/7. Personally, I feel that on any decent operating system, if someone can get to your files you should either be able to trust the person to not touch them, or you shouldn't be storing sensitive information there at all.

Milestone: Merge MSNP14 Branch
4 days late (09/14/2007) 

Pappice ha scritto: @Guiodic: Non lo so, sai?
Il target di pidgin è il "messenger universale"... cosa anche piuttosto pretenziosa, secondo me.
CMQ per diventarlo dovrebbero riuscire a interfacciarsi al 100% con tutti i protocolli di IM...
Nella roadmap si legge (attualmente):

Milestone: Merge MSNP14 Branch
4 days late (09/14/2007) 

A prescindere che è stata già posticipata mille volte... se così dev'essere, devono sbattersi un bel po' x realizzarlo!!

Pappice ha scritto: Ok, però consentimi: tempo fa se io da MSN messenger digitavo il codice 317 nella finestra di conversazione, io vedevo una bella faccina che salutava, e il mio buddy da gaim leggeva 317... ora, posso capire che un client austero non sia particolarmente interessato alla possibilità di permettere agli utenti di inviare trilli, faccine, winks e tranci di pizza, ma la compatibilità sta anche nel ricevere tutta una serie di cose e di avere una conversazione "ergonomica", ehehe!
Io finora ho sempre usato gnome, non mi sono mai piaciute le interfacce plasticose, i desktop a 300 colori, suoni spaziali ed effetti speciali ultravivaci...
però quanno ce vo ce vo!

rockstar86 ha scritto: vabè non c'è bisogno di difendere a tutti i costi il software che si usa...nessuno giudica nessuno...nemmeno se usate un client msn da shell..