MiM

Posted Aug 1, 2006 0:58 UTC (Tue) by bluefoxicy (guest, #25366)
In reply to: MiM by bryanr
Parent article: ScatterChat for encrypted instant messaging

This is unfortunately true. The best route would actually be to use the user's PGP key; I've got one, I sign my e-mail with it by default. This would be useful because for confirmation the guy you're chatting with could send you an e-mail with an encrypted message; being able to read and reply to the message would signify that yes the correct key is in use.

A man-in-the-middle could easily replace things like "What's your e-mail address" and whatnot, as well as key exchanges, based on heuristics. j@boom.com could be detected, associated with a random e-mail and a direction, and get translated to the random address going out and from the random address coming in. This is easy to defeat but hey nobody is going to think about that.

But exchanging e-mails, replacing e-mail addresses in messages, paranoid key exchange... it's all irrelevant isn't it? Think about it; if you've got a GPG key already, it's probably tied to your e-mail. If you AND your friend already have GPG keys, they're probably BOTH tied to your e-mail. And further, you probably both already exchanged them, i.e. your mail client automatically downloaded it into your GPG keyring and it's already available.

The longer it goes on the easier it is to get caught; and a diverse set of key exchange and use mediums is going to expose a man in the middle unless he's got every pipe on the Internet in his control. Things like ssh or gaim-encryption suck like that, because they use their own little keys and no certificate authority or keyserver, making any attacks you want to carry out much simpler and more practical.