Skip to content

GitLab

B
blueprints
Last edited by intrigeri
Page history

replace_Pidgin

Corresponding ticket: tails#8573

We want to replace Pidgin with a more secure IM client.

This document lists our requirements and candidate clients, along with their pros and cons.

Requirements

Note: the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

General requirements

Use cases

The client SHOULD support the following use cases:

  1. Use Tails' XMPP public and internal chatrooms
  2. One-to-one chat that is compatible with currently widespread practice. That basically means XMPP + OMEMO, nowadays.

The client MAY support the following use cases:

  • One-to-one chat that protects metadata end-to-end (that is: "who is chatting with whom")

Documentation

Internationalization

The client must be internationalized, ideally already translated in many languages - if not, adding new languages should be easy.

GUI

The client must have a easy to use GUI that makes it hard for users to use the client in an insecure way.

TLS

The client must support connections using TLS.

Support for Tor

The client must support Tor and must not leak any private data (hostname, username, local IP, ...) at the application level.

Support for OMEMO

The client must support OMEMO and should make it easy to enforce usage of OMEMO for all conversations or only for specific contacts.

Ideally, some usability study for the OMEMO user interface has been done.

Resources:

Support for OTR

The client MAY support OTR and make it easy to enforce usage of OTR for specific contacts.

Other

TODO: Pidgin already has an apparmor profile; should we require that a replacement also comes with an apparmor profile?

The client MUST NOT save logs of conversations.

Candidates

Suggested by sajolida on https://mailman.boum.org/pipermail/tails-dev/2016-January/010123.html:

XMPP (Jabber)

( Here is a list of XMPP extensions supported by Pidgin )

MUC

The client must support XMPP conference rooms (XEP-0045).

Candidate alternatives

Dino

Security

  • 28k lines of Vala + 1k lines of C = 29k lines of code

  • Track record:

    • In 2019, Multiple protocol implementation errors were discovered in Dino:

      • CVE-2019-16237: an attacker can send messages in the name of someone else (previously found in other XMPP clients: CVE-2017-5589+)
      • CVE-2019-16236: remote attackers can modify the roster (previously found in Gajim: CVE-2015-8688)
      • CVE-2019-16235: does not properly check the source of a carbons message

      As that document says, "When confronted with the fact that the same trivial vulnerabilities have been discovered in multiple, independent clients one can not avoid the question if there is a more fundamental issue underneath that causes different developers to all make the same mistakes." Indeed, at the time, the corresponding XEPs lacked sufficient information to implement them securely.

  • intrigeri's conclusion (2020-12-07):

    • Looks OK to me, but Dino is pretty recent and not widespread, so this could be a case that nobody bothered looking closely enough.

    • Dino's small feature set suggests it should be easy to confine it with AppArmor.

Gajim

  • XMPP client
  • in Debian
  • OMEMO plugin is in Debian Buster
  • OTR v3 plugin is not in Debian
  • People from Security-in-a-Box have used it successfully in Tails.
  • Large established user base (https://qa.debian.org/popcon.php?package=gajim) for a XMPP client. Stagnating since about 10 years.
  • Account setup wizard is confusing: when one wants to enable Tor, one also has to fill in other advanced settings.
  • By default, tries to save passwords to the GNOME password store, which we decided is hard to persist. This can be disabled.
  • Allows accepting an arbitrary TLS certificate, which allows connecting to Onion XMPP servers.

Security

  • 86k lines of Python + 2k for the OMEMO plugin = 88k lines of code

  • D-Bus capabilities: can be disabled?

  • Track record:

  • Gajim ships with a plugin called "plugin installer" which allows a user to download new plugins. This sounds suspicious for security, because plugins are pieces of code running with full privilege. The implementation in Debian use unverified TLS connection, which is very very open to MITM. The development version has switched to verified HTTPS connection and is trying to make it more robust.

    However, I think that Tails should not ship this plugin installer at all: it allows a user to download code without needing sudo. We could work debian-side to separate gajim-plugininstaller in a separate package so that Tails can choose not to install it?

  • intrigeri's conclusion (2020-12-07):

    • Having tons of powerful features increases attack surface and the risk of secure programming mistakes. Gajim's security track record in 2012 is not confidence inspiring, to say the least. OTOH the worst problems happened many years ago, so perhaps the Gajim project has updated their processes to lower the risks of introducing other really bad security issues?

    • The plugin installer is not confidence inspiring either.

    • Gajim's large feature set suggests it may be hard to write an AppArmor profile that provides meaningful security, while not breaking too much functionality.

Does not meet our requirements

CoyIM

  • Homepage
  • Github
  • CoyIM only supports XMPP.
  • CoyIM is in Debian
  • Support for multi-user chatrooms (MUC) is in progress and lacks some important features such as having a persistent list of rooms persistently saved in the configuration
  • Supports Tor, TLS, OTR
  • Supports creation of random accounts.
  • Supports importing accounts from Pidgin.
  • No logging, no clickable links.
  • Not audited.
  • Test results in Tails: tails#8574
  • No OMEMO support.

Thunderbird

Tor Messenger (tails#8577)

Tor Messenger is no more: https://blog.torproject.org/sunsetting-tor-messenger

  • Documentation, downloads and tickets in Tor's Trac
  • Satisfies all our requirements (listed above, as of commit 8e3157d5f4cd7894bca21adf6b95a6b49d9beb01) except the TODO about StartTLS (I bet it has the code for it though, since Thunderbird supports it, but I in the GUI there is only "Enable SSL" as options for XMPP).
  • The GUI is very similar to Pidgin's, which might be a bonus point since we are looking for a "Pidgin replacement".
  • It has support for "temporary XMPP accounts" that require no registration (no user input!) which would be useful for our support channel (see tails#11307).
  • Tor Messenger provides Linux packages but is not in Debian :(
  • FWIW: Tor Messenger got 30K USD funding in 2017!
  • FWIW: anonym has been happy using it exclusively for chatting since September, 2016.
  • Instantbird (on which Tor Messenger is based) is dead upstream and is meant to be replaced by future improvements in Thunderbird's chat features (although Thunderbird's future is unclear as well). To follow along, subscribe to the meta tracking bug and the ones it depends on. The Tor Messenger developers intend to follow suit and create a Tor Communicator bundle based on Thunderbird, that would handle both email and chat.