This plugin implements Off The Record messaging.
This is a plugin used to encrypt one-to-one conversation using the OTR encryption method. You can use it if you want good privacy, deniability, authentication, and strong secrecy. Without this encryption, your messages are encrypted at least from your client (poezio) to your server. The message is decrypted by your server and you cannot control the encryption method of your messages from your server to your contact’s server (unless you are your own server’s administrator), nor from your contact’s server to your contact’s client.
This plugin does end-to-end encryption. This means that only your contact can decrypt your messages, and it is fully encrypted during all its travel through the internet.
Note that if you are having an encrypted conversation with a contact, you can not send XHTML-IM messages to him (or correct messages, or anything more than raw text). They will be removed and be replaced by plain text messages.
This is a limitation of the OTR protocol, and it will never be fixed. Some clients like Pidgin-OTR try do do magic stuff with html unescaping inside the OTR body, and it is not pretty.
To use the OTR plugin, you must first install pure-python-otr.
You have to install it from the git because a few issues were found with the python3 compatibility while writing this plugin, and the fixes did not make it into a stable release yet.
Install the python module:
git clone https://github.com/afflux/pure-python-otr.git
cd pure-python-otr
python3 setup.py install --user
You can also use pip with the requirements.txt at the root of the poezio directory.
Command added to Conversation Tabs and Private Tabs:
Usage: /otr [start|refresh|end|fpr|ourfpr|trust|untrust]
This command is used to manage an OTR private session.
Warning
With drop, the private key is only removed from the filesystem, NOT with multiple rewrites in a secure manner, you should do that yourself if you want to be sure.
To use OTR, make sure the plugin is loaded (if not, then do /load otr).
A simple workflow looks like this:
/otr start
The status of the OTR encryption should appear in the bar between the chat and the input as OTR: encrypted.
Then you use fpr/ourfpr to check the fingerprints, and confirm your respective identities out-of-band.
You can then use
/otr trust
To set the key as trusted, which will be shown when you start or refresh a conversation (the trust status will be in a bold font and if the key is untrusted, the remote fingerprint will be shown).
Once you’re done, end the OTR session with
/otr end
This plugin creates trust files complatible with libotr and the files produced by gajim.
The files are located in $XDG_DATA_HOME/poezio/otr/ by default (so ~/.local/share/poezio/otr in most cases).
Two files are created:
Default: false
Allow OTRv1
Default: true
Allow OTRv2
Default: $XDG_DATA_HOME/poezio/otr
The directory in which you want keys and fpr to be stored.
Default: false
Log conversations (OTR start/end marker, and messages).
The allow_v1, allow_v2 and log configuration parameters are tab-specific.
The OTR session is considered for a full jid, but the trust is considered with a bare JID. This is important to know in the case of Private Chats, since you cannot always get the real the JID of your contact (or check if the same nick is used by different people).