[jitsi-dev] Issue Report: secure chat information leak


#1

Secure chats should not load YouTube (and so on) preview images by
default, since it leaks exactly which links were pasted. This should
be an opt-in setting.

An eavesdropper can notice that just a preview image was loaded
immediately after the client received an encrypted message and
determine that there is a high probability of a link to that video in
the encrypted chat. This can give the eavesdropper quite a bit of
information about what is being discussed in the chat, particularly if
several related videos are posted. This is not good if the
eavesdropper is an ISP owned by a repressive government.

Can you please also address the DNS information leak
(https://trac.jitsi.org/ticket/1060)? If someone is using Jitsi over
Tor or any other proxy, DNS lookups should be done over the proxy to
avoid eavesdropping and maintain privacy.


#2

Good point! An alternative would be to just make the preview loads
over https. We'd need to think about it.

Could you please open a ticket?

Thanks,
Emil

···

On Sat, Jul 13, 2013 at 12:57 AM, C Erler <erlercw@gmail.com> wrote:

Secure chats should not load YouTube (and so on) preview images by
default, since it leaks exactly which links were pasted. This should
be an opt-in setting.

An eavesdropper can notice that just a preview image was loaded
immediately after the client received an encrypted message and
determine that there is a high probability of a link to that video in
the encrypted chat. This can give the eavesdropper quite a bit of
information about what is being discussed in the chat, particularly if
several related videos are posted. This is not good if the
eavesdropper is an ISP owned by a repressive government.

Can you please also address the DNS information leak
(https://trac.jitsi.org/ticket/1060)? If someone is using Jitsi over
Tor or any other proxy, DNS lookups should be done over the proxy to
avoid eavesdropping and maintain privacy.

_______________________________________________
dev mailing list
dev@jitsi.org
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev


#3

Hi guys,

Just want to add a thought on the issue, JItsi does this for images as well, so should that not be added as a problem to the same ticket?
To me it seems like the same security leak -- the content being visited automatically.

Thanks,
Nick

···

From: emcho@jitsi.org
Date: Sat, 13 Jul 2013 17:56:12 +0200
To: dev@jitsi.org
Subject: Re: [jitsi-dev] Issue Report: secure chat information leak

Good point! An alternative would be to just make the preview loads
over https. We'd need to think about it.

Could you please open a ticket?

Thanks,
Emil

On Sat, Jul 13, 2013 at 12:57 AM, C Erler <erlercw@gmail.com> wrote:
> Secure chats should not load YouTube (and so on) preview images by
> default, since it leaks exactly which links were pasted. This should
> be an opt-in setting.
>
> An eavesdropper can notice that just a preview image was loaded
> immediately after the client received an encrypted message and
> determine that there is a high probability of a link to that video in
> the encrypted chat. This can give the eavesdropper quite a bit of
> information about what is being discussed in the chat, particularly if
> several related videos are posted. This is not good if the
> eavesdropper is an ISP owned by a repressive government.
>
> Can you please also address the DNS information leak
> (https://trac.jitsi.org/ticket/1060)? If someone is using Jitsi over
> Tor or any other proxy, DNS lookups should be done over the proxy to
> avoid eavesdropping and maintain privacy.
>
> _______________________________________________
> dev mailing list
> dev@jitsi.org
> Unsubscribe instructions and other list options:
> http://lists.jitsi.org/mailman/listinfo/dev

_______________________________________________
dev mailing list
dev@jitsi.org
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev


#4

Hey guys,

Has anyone opened a ticket for this?

Emil

···

On 15.07.13, 15:37, Nick H wrote:

Hi guys,

Just want to add a thought on the issue, JItsi does this for images as
well, so should that not be added as a problem to the same ticket?
To me it seems like the same security leak -- the content being visited
automatically.

Thanks,
Nick

> From: emcho@jitsi.org
> Date: Sat, 13 Jul 2013 17:56:12 +0200
> To: dev@jitsi.org
> Subject: Re: [jitsi-dev] Issue Report: secure chat information leak
>
> Good point! An alternative would be to just make the preview loads
> over https. We'd need to think about it.
>
> Could you please open a ticket?
>
> Thanks,
> Emil
>
> On Sat, Jul 13, 2013 at 12:57 AM, C Erler <erlercw@gmail.com> wrote:
> > Secure chats should not load YouTube (and so on) preview images by
> > default, since it leaks exactly which links were pasted. This should
> > be an opt-in setting.
> >
> > An eavesdropper can notice that just a preview image was loaded
> > immediately after the client received an encrypted message and
> > determine that there is a high probability of a link to that video in
> > the encrypted chat. This can give the eavesdropper quite a bit of
> > information about what is being discussed in the chat, particularly if
> > several related videos are posted. This is not good if the
> > eavesdropper is an ISP owned by a repressive government.
> >
> > Can you please also address the DNS information leak
> > (https://trac.jitsi.org/ticket/1060)? If someone is using Jitsi over
> > Tor or any other proxy, DNS lookups should be done over the proxy to
> > avoid eavesdropping and maintain privacy.
> >
> > _______________________________________________
> > dev mailing list
> > dev@jitsi.org
> > Unsubscribe instructions and other list options:
> > http://lists.jitsi.org/mailman/listinfo/dev
>
> _______________________________________________
> dev mailing list
> dev@jitsi.org
> Unsubscribe instructions and other list options:
> http://lists.jitsi.org/mailman/listinfo/dev

_______________________________________________
dev mailing list
dev@jitsi.org
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev

--
https://jitsi.org