Slashdot Log In
Good Open Source, Multi-Platform, Secure IM Client?
Posted by
Soulskill
on Fri Oct 31, 2008 03:09 PM
from the real-time-tps-report-updates dept.
from the real-time-tps-report-updates dept.
Phil O. writes "I work for a company with 30+ locations across North America. Some offices have hundreds of employees; some only a dozen. We're looking for a secure, multi-platform IM client we could implement across the organization. One group is pushing for Microsoft's solution, but it has a number of drawbacks (including cost). What other options are out there, and what has worked well in similar situations? Security is a big concern for the company."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Anonymous Coward (Score:5, Informative)
Jabber server, pidgin clients, and http://pidgin-encrypt.sourceforge.net/ for security. Really it's a shame this even made it to slashdot. Can't anyone google anymore?
Re:Anonymous Coward (Score:5, Informative)
OTR is more secure that pidgin-encryption, and works with other IM clients as well.
Parent
Portable (Score:4, Informative)
Plus, pidgin is portable.
http://portableapps.com/apps/internet/pidgin_portable [portableapps.com]
Parent
Re: (Score:3, Informative)
You might want to check their homepage [cypherpunks.ca] and the Wikipedia [wikipedia.org] article.
OTR works very well for me. I recommend Pidgin as a client and Jabber as a protocol.
Re:Anonymous Coward (Score:5, Funny)
Parent
Re:Anonymous Coward (Score:5, Funny)
Anyone know a news site for nerds, something with stuff that matters?
Parent
Re:Anonymous Coward (Score:5, Funny)
Maybe try digg [digg.com]?
Parent
Pidgin + OTR (Score:4, Informative)
http://www.pidgin.im/ [pidgin.im]
http://en.wikipedia.org/wiki/Pidgin [wikipedia.org]
http://www.cypherpunks.ca/otr/ [cypherpunks.ca]
Re: (Score:3, Informative)
It hangs quite often (more if you don't use the tab mode, and if you use tab mode, if some spammer spams you, you can't tell from the taskbar who sent you the message - it could look like someone else is sending you a message).
It often doesn't succeed in sending messages to people on MSN - 5 minutes after I send, it'll tell me it failed. 5 minutes!
You can't easily filter out "spim", even if you use stuff like bot sentry you still get bugged about it- which completel
Re:Pidgin + OTR (Score:4, Informative)
Parent
Re:Pidgin + OTR (Score:5, Insightful)
Most likely the MSN bug in pidgin is due to having to reverse engineer the protocol every time it gets changed...
Parent
Re:Pidgin + OTR (Score:5, Interesting)
I'm still waiting for it to show up for the Android chat client, but it is still early days...
--- SER
Parent
jabber (Score:5, Informative)
Re:jabber (Score:5, Insightful)
I agree - not too hard to set up your own jabber server with an SSL connection. If you REALLY want to be secure, you won't rely on someone elses server.
Parent
Re:jabber (Score:5, Informative)
Here's a jabber server with ssl ready to go.
http://wikis.sun.com/display/CommSuite/Sun+Java+Communications+Suite+Information [sun.com]
Parent
Re:jabber (Score:5, Insightful)
If the clients use end-to-end encryption and share the password through a secure different channel (e.g. encrypted email) does it really matter if the server is your own?
Parent
Multi-platform (Score:4, Insightful)
Re:Multi-platform (Score:5, Funny)
What do you mean? It runs on both kinds of computer, XP and Vista.
Parent
Openfire + Spark (Score:5, Informative)
So far no problems beyond user error. I'd recommend it.
Re: (Score:3, Insightful)
I'll second that, we use Openfire within our IT department (spanning 3 locations plus accessible via VPN). Spark is the primary client we give to our people but they're also free to use any other Jabber client they want like Pidgin, Miranda, Exodus, etc. We have SSL enabled and message auditing & archiving turned on which is also important for businesses in certain markets. We have it authenticating off our Active Directory via LDAP lookup. There's also a Flash-based web client which simply is a SWF tha
Re: (Score:3, Informative)
I use openfire for my personal jabber server, it's been reliable, and keeps getting good updates.
I haven't used the spark client, and I haven't had good luck with the web client. That's probably the biggest thing I wish I could find was a good web client like gmail chat.
Jabber? (Score:3, Insightful)
I've never actually implemented Jabber before, but it seems like the obvious answer. You should be able to set up your own server without paying any software costs, and use GAIM/Adium. I think encryption is supported, but it's slightly less of a concern if the traffic never leaves your own network.
Actually, depending on your requirements, you may not want clients to encrypt traffic, so that you can log and archive it.
Any XMPP Client (Score:5, Informative)
I would go about your problem by first separating the client from the actual protocol. If you are worried about cross platform I would of course go with an XMPP solution. You can do the following:
- Run an OpenFire server Here [igniterealtime.org]
- Pick from a slew of XMPP clients but I would problem pick the Spark IM Client (Same people as the OpenFire software)
This way you don't have to worry about Client A working with Protocol B across Windows/Linux/Mac.
Using XMPP is also an easy way to control your IM facilities as you can create an organizational system for creating names such as using email addresses as screen names and not have to worry about Bob from Accounting using PiMpMaSta23.
I would evaluate OpenFire and the Spark IM client and see if it fits. The server is very easy to set up and administer. You can also use Pidgin or Psi as XMPP clients although I think Spark is the most professional looking of the three.
You'll need a server, too (Score:5, Informative)
Everybody is saying "Pidgin", but a client won't do you any good without a server to connect to, and if you really care about being secure, you shouldn't trust any third-party server that is publicly accessible.
You should probably set up your own Jabber server; I recommend Openfire [igniterealtime.org], which is open source, easy to install, and pretty powerful. It is possible to mandate that all clients must use encryption to connect, which will do a pretty good job of keeping things secure, and you can use any XMPP client that supports encryption. If you don't want even the server to be able to read your messages, as others have suggested, installing an OTR plugin for your client is the way to go.
Pidgin performs beautifully cross-platform (Score:4, Informative)
Why IM? (Score:5, Interesting)
Why not IRC?
Re: (Score:3, Informative)
I have yet to see a reliable working UnrealIRCd server hack.
As long as they didn't use mIRC and kept their IRC network completely internal (kinda tough to do without some VPN connecting to the other 30+ locations plus password entry into channel (or an allow list) they shouldn't have too much of an issue.
And of course IRC does have SSL connection capability.
Check out SupraBrowser (Score:5, Interesting)
SupraBrowser [sourceforge.net]
It's a secure, threaded IM client (all socket communication 3DES encrypted with a zero-knowledge proof SRPP [stanford.edu]), written in Java, that runs on Linux, Mac, and Windows. It was developed for the hedge fund industry in Boston. I developed it initially, but it's mainly being maintained, not developed further because we don't receive any new feature requests.
Don't let the extensive features fool you. It's primarily a secure, threaded IM system. The other features were added (email gateway, auto-forwarding to email, embedded web browser with sophisticated tagging engine) based on its being used *very* heavily every day and requests coming from highly advanced users of the system.
There is also a Firefox plugin that integrates with it, as well as a pure ajax client written in the Eclipse Rich Ajax Platform.
Feel free to contact me personally for any details or help setting it up. The release on sourceforge assumes fairly good technical abilities (building it from ant, getting xulrunner to work with javaxpcom) and is not a general packaged release. However, it is running many places in production.
suprasphere@gmail.com
David Thomson
XMPP with TLS and (optionally) GPG/PGP (Score:5, Informative)
You can setup the thing completely in-house (you don't have to trust a contractor), or you can opt for a canned solution (for example Jabber, Inc., http://www.jabber.com/ [jabber.com], they do provide everything for big and small companies, and are backed by Cisco). It uses SSL/TLS for secure connections both between clients and servers (C2S) and between separate servers (S2S), with full support for certificate authenticity checking, and even PGP/GPG encryption between the users, should they need to exchange really confifental data that even a rogue company server admin shouldn't be able to intercept (message encryption, pretty rare among proprietary protocols, but happens), or be sure that joe.the.boss@company.com is really Joe, their Boss, and not someone who just happend to "borrow" their laptop at the airport (signed presence, something, AFAIK, no other protocol provides). There are XMPP servers and clients for almost every platform possible, open-source or commercial, the protocol is open and approved by IETF for IM-style communication.
I won't give you any specific names, but I believe it wouldn't be very difficult to find a few *very* big companies using XMPP to prove to your boss that it's being used like this by big players in the industry.
And, frankly, that's the only open solution to your problem.
Zimbra (Score:4, Interesting)
It can replace your Exchange server for email, has an XMLPP IM server built-in, and is much more cost effective and easier to administer than Exchange.
OpenFire Jabber server (Score:3, Informative)
I would recommend the open source OpenFire [igniterealtime.org] server. Install it on your own server, then set the preferences to force SSL connections. Then communicates passed between clients on any platform are SSL encrypted. Turn off local client logging for better security. Beyond that, it's all client-side stuff that doesn't port as well.
Nicodemus
Spark/Openfire? (Score:3, Informative)
I have been a fan of the Spark Client and Openfire Server [igniterealtime.org] as an IM platform for quite sometime. They are built on the XMPP and Jabber protocols. After being in a corporate environment before, I know it's hard to convince management to go with an OSS solution as they seem to think that if it doesn't have a price tag, it's not secure. The Spark/Openfire platform come in an 'Enterprise' flavor with support to appease management as well. Both the client and server are built on a plug-in style architecture, so it's pretty easy to include your own software add-ins. There are really too many features for me to really go into though.
CenterIM is the way (Score:5, Funny)
I use CenterIM, formerly called CenterICQ.
It's ncurses based, so it runs in any real computation environment. It supports Yahoo, ICQ, AIM, MSN, Jabber, IRC, Google Talk, Live Journal, RSS feeds and more!
It's a wonderful client, tiny footprint, and it runs where programs belong, on the command line!
Re:skype (Score:5, Informative)
Parent
Re:skype (Score:5, Funny)
Read? Who reads anything on here? I only post.
Parent
Re: (Score:3, Insightful)
"More Skype security Speculation."
Do you have any evidence that the Skype protocol is secure?
Note, Obscure != Secure.
Re:skype (Score:5, Funny)
Holy crap! You're a genius!
Tomorrow I'm going to go to the office and disguise the server rack as a refrigerator. Then my data will truly be safe, because even if a hacker does get in, he'll never believe there's any valuable data in a cheese sandwich.
Parent
Re:skype (Score:5, Funny)
next time try to read more than just the title
But my "Slashdot User's Handbook" says I'm not supposed to!
Anyway, I was wondering if there was any papers or anything to follow up that post. Something that would move it from speculation to truth. There's some papers in the comments linking to notes about obfuscating against reverse engineering. The last sentence just said the Austrians claim they can easily listen into the conversations.
Parent
Re:skype (Score:5, Funny)
But my "Slashdot User's Handbook" says I'm not supposed to!
Ha! Nobody's read the handbook!
Parent
Re:Sametime (Score:5, Informative)
Parent
Re:Sametime (Score:4, Informative)
Parent
Re: (Score:3, Informative)
It shouldn't. (Score:3, Informative)
No software should have that problem. If it can't handle it, it should reject/drop the message, not crash (preferably with a substitute message saying message was dropped because sender.
Not confirming the Sametime behavior described, just speaking from experience of many many instances of developers feeding me BS about how they shouldn't have to tolerate some condition or another as it is artificial and stupid, not acknowledging a DoS as a serious problem.
Re:Sametime (Score:5, Informative)
Openfire is amazing and with thier Sparks client it gets even better.
Includes SSL, open API, different database backend, including LDAP. I've been running it for my office on a linux box connecting to a windows AD authentication. Best part about it is you can manage everyones contact lists. So no more invite this person add this person.
Openfire (formerly Wildfire) is a real time collaboration (RTC) server dual-licensed under the Open Source GPL and commercially. It uses the only widely adopted open protocol for instant messaging, XMPP (also called Jabber). Openfire is incredibly easy to setup and administer, but offers rock-solid security and performance
BTW i'm not affiliated with them, i just have used thier projects for years. Go opensource!
Parent
Re:Sametime (Score:5, Informative)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Sametime is slightly open source (Score:3, Informative)
Re:There is only one true IM client (Score:5, Funny)
talk requires a terminal that can handle curses (vt100 or similar). This creates a barrier that's simply too cumbersome. I would suggest using write instead.
If encryption is needed, I would suggest rot13. For double encryption, rot26 can be used. Or, you could do what they did in WWII and "encrypt" by using an obscure language that few outsiders are likely to be able to decode. Since getting your coworkers to learn Navajo is probably out of reach, I suggest Pig Latin.
Really, I think the submitter is making this harder than it needs to be.
Parent
Re: (Score:3, Insightful)
Kerberos [mit.edu] will authenticate without storing or sending passwords. It works for email, remote login (ssh, telnet, rlogin), file service (AFS, ftp) and web as well. Pidgin supports Kerberos, though you wouldn't know it to look at the documentation; it took me a while to realize I needed to load the Debian package libsasl2-modules-gssapi-mit [debian.org].