summaryrefslogtreecommitdiffstats
path: root/wiki/src/blueprint/replace_Pidgin.mdwn
blob: 603598b4df7de04f08eb9cfe8f5671170f8a6d02 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
Corresponding ticket: [[!tails_ticket 8573]]

It would be nice to replace Pidgin with another secure IM client. Unfortunately no good alternative seems to exist today. To be able to decide, if another IM client would be a suitable replacement this document should list the requirements a client needs to fulfill to fit the bill.

The document can also list candidate clients together with some indication where they are lacking (and where they shine).

[[!toc levels=3]]

# Requirements

**Note**: this is a work in progress. See [[!tails_ticket 11686]]
and its blockers for the next steps.

**Note**: the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", 
"SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and 
"OPTIONAL" in this document are to be interpreted as described in 
[RFC 2119](http://www.ietf.org/rfc/rfc2119.txt).

## General requirements

### Use cases

The client SHOULD support the following use cases:

1. Contributing to Free Software projects that use IRC chatrooms (and won't switch to anything else any time soon)
2. Contributing to Free Software projects that use XMPP chatrooms
3. One-to-one chat that is compatible with currently widespread practice. That basically means XMPP + OTR, nowadays.
4. Participation in public chatrooms for Tails user support.

The client MAY support the following use cases:

* One-to-one chat that protects metadata end-to-end (that is: "who is chatting with whom")

### Documentation

### Internationalization

The client must be internationalized, ideally already translated in many languages - if not, adding new languages should be easy.

### GUI

The client must have a easy to use GUI that makes it hard for users to use the client in an insecure way.

### TLS

The client must support connections using TLS.

### Support for Tor

The client must support Tor and must not leak any private data (hostname, username, local IP, ...) at the application level.

### Support for OTR

The client must support OTR and should make it easy to enforce usage of OTR for all conversations or only for specific contacts.

Ideally, some usability study for the OTR user interface has been done.

### Other

TODO: Pidgin already has an apparmor profile; should we require that a replacement also comes with an apparmor profile?

The client MUST NOT save logs of conversations.

### Candidates

Suggested by sajolida on <https://mailman.boum.org/pipermail/tails-dev/2016-January/010123.html>:

* private group chat
* search and archive past public communications
* offline-friendliness
* <https://dymaxion.org/essays/pleasestop.html>

## XMPP (Jabber)

 *( Here is a [list](https://developer.pidgin.im/wiki/SupportedXEPs) of XMPP extensions supported by Pidgin )*

### MUC
The client must support XMPP conference rooms [(XEP-0045)](https://xmpp.org/extensions/xep-0045.html).

## IRC
### SASL
The client must support SASL authentication.

# Candidate alternatives 

## CoyIM

* [Homepage](https://coy.im/)
* [Github](https://github.com/coyim/coyim/)
* CoyIM only supports XMPP.
* CoyIM [is in Debian](https://tracker.debian.org/pkg/coyim)
* Support for multi-user chatrooms (MUC) is [in
  progress](https://github.com/coyim/coyim/projects/2) and lacks some
  important features such as having a persistent list of rooms
  persistently saved in the configuration
* Supports Tor, TLS, OTR
* Supports creation of random accounts.
* Supports importing accounts from Pidgin.
* No logging, no clickable links.
* Not audited.
* Test results in Tails: [[!tails_ticket 8574]]

## dino

* [homepage](https://github.com/dino/dino)
* implemented in GTK+/Vala
* supports XMPP and OMEMO; OTR support is
  [not high on the todo list](https://github.com/dino/dino/issues/97)
* is [[!debpts dino-im desc="in Debian"]] Buster
* the Debian maintainer wants to add an AppArmor profile and got in
  touch with intrigeri about it

## Gajim

XMPP client in Debian with plugins for OTR and [OMEMO](https://en.wikipedia.org/wiki/OMEMO) (Signal-like, [XEP-0384](http://xmpp.org/extensions/xep-0384.html)) but no IRC. Tickets were created and rejected some time ago
([[!tails_ticket 7868]] and [[!tails_ticket 11541]]) but might be worth
reconsidering after updating this blueprint ([[!tails_ticket 11686]]).

People from Security-in-a-Box have used it successfully in Tails.

Gajim ships with a plugin called "plugin installer" which allows a user to download new plugins. This sounds suspicious for security, because plugins are pieces of code running with full privilege. The implementation in Debian use unverified TLS connection, which is very very open to MITM. The development version has switched to verified HTTPS connection and is trying to make it more robust.
However, I think that Tails should not ship this plugin at all: it allows a user to download code without needing sudo. We could work debian-side to separate gajim-plugininstaller in a separate package so that Tails can choose not to install it?

## No longer viable

### Tor Messenger ([[!tails_ticket 8577]])

Tor Messenger is no more: https://blog.torproject.org/sunsetting-tor-messenger

* Documentation, downloads and tickets in Tor's [Trac](https://trac.torproject.org/projects/tor/wiki/doc/TorMessenger)
* Satisfies all our requirements (listed above, as of commit
  `8e3157d5f4cd7894bca21adf6b95a6b49d9beb01`) except the TODO about
  StartTLS (I bet it has the code for it though, since Thunderbird
  supports it, but I in the GUI there is only "Enable SSL" as options
  for IRC and XMPP).
* The GUI is very similar to Pidgin's, which might be a bonus point
  since we are looking for a "Pidgin replacement".
* It has support for "temporary XMPP accounts" that require no
  registration (no user input!) which would be useful for our support
  channel (see [[!tails_ticket 11307]]).
* Tor Messenger provides Linux packages but is not in Debian :(
* FWIW: Tor Messenger got 30K USD funding in 2017!
* FWIW: anonym has been happy using it exclusively for chatting since
  September, 2016.
* _Instantbird_ (on which _Tor Messenger_ is based) is dead upstream
  and is meant to be
  [replaced by future improvements in _Thunderbird_'s chat features](http://blog.queze.net/post/2017/10/18/Thunderbird-is-the-next-version-of-Instantbird)
  (although _Thunderbird_'s future is unclear as well). To follow
  along, subscribe to the [[!mozbug 1409891 desc="meta tracking bug"]]
  and the ones it depends on. The _Tor Messenger_ developers
  intend to
  [follow suit](https://lists.torproject.org/pipermail/tor-project/2017-October/001521.html)
  and create a _Tor Communicator_ bundle based on _Thunderbird_, that
  would handle both email and chat.