[tor-bugs] #1676 [Tor bundles/installation]: Audit jabber/XMPP support for pidgin

[Tor Bug Tracker & Wiki]

#1676: Audit jabber/XMPP support for pidgin
--------------------------------------+-------------------------------------
 Reporter:  katmagic                  |          Owner:  ioerror 
     Type:  defect                    |         Status:  assigned
 Priority:  critical                  |      Milestone:          
Component:  Tor bundles/installation  |        Version:          
 Keywords:  pidgin, DNS               |         Parent:  #2918   
   Points:                            |   Actualpoints:          
--------------------------------------+-------------------------------------

Comment(by ioerror):

 Replying to [comment:37 rubin110]:
 > So after scratching my brain for a bit, actually rereading much of this
 thread, and a bit of retesting...
 >
 > The new build people have been speaking of is Pidgin, the change is a
 new item in the proxy type menu called "Tor/Privacy (SOCKS5)" which seems
 to push DNS through Tor.

 Right - exactly so.

 >
 > Via the XMPP connection protocol I'm able to make successful connections
 to CCC's jabber server and talk.google.com without any DNS leakage.

 Great. In theory - this should be be the default mode.

 >
 > The "GTalk" connection protocol uses gmail.com as the server, which
 seems to choke on making SRV look ups. This is also the case if gmail.com
 is used as the server in the XMPP connection protocol. Basically it fails
 to connect but with no DNS leakage.
 >

 Yes, that is expected and this confirms the goal of the patch.

 > I don't know if whoever packages this could simply rebuild Pidgin with
 talk.google.com in the server spot by default for GTalk instead of
 gmail.com. Additionally I have the feeling if the exit node is terminating
 out of Germany, gmail.com wont actually work, but I could be wrong.
 >

 In theory, yes - though in practice, I think we need to set the connect
 server to talk.google.com and the main server to gmail.com - eg
 you at gmail.com but connecting through talk.google.com over Tor.

 > Also tested under the new Tor/Privacy proxy type was chatting over AIM,
 which worked without issue. Is Tor planning to support any other IM
 protocols? If so I can quickly test the rest of those out too.
 >

 If they are confirmed to not leak, yes. There are subtickets - if you do
 the review, they can be added into the bundle. At first glance, I think
 that AIM is fine except that their data retention policy is HORRIBLE as
 far as chatting goes.

 > I'm going to poke file transfers and other forms of possibly leakage in
 a bit, with a primary focus on XMPP through CCC and talk.google.com.

 Sounds good. XMPP is first, feel free to do others after that...

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/1676#comment:38>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online