My personal notes on all things technical and factual....

Clayton's Tech Bits

Search this site:

Custom Search

Wed, 18 Feb 2009

/Security/IMchat: Chat Monitoring is a Standard Firewall Feature

And I quote[1]:

"The IM proxy is the best I’ve seen. Once it’s enabled, every incoming and outgoing IM conversation is logged. After opening up a few channels in IRC - in real-time - it’s possible to view any conversation going through the firewall. MSN, AIM, and other protocols are supported as well. It’s a big-brother feature, but if you want to monitor who you children are talking to, or for whatever reason, I can see it being an invaluable resource to monitor what is going on in a network you control. It would almost be easier to keep track of conversations using the logging tool in Smoothwall instead of multiple instant messenger clients."

The above quote is from a review of the free version of the Smoothwall[2] firewall -- you do not even have to pay money for this feature in Smoothwall! Meaning this feature is probably simple and common among commercial firewalls. Anyone who thinks that their employer is not listening in on their Yahoo Messenger / MSN / AIM / etc. chat sessions is being extremely naive. Check out this[3]:

"New IM Reports - Generate new reports on IM including time spent messaging and number of chat friends per user."

The solution: use a chat client that does encryption:

Pidgin: After both ends have installed and turned on the Off-The-Record Messaging plugin[5], Pidgin[4] clients can encrypt all chat traffic. This is one of the best solutions, because Pidgin is Open Source software, and runs on most popular OSes: Windows, Mac, and Linux. On Macs, Adium[6] should also be Pidgin-compatible, and there are other OTR-enabled clients[8].
Skype: Skype[6] encrypts everything, but is closed-source commercial software and they seem willing to give your "encrypted" conversation away to any government who asks[10].
Google Talk in the Browser: Gmail seems to run a 100% encrypted session in the browser. Therefore, any Google Talk[9] chat session that occurs in the same browser window should be encrypted, but do not quote me on that. I personally usually use Pidgin for my Google Talk chats, and there is an option called "Require SSL/TLS" (encryption). I have it turned on, and everything works fine.

[1] http://www.fsckin.com/tag/smoothwall/
[2] http://www.smoothwall.net/products/
[3] http://www.smoothwall.net/products/corporatefirewall2008/?whatsnew
[4] http://www.pidgin.im/
[5] http://www.cypherpunks.ca/otr/
[6] http://www.adiumx.com/
[7] http://www.skype.com/
[8] http://www.cypherpunks.ca/otr/software.php
[9] http://www.google.com/talk/
[10] http://blog.langex.net/index.cgi/Security/skype/

posted at: 03:45 | path: /Security/IMchat | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Wed, 18 Feb 2009