How private are chatroom chats?

East Palo Alto, Sun, 01 Apr 2018 18:19:26 -0400 last edited: Mon, 02 Apr 2018 20:08:17 -0400

!Hubzilla Support Forum

How strong is the security of the Privacy Groups? For example, if I have a chat with someone in a chatroom assigned to Privacy Group containing just me and the other person, can the Administrator of the hub hosting the chatroom see chat conversations if he looks hard enough (such as by reading the chat directly from the database)?

chat hubzilla support privacy

show all 18 comments

Andrew

Sun, 01 Apr 2018 18:47:08 -0400

The administrator can always see everything, except in the specific case of using the "end-to-end encryption" where you create a symmetric key based on a shared passphrase (you know, with the little lock icon in the post).

Christopher M. Rasch

Sun, 01 Apr 2018 18:48:25 -0400

Thanks! Is there a way to set up a chatroom such that the entire chat is encrypted? Not just individual comments?

Jamie Green Eyes

Sun, 01 Apr 2018 19:09:16 -0400

Is there a way....
Not :), but I like the idea.
I don't know if is possible to create something like that without transforming the hubzilla core ;)

Einer von Vielen

Sun, 01 Apr 2018 19:14:21 -0400

You can encrypt every post and comment individually in Hubzilla. Your site admin has to switch this in.

Andrew

Sun, 01 Apr 2018 19:15:12 -0400

That wouldn't be too hard, I wouldn't think. Hubzilla would do its normal thing to control who has access to the chat, but I don't see why a suitable JavaScript library couldn't be used to enable e2ee. The catch would be that the keys would have to reside in the browser as a cookie or something and that might be a bit fragile.

Mike Macgirvin

Sun, 01 Apr 2018 19:36:13 -0400

Not currently. At the moment we do have chatroom expiration which removes old chat messages from the database, and which tends to make them difficult to read. We had also considered at one time obscuring chats as we do email, so as to prevent casual browsing by the admin. This is almost trivial to add. The premise is that people are generally lazy and if we make admins work to read private stuff they will rarely if ever bother.

Full AES encryption on top of RSA is pointless as it just degrades performance and the admin still has the keys to read everything if they feel motivated to do so. We used to do this for email a few years ago but the performance was poor and there weren't any obvious advantages over simple obscuring. E2EE is always a possibility here but you do need to get the shared secret to the other chat members in a way the admin won't or cannot see. If you're going that route, I'd suggest perhaps a plugin to engage through the signal protocol since they seem to do a good job of key transfer - albeit using a central server which I don't personally trust.

I will add my obligatory comment that the project is open source and if anybody finds it lacking in some way they are always welcome to improve it.

We usually don't consider the admin to be an adversary in this project and if you do, you might want to find another hub or self host. If you're just chatting with lovers or co-workers and want to be a bit more private or discuss trade secrets, obfuscation is generally adequate and expiration will remove the evidence afterward. If you're trying to protect military or state secrets you wouldn't be using this software to begin with.

Christopher M. Rasch

Sun, 01 Apr 2018 19:38:21 -0400

@"Einer von Vielen", thanks! I discovered that you can encrypt individual messages, but that becomes rather tiresome if you're having an extended conversation that you want to keep private.

Christopher M. Rasch

Sun, 01 Apr 2018 19:49:58 -0400

@Mike Macgirvin, thanks for the response!  Let me emphasize that when I ask if Hubzilla can do something, it's in the spirit of finding out what it can do that I may not be aware of.

And if I ask for a feature, it's with the understanding that devs are under no obligation to fulfill such a request.  I'm very grateful for all of the work that you and the other devs have put into making Hubzilla already.

I don't consider admins to be adversaries generally, but sometimes they're forced to be adversaries.  I'd rather that they be able to honestly say that they can't spy on private conversations, even if they wanted to.

Christopher M. Rasch

Sun, 01 Apr 2018 19:53:12 -0400

Perhaps the Converse.js library would be useful? It already supports Friendica and Diaspora.

https://conversejs.org/#features

Mike Macgirvin

Sun, 01 Apr 2018 20:00:37 -0400

I've just added chat obfuscation, which as I mentioned isn't real security but it will keep private sex chats or whatever from appearing during routine DB maintenance and ensure the admin has to work to snoop on your private chatter.

While testing this I also got a browser popup to add web notifications for the chatroom - I don't remember this feature going in but evidently somebody added a chat notification feature somewhere along the line. I can't really tell you anything else about it right now but I'll have to poke around and try it out. I'm not big on chat personally so I don't look at this code very often. It has improved a lot since I last looked.

Christopher M. Rasch

Sun, 01 Apr 2018 20:02:16 -0400

Cool, thank you!

Mike Macgirvin

Sun, 01 Apr 2018 20:09:41 -0400

If I recall there may already be a converse addon. TBH there have been so many chat addons that I often lose track. These do not integrate well with hubzilla privacy and think the developers are long gone, so it's kind of let the buyer beware - but there are several such addons. I have used the irc addon a few times but can't tell you about any of the others or what state they're in currently.

giac hellvecio

Sun, 01 Apr 2018 20:10:59 -0400

curios, i did that a lot of time ago.... :)

converse jabber

Andrew

Sun, 01 Apr 2018 21:57:16 -0400

While testing this I also got a browser popup to add web notifications for the chatroom - I don't remember this feature going in but evidently somebody added a chat notification feature somewhere along the line.

That was me. I got all excited about the browser notification support a while back, thinking it would make the chat web app be more functional. It is a step forward, but a mobile OS kills the JavaScript after a few minutes of being in the background (or immediately in the case of iOS), so it's not particularly useful in the context I wanted. We really need a native app to make the chat usable in that way. The notifications are very useful in a browser tab or side window on a "full computer" (what are we supposed to call desktops/laptops to distinguish from "mobile" devices?), and in this case the chat seems most useful when people plan to meet in the chat room at a specific time for a real-time conversation. Anything slightly more asynchronous is satisfied by the standard post/comment mechanism in my opinion.

Christopher M. Rasch

Sun, 01 Apr 2018 22:13:02 -0400

@giac hellvecio - you made a Hubzilla app that integrates with Converse?

Thndr

Sun, 01 Apr 2018 22:51:29 -0400

https://github.com/redmatrix/hubzilla-addons/tree/master/xmpp

The current XMPP addon seems to use Converse, or at least an older version as the last commit to that folder was 2 years ago