In the jabber world, almost every connection between different entities (clients and servers) are encrypted using TLS. But some people claim that it's not enough, because the server can still read the messages. The solution, for paranoic people that can't trust their server, is to use end to end (e2e) encryption, such as OTR.

OTR (for Off The Record messaging) is a protocol that make the e2e encryption easy. But it is vulnerable to the man in the middle attack, specially because the server can read and modify all messages. To prevent against this attack, user must check carefully the peer's fingerprint using another media, but honestly, who does that ?

Recently, Michael Zanetti announced he was working on an implementation of OTR for Kopete.
I have now a working implementation of OTR on the hand. And I decided to break it :-)

That's why I wrote mod_otr . It is a module for ejabberd, which do the man in the middle attack at server level. It will intercept message and decrypt them. It can be used in combination with the mod_logmnesia module which log all messages.

The problem I have with e2e encryption is that it make impossible some other desirable feature such as automatic message history on the server. [1] All the proposals of an easy to use e2e encryption suffer from the same problem. The lambda user don't really care about privacy, so they will never check their fingerprints.

Download

The source code of mod_otr is there:
http://bepointbe.be/files/mod_otr-20070329.tar.gz

The instructions about how to install are in the README file

Notes

[1] for which i have made an implementation, see mod_archive