Archive for the ‘security’ Category

Worse than a walled garden

May 28, 2013 1 comment

So, Google has a  known history of axing things that people like. My eye gets twitchy every time they funnel a new service through Google+. I whined and moaned when they axed sharing on Google Reader. I was even more pissed when they axed Reader altogether. But none of these were things that I desperately needed, so I sort of grinned and bore it, all the while chalking it up to the perils of using a free service run by what is basically an advertising company.

But now that Google is dropping full XMPP support, I’m not just pissed off. I’m actively worried.

Here, have some flowery quotes from the shills at Verge responsible for this fluff piece:

But today, the wait is over as Google introduces a new messaging platform it’s calling Hangouts. It spans Android, iOS, Chrome, and Gmail. It’s a fusion of Google’s strengths in cloud computing, search, and mobile.

Hangouts keep your messages in the cloud — which isn’t exactly revolutionary, but since it’s Google’s cloud, there are some unique benefits. Every Hangouts conversation is stored online (and is accessible from any Hangouts app), but there is an option to toggle off history if you’d like to go off the record.

XMPP is an extensible chat framework that, among other things, delivers instant messages to desktop clients. Personally, I use Adium to funnel chats from a range of my friend’s jabber addresses into one place.  I actually use a handle associated with a Google Apps domain to communicate with my friends, and XMPP support means I can talk to users on different instant messaging networks.

More importantly, I use Adium because it enables me, at any time, to switch quickly and reliably chat off the record. OTR chat provides encrypted end-to-end messaging between chat clients, allowing two people to communicate in a mostly secure fashion regardless of what their chat provider is. I’m aware there are vulnerabilities to OTR security across platforms like Adium (and also other clients like Pidgin). Anyone looking for a good primer on how off the record messaging works should pop on over to the page on OTR. There’s a FAQ! There’s documentation! There’s a big donation button that you should click.

So what the Verge article (along with most of the other coverage on the Hangouts switch) tellingly fails to mention is that this switch to Hangouts will drop all support for users who wish to use third party clients to communicate with people on other XMPP servers. If I want to talk to, say, someone with a handle run through, then I’m shit out of luck. Google’s XMPP servers will no longer federate with other people’s servers. There are a number of servers out there that exist almost exclusively to cater to people who have reason to want to protect their privacy and security ( specifically comes to mind). Now, they’ll still be out there and able to communicate with each other… but not to any Google server.

This article from Ars Technica sheds only a little more light on what Hangouts mean for OTR users:

“The good news is that Hangouts will still support client-to-server connections via XMPP, though only for one-to-one text chat. That means that Web and client-side chat applications that have used XMPP to connect to Google Talk will still be able to see presence information about their contacts in Google+ and chat with them via text in Hangouts.”

So there will still be some basic XMPP support. However, the implications for OTR support are still foggy at best, and in my opinion merit a closer look. But “chatting via text” doesn’t inspire a whole lot of confidence.

This is much more sinister than Google simply building the walls on their garden a bit higher. This move actively disrupts a chat ecosystem that supports the most vulnerable and the most sensitive users. If Google cripples third party client XMPP support, they will be booting people who rely on OTR chat to ensure their digital safety squarely out of their walled garden altogether. It seems that OTR support will still exist for gmail-to-gmail chat within their walled garden… for now.

Now, I know that a number of people in the security community are already highly distrustful of Google. While I have always at least understood their concerns in the past, I’ve often defended the big G. I’ve known a number of Googlers who have demonstrated with both their work and occasional drunken rant with me at some security con that they deeply, sincerely care about the privacy and rights of the users who rely on them. They consistently get high marks from organizations like the EFF. Anyone who wants to get an idea of hours they log to protect their users should look at a few pages of their Security Team’s public blog. There’s some hard work there, and it’s for reasons like these that when people ask me if I trust Google, I have answered (with reservations) yes.

But this move to drop XMPP support makes me question that. It also makes me question what I should tell my peers, especially journalists who wish to better protect their sources, when they ask me about things like OTR chat. When I was in journalism school, one of my hobbies was showing my peers in the newsroom how to set up OTR chat on their desktop clients and how to verify keys. It was easy, and people could use their ubiquitous gmail addresses instead of having to set up some new jabber handle. What am I supposed to say to those peers seeking my advice now? “Well, this is the easiest and most reliable way to go OTR with the credentials you already have and a few clicks, but who knows how long that will last!”

Although this post feels a bit like shouting into the abyss, I wish there was a way I could address the Hangouts team and remind them how vitally important it is that Google’s XMPP servers continue to federate with other XMPP servers. I wish I could remind them of the journalists, activists, and other vulnerable people on the ground who rely on this support and ability to communicate securely across platforms.

This is more than bolstering a walled garden. This is a slashing and burning of the crops in that garden that people were relying on.

Categories: activism, security