Pidgin is full of privacy and anonymity issues such as the ones discovered in #1676 (closed).
I propose that this is a parent ticket for an audit of pidgin for privacy related issues.
When this bug is closed and all sub bugs are closed, we can ship the TIMBB again. Or, alternatively, we can ship it with just the plugins that have been audited.
Trac: Description: Pidgin is full of privacy and anonymity issues such as the ones discovered in #1676 (closed).
I propose that this is a parent ticket for an audit of pidgin for privacy related issues.
When this bug is closed and all sub bugs are closed, we can ship the TIMBB again.
to
Pidgin is full of privacy and anonymity issues such as the ones discovered in #1676 (closed).
I propose that this is a parent ticket for an audit of pidgin for privacy related issues.
When this bug is closed and all sub bugs are closed, we can ship the TIMBB again.
[[TicketQuery(parent=#2918 (closed),format=table,col=component|owner|summary|priority,order=priority)]] Component: - Select a component to Tor bundles/installation
Pidgin is full of privacy and anonymity issues such as the ones discovered in #1676 (closed).
I propose that this is a parent ticket for an audit of pidgin for privacy related issues.
When this bug is closed and all sub bugs are closed, we can ship the TIMBB again. Or, alternatively, we can ship it with just the plugins that have been audited.
[[TicketQuery(parent=#2918 (closed),format=table,col=component|owner|summary|priority,order=priority)]] Status: assigned to accepted
We should specifically focus our audit on proxy compliance issues. timing information such as time zones, usernames, local host name leakage, etc
Configure each protocol to use Tor as a SOCKS5 proxy and then check:
Do we only send traffic over the proxy?
Do we leak DNS?
If the proxy is unreachable - do we fail closed?
The Pidgin we ship should disable any protocol support for information leaks - we should not give remote typing indications, etc.
There are some privacy issues that are unavoidable - any plugin (such as OTR) allows a remote party to illicit a client response will be able to calculate network latency. Some protocols allow this by default (IRC), others have this as matter of functionality (OTR) - we have to find those issues identify them.
Ok, perhaps we have two levels of audit: one for proxy bypass and one for info leaks. We could then ship more protocols if we do a quick pass over the source and ensure no non-proxied network calls are made. Info leaks could be filed as bugs, but not blockers to shipping?
Ok, perhaps we have two levels of audit: one for proxy bypass and one for info leaks. We could then ship more protocols if we do a quick pass over the source and ensure no non-proxied network calls are made. Info leaks could be filed as bugs, but not blockers to shipping?
I think protocols have enough behavioural reaction nonsense in them that we actually need to check the source for proxy bypass leaks rather than just blackbox + wireshark (ie direct connect, send file, voice/video, etc). Is grepping the plugin source for network socket syscalls a feasible idea? Does Pidgin export non-proxied versions of any of its network functions? It's been years since I looked at the source.
I think protocols have enough behavioural reaction nonsense in them that we actually need to check the source for proxy bypass leaks rather than just blackbox + wireshark (ie direct connect, send file, voice/video, etc).
I agree - I've been reading the source and my Jabber patch for #1676 (closed) is the result.
Is grepping the plugin source for network socket syscalls a feasible idea? Does Pidgin export non-proxied versions of any of its network functions? It's been years since I looked at the source.
Yeah, you can go that route. I prefer to 0) think about the protocol in question: AIM vs XMPP? Very different DNS requirements 1) use the protocol with a debug window open, 2) use wireshark 3) narrow down the code path for leaks or 4) just read the entire protocol source plugin and perform 1-3 to confirm the patches or fixes work properly.
I've tried to compile it but unlike the previous attempts - it fails:
{{{% make
cd . && /bin/bash ./config.status config.h
config.status: creating config.h
make all-recursive
make[1]: Entering directory /tmp/pidgin-mtn' Making all in . make[2]: Entering directory /tmp/pidgin-mtn'
LC_ALL=C /usr/bin/intltool-merge -d -u -c ./po/.intltool-merge-cache ./po pidgin.desktop.in pidgin.desktop
Generating and caching the translation database
Merging translations into pidgin.desktop.
GEN package_revision_raw.txt
GEN package_revision.h
make[2]: Leaving directory /tmp/pidgin-mtn' Making all in libpurple make[2]: Entering directory /tmp/pidgin-mtn/libpurple'
Makefile:909: .deps/account.Plo: No such file or directory
Makefile:910: .deps/accountopt.Plo: No such file or directory
Makefile:911: .deps/backend-fs2.Plo: No such file or directory
Makefile:912: .deps/backend-iface.Plo: No such file or directory
Makefile:913: .deps/blist.Plo: No such file or directory
Makefile:914: .deps/buddyicon.Plo: No such file or directory
Makefile:915: .deps/candidate.Plo: No such file or directory
Makefile:916: .deps/certificate.Plo: No such file or directory
Makefile:917: .deps/cipher.Plo: No such file or directory
Makefile:918: .deps/circbuffer.Plo: No such file or directory
Makefile:919: .deps/cmds.Plo: No such file or directory
Makefile:920: .deps/codec.Plo: No such file or directory
Makefile:921: .deps/connection.Plo: No such file or directory
Makefile:922: .deps/conversation.Plo: No such file or directory
Makefile:923: .deps/core.Plo: No such file or directory
Makefile:924: .deps/dbus-server.Plo: No such file or directory
Makefile:925: .deps/dbus-useful.Plo: No such file or directory
Makefile:926: .deps/debug.Plo: No such file or directory
Makefile:927: .deps/desktopitem.Plo: No such file or directory
Makefile:928: .deps/dnsquery.Plo: No such file or directory
Makefile:929: .deps/dnssrv.Plo: No such file or directory
Makefile:930: .deps/enum-types.Plo: No such file or directory
Makefile:931: .deps/eventloop.Plo: No such file or directory
Makefile:932: .deps/ft.Plo: No such file or directory
Makefile:933: .deps/idle.Plo: No such file or directory
Makefile:934: .deps/imgstore.Plo: No such file or directory
Makefile:935: .deps/log.Plo: No such file or directory
Makefile:936: .deps/marshallers.Plo: No such file or directory
Makefile:937: .deps/media.Plo: No such file or directory
Makefile:938: .deps/mediamanager.Plo: No such file or directory
Makefile:939: .deps/mime.Plo: No such file or directory
Makefile:940: .deps/nat-pmp.Plo: No such file or directory
Makefile:941: .deps/network.Plo: No such file or directory
Makefile:942: .deps/notify.Plo: No such file or directory
Makefile:943: .deps/ntlm.Plo: No such file or directory
Makefile:944: .deps/plugin.Plo: No such file or directory
Makefile:945: .deps/pluginpref.Plo: No such file or directory
Makefile:946: .deps/pounce.Plo: No such file or directory
Makefile:947: .deps/prefs.Plo: No such file or directory
Makefile:948: .deps/privacy.Plo: No such file or directory
Makefile:949: .deps/proxy.Plo: No such file or directory
Makefile:950: .deps/prpl.Plo: No such file or directory
Makefile:951: .deps/purple-client-example.Po: No such file or directory
Makefile:952: .deps/purple-client.Plo: No such file or directory
Makefile:953: .deps/request.Plo: No such file or directory
Makefile:954: .deps/roomlist.Plo: No such file or directory
Makefile:955: .deps/savedstatuses.Plo: No such file or directory
Makefile:956: .deps/server.Plo: No such file or directory
Makefile:957: .deps/signals.Plo: No such file or directory
Makefile:958: .deps/smiley.Plo: No such file or directory
Makefile:959: .deps/sound-theme-loader.Plo: No such file or directory
Makefile:960: .deps/sound-theme.Plo: No such file or directory
Makefile:961: .deps/sound.Plo: No such file or directory
Makefile:962: .deps/sslconn.Plo: No such file or directory
Makefile:963: .deps/status.Plo: No such file or directory
Makefile:964: .deps/stringref.Plo: No such file or directory
Makefile:965: .deps/stun.Plo: No such file or directory
Makefile:966: .deps/theme-loader.Plo: No such file or directory
Makefile:967: .deps/theme-manager.Plo: No such file or directory
Makefile:968: .deps/theme.Plo: No such file or directory
Makefile:969: .deps/upnp.Plo: No such file or directory
Makefile:970: .deps/util.Plo: No such file or directory
Makefile:971: .deps/value.Plo: No such file or directory
Makefile:972: .deps/version.Plo: No such file or directory
Makefile:973: .deps/whiteboard.Plo: No such file or directory
Makefile:974: .deps/xmlnode.Plo: No such file or directory
make[2]: *** No rule to make target .deps/xmlnode.Plo'. Stop. make[2]: Leaving directory /tmp/pidgin-mtn/libpurple'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/tmp/pidgin-mtn'
make: *** [all] Error 2
}}}
If I try to do it without my patch and configure it like so, it still fails:
makecd . && /bin/bash ./config.status config.hconfig.status: creating config.hconfig.status: config.h is unchangedmake all-recursivemake[1]: Entering directory `/tmp/pidgin-mtn'Making all in .make[2]: Entering directory `/tmp/pidgin-mtn' GEN package_revision_raw.txt GEN package_revision.hmake[2]: Leaving directory `/tmp/pidgin-mtn'Making all in libpurplemake[2]: Entering directory `/tmp/pidgin-mtn/libpurple'Makefile:909: .deps/account.Plo: No such file or directoryMakefile:910: .deps/accountopt.Plo: No such file or directoryMakefile:911: .deps/backend-fs2.Plo: No such file or directoryMakefile:912: .deps/backend-iface.Plo: No such file or directoryMakefile:913: .deps/blist.Plo: No such file or directoryMakefile:914: .deps/buddyicon.Plo: No such file or directoryMakefile:915: .deps/candidate.Plo: No such file or directoryMakefile:916: .deps/certificate.Plo: No such file or directoryMakefile:917: .deps/cipher.Plo: No such file or directoryMakefile:918: .deps/circbuffer.Plo: No such file or directoryMakefile:919: .deps/cmds.Plo: No such file or directoryMakefile:920: .deps/codec.Plo: No such file or directoryMakefile:921: .deps/connection.Plo: No such file or directoryMakefile:922: .deps/conversation.Plo: No such file or directoryMakefile:923: .deps/core.Plo: No such file or directoryMakefile:924: .deps/dbus-server.Plo: No such file or directoryMakefile:925: .deps/dbus-useful.Plo: No such file or directoryMakefile:926: .deps/debug.Plo: No such file or directoryMakefile:927: .deps/desktopitem.Plo: No such file or directoryMakefile:928: .deps/dnsquery.Plo: No such file or directoryMakefile:929: .deps/dnssrv.Plo: No such file or directoryMakefile:930: .deps/enum-types.Plo: No such file or directoryMakefile:931: .deps/eventloop.Plo: No such file or directoryMakefile:932: .deps/ft.Plo: No such file or directoryMakefile:933: .deps/idle.Plo: No such file or directoryMakefile:934: .deps/imgstore.Plo: No such file or directoryMakefile:935: .deps/log.Plo: No such file or directoryMakefile:936: .deps/marshallers.Plo: No such file or directoryMakefile:937: .deps/media.Plo: No such file or directoryMakefile:938: .deps/mediamanager.Plo: No such file or directoryMakefile:939: .deps/mime.Plo: No such file or directoryMakefile:940: .deps/nat-pmp.Plo: No such file or directoryMakefile:941: .deps/network.Plo: No such file or directoryMakefile:942: .deps/notify.Plo: No such file or directoryMakefile:943: .deps/ntlm.Plo: No such file or directoryMakefile:944: .deps/plugin.Plo: No such file or directoryMakefile:945: .deps/pluginpref.Plo: No such file or directoryMakefile:946: .deps/pounce.Plo: No such file or directoryMakefile:947: .deps/prefs.Plo: No such file or directoryMakefile:948: .deps/privacy.Plo: No such file or directoryMakefile:949: .deps/proxy.Plo: No such file or directoryMakefile:950: .deps/prpl.Plo: No such file or directoryMakefile:951: .deps/purple-client-example.Po: No such file or directoryMakefile:952: .deps/purple-client.Plo: No such file or directoryMakefile:953: .deps/request.Plo: No such file or directoryMakefile:954: .deps/roomlist.Plo: No such file or directoryMakefile:955: .deps/savedstatuses.Plo: No such file or directoryMakefile:956: .deps/server.Plo: No such file or directoryMakefile:957: .deps/signals.Plo: No such file or directoryMakefile:958: .deps/smiley.Plo: No such file or directoryMakefile:959: .deps/sound-theme-loader.Plo: No such file or directoryMakefile:960: .deps/sound-theme.Plo: No such file or directoryMakefile:961: .deps/sound.Plo: No such file or directoryMakefile:962: .deps/sslconn.Plo: No such file or directoryMakefile:963: .deps/status.Plo: No such file or directoryMakefile:964: .deps/stringref.Plo: No such file or directoryMakefile:965: .deps/stun.Plo: No such file or directoryMakefile:966: .deps/theme-loader.Plo: No such file or directoryMakefile:967: .deps/theme-manager.Plo: No such file or directoryMakefile:968: .deps/theme.Plo: No such file or directoryMakefile:969: .deps/upnp.Plo: No such file or directoryMakefile:970: .deps/util.Plo: No such file or directoryMakefile:971: .deps/value.Plo: No such file or directoryMakefile:972: .deps/version.Plo: No such file or directoryMakefile:973: .deps/whiteboard.Plo: No such file or directoryMakefile:974: .deps/xmlnode.Plo: No such file or directorymake[2]: *** No rule to make target `.deps/xmlnode.Plo'. Stop.make[2]: Leaving directory `/tmp/pidgin-mtn/libpurple'make[1]: *** [all-recursive] Error 1make[1]: Leaving directory `/tmp/pidgin-mtn'make: *** [all] Error 2
I've tried to compile it but unlike the previous attempts - it fails:
% makecd . && /bin/bash ./config.status config.hconfig.status: creating config.hmake all-recursivemake[1]: Entering directory `/tmp/pidgin-mtn'Making all in .make[2]: Entering directory `/tmp/pidgin-mtn'LC_ALL=C /usr/bin/intltool-merge -d -u -c ./po/.intltool-merge-cache ./po pidgin.desktop.in pidgin.desktopGenerating and caching the translation databaseMerging translations into pidgin.desktop. GEN package_revision_raw.txt GEN package_revision.hmake[2]: Leaving directory `/tmp/pidgin-mtn'Making all in libpurplemake[2]: Entering directory `/tmp/pidgin-mtn/libpurple'Makefile:909: .deps/account.Plo: No such file or directoryMakefile:910: .deps/accountopt.Plo: No such file or directoryMakefile:911: .deps/backend-fs2.Plo: No such file or directoryMakefile:912: .deps/backend-iface.Plo: No such file or directoryMakefile:913: .deps/blist.Plo: No such file or directoryMakefile:914: .deps/buddyicon.Plo: No such file or directoryMakefile:915: .deps/candidate.Plo: No such file or directoryMakefile:916: .deps/certificate.Plo: No such file or directoryMakefile:917: .deps/cipher.Plo: No such file or directoryMakefile:918: .deps/circbuffer.Plo: No such file or directoryMakefile:919: .deps/cmds.Plo: No such file or directoryMakefile:920: .deps/codec.Plo: No such file or directoryMakefile:921: .deps/connection.Plo: No such file or directoryMakefile:922: .deps/conversation.Plo: No such file or directoryMakefile:923: .deps/core.Plo: No such file or directoryMakefile:924: .deps/dbus-server.Plo: No such file or directoryMakefile:925: .deps/dbus-useful.Plo: No such file or directoryMakefile:926: .deps/debug.Plo: No such file or directoryMakefile:927: .deps/desktopitem.Plo: No such file or directoryMakefile:928: .deps/dnsquery.Plo: No such file or directoryMakefile:929: .deps/dnssrv.Plo: No such file or directoryMakefile:930: .deps/enum-types.Plo: No such file or directoryMakefile:931: .deps/eventloop.Plo: No such file or directoryMakefile:932: .deps/ft.Plo: No such file or directoryMakefile:933: .deps/idle.Plo: No such file or directoryMakefile:934: .deps/imgstore.Plo: No such file or directoryMakefile:935: .deps/log.Plo: No such file or directoryMakefile:936: .deps/marshallers.Plo: No such file or directoryMakefile:937: .deps/media.Plo: No such file or directoryMakefile:938: .deps/mediamanager.Plo: No such file or directoryMakefile:939: .deps/mime.Plo: No such file or directoryMakefile:940: .deps/nat-pmp.Plo: No such file or directoryMakefile:941: .deps/network.Plo: No such file or directoryMakefile:942: .deps/notify.Plo: No such file or directoryMakefile:943: .deps/ntlm.Plo: No such file or directoryMakefile:944: .deps/plugin.Plo: No such file or directoryMakefile:945: .deps/pluginpref.Plo: No such file or directoryMakefile:946: .deps/pounce.Plo: No such file or directoryMakefile:947: .deps/prefs.Plo: No such file or directoryMakefile:948: .deps/privacy.Plo: No such file or directoryMakefile:949: .deps/proxy.Plo: No such file or directoryMakefile:950: .deps/prpl.Plo: No such file or directoryMakefile:951: .deps/purple-client-example.Po: No such file or directoryMakefile:952: .deps/purple-client.Plo: No such file or directoryMakefile:953: .deps/request.Plo: No such file or directoryMakefile:954: .deps/roomlist.Plo: No such file or directoryMakefile:955: .deps/savedstatuses.Plo: No such file or directoryMakefile:956: .deps/server.Plo: No such file or directoryMakefile:957: .deps/signals.Plo: No such file or directoryMakefile:958: .deps/smiley.Plo: No such file or directoryMakefile:959: .deps/sound-theme-loader.Plo: No such file or directoryMakefile:960: .deps/sound-theme.Plo: No such file or directoryMakefile:961: .deps/sound.Plo: No such file or directoryMakefile:962: .deps/sslconn.Plo: No such file or directoryMakefile:963: .deps/status.Plo: No such file or directoryMakefile:964: .deps/stringref.Plo: No such file or directoryMakefile:965: .deps/stun.Plo: No such file or directoryMakefile:966: .deps/theme-loader.Plo: No such file or directoryMakefile:967: .deps/theme-manager.Plo: No such file or directoryMakefile:968: .deps/theme.Plo: No such file or directoryMakefile:969: .deps/upnp.Plo: No such file or directoryMakefile:970: .deps/util.Plo: No such file or directoryMakefile:971: .deps/value.Plo: No such file or directoryMakefile:972: .deps/version.Plo: No such file or directoryMakefile:973: .deps/whiteboard.Plo: No such file or directoryMakefile:974: .deps/xmlnode.Plo: No such file or directorymake[2]: *** No rule to make target `.deps/xmlnode.Plo'. Stop.make[2]: Leaving directory `/tmp/pidgin-mtn/libpurple'make[1]: *** [all-recursive] Error 1make[1]: Leaving directory `/tmp/pidgin-mtn'make: *** [all] Error 2
If I try to do it without my patch and configure it like so, it still fails:
makecd . && /bin/bash ./config.status config.hconfig.status: creating config.hconfig.status: config.h is unchangedmake all-recursivemake[1]: Entering directory `/tmp/pidgin-mtn'Making all in .make[2]: Entering directory `/tmp/pidgin-mtn' GEN package_revision_raw.txt GEN package_revision.hmake[2]: Leaving directory `/tmp/pidgin-mtn'Making all in libpurplemake[2]: Entering directory `/tmp/pidgin-mtn/libpurple'Makefile:909: .deps/account.Plo: No such file or directoryMakefile:910: .deps/accountopt.Plo: No such file or directoryMakefile:911: .deps/backend-fs2.Plo: No such file or directoryMakefile:912: .deps/backend-iface.Plo: No such file or directoryMakefile:913: .deps/blist.Plo: No such file or directoryMakefile:914: .deps/buddyicon.Plo: No such file or directoryMakefile:915: .deps/candidate.Plo: No such file or directoryMakefile:916: .deps/certificate.Plo: No such file or directoryMakefile:917: .deps/cipher.Plo: No such file or directoryMakefile:918: .deps/circbuffer.Plo: No such file or directoryMakefile:919: .deps/cmds.Plo: No such file or directoryMakefile:920: .deps/codec.Plo: No such file or directoryMakefile:921: .deps/connection.Plo: No such file or directoryMakefile:922: .deps/conversation.Plo: No such file or directoryMakefile:923: .deps/core.Plo: No such file or directoryMakefile:924: .deps/dbus-server.Plo: No such file or directoryMakefile:925: .deps/dbus-useful.Plo: No such file or directoryMakefile:926: .deps/debug.Plo: No such file or directoryMakefile:927: .deps/desktopitem.Plo: No such file or directoryMakefile:928: .deps/dnsquery.Plo: No such file or directoryMakefile:929: .deps/dnssrv.Plo: No such file or directoryMakefile:930: .deps/enum-types.Plo: No such file or directoryMakefile:931: .deps/eventloop.Plo: No such file or directoryMakefile:932: .deps/ft.Plo: No such file or directoryMakefile:933: .deps/idle.Plo: No such file or directoryMakefile:934: .deps/imgstore.Plo: No such file or directoryMakefile:935: .deps/log.Plo: No such file or directoryMakefile:936: .deps/marshallers.Plo: No such file or directoryMakefile:937: .deps/media.Plo: No such file or directoryMakefile:938: .deps/mediamanager.Plo: No such file or directoryMakefile:939: .deps/mime.Plo: No such file or directoryMakefile:940: .deps/nat-pmp.Plo: No such file or directoryMakefile:941: .deps/network.Plo: No such file or directoryMakefile:942: .deps/notify.Plo: No such file or directoryMakefile:943: .deps/ntlm.Plo: No such file or directoryMakefile:944: .deps/plugin.Plo: No such file or directoryMakefile:945: .deps/pluginpref.Plo: No such file or directoryMakefile:946: .deps/pounce.Plo: No such file or directoryMakefile:947: .deps/prefs.Plo: No such file or directoryMakefile:948: .deps/privacy.Plo: No such file or directoryMakefile:949: .deps/proxy.Plo: No such file or directoryMakefile:950: .deps/prpl.Plo: No such file or directoryMakefile:951: .deps/purple-client-example.Po: No such file or directoryMakefile:952: .deps/purple-client.Plo: No such file or directoryMakefile:953: .deps/request.Plo: No such file or directoryMakefile:954: .deps/roomlist.Plo: No such file or directoryMakefile:955: .deps/savedstatuses.Plo: No such file or directoryMakefile:956: .deps/server.Plo: No such file or directoryMakefile:957: .deps/signals.Plo: No such file or directoryMakefile:958: .deps/smiley.Plo: No such file or directoryMakefile:959: .deps/sound-theme-loader.Plo: No such file or directoryMakefile:960: .deps/sound-theme.Plo: No such file or directoryMakefile:961: .deps/sound.Plo: No such file or directoryMakefile:962: .deps/sslconn.Plo: No such file or directoryMakefile:963: .deps/status.Plo: No such file or directoryMakefile:964: .deps/stringref.Plo: No such file or directoryMakefile:965: .deps/stun.Plo: No such file or directoryMakefile:966: .deps/theme-loader.Plo: No such file or directoryMakefile:967: .deps/theme-manager.Plo: No such file or directoryMakefile:968: .deps/theme.Plo: No such file or directoryMakefile:969: .deps/upnp.Plo: No such file or directoryMakefile:970: .deps/util.Plo: No such file or directoryMakefile:971: .deps/value.Plo: No such file or directoryMakefile:972: .deps/version.Plo: No such file or directoryMakefile:973: .deps/whiteboard.Plo: No such file or directoryMakefile:974: .deps/xmlnode.Plo: No such file or directorymake[2]: *** No rule to make target `.deps/xmlnode.Plo'. Stop.make[2]: Leaving directory `/tmp/pidgin-mtn/libpurple'make[1]: *** [all-recursive] Error 1make[1]: Leaving directory `/tmp/pidgin-mtn'make: *** [all] Error 2