Hack Forums
[Tutorial] Pidgin + OTR - Easy Setup - Jabber / XMPP Setup Tutorial - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: [Tutorial] Pidgin + OTR - Easy Setup - Jabber / XMPP Setup Tutorial (/showthread.php?tid=4812708)

Pages: Pages 1 2 3 4 5

[Tutorial] Pidgin + OTR - Easy Setup - Jabber / XMPP Setup Tutorial - 'Cynical - May 8, 2015

To start off, download and install the latest version of Pidgin
After installing go to the taskbar at the top of the "Buddy List" window and go to the Accounts tab, then click on Manage Accounts. After doing this, a window will pop up in which you will want to press "Add Account."
Set a username, password, and for the domain, I recommend "army.li" Remember to check "Create this new account on the server."
Edit: Exploit has now known to have been rooted along with other complications w/ the server. Currently I recommend "army.li".
Spoiler (Click to View)

Next, go to https://otr.cypherpunks.ca/ and download the latest version of OTR for Pidgin. Run the installer and you'll need to go over to Pidgin and go to Plugins, which is under the "Tools" tab in the top taskbar.

Scroll down the Plugins until you find OTR, and check the box to enable it.
Spoiler (Click to View)

Now, you are ready to use XMPP, also known as Jabber, with OTR. To add someone, simply go to "Buddies" and "Add buddy". Remember to enter their username as "[email protected]"
Spoiler (Click to View)

To use OTR to encrypt conversations, click "Not private" in the bottom right of the IM window. In the window that pops up, click "Start private conversation." OTR will also automagically delete logs created by Pidgin.
Spoiler (Click to View)

Congratulations! You now have XMPP/Jabber setup with OTR!

But! OTR is also good for confirming that someone is who they say they are!
If you go to the same window used for initiating a private conversation, you can also click on "Authenticate Buddy."
Authenticate Buddy is good for making sure that the person on the other end isn't a malicious user who hasn't hijacked, or stolen, your buddy's account.
There are multiple tools provided for doing this, such as "Question and Answer", which allows you to set a question and the answer to that question, "Shared Secret", which is a phrase that is shared between you and your buddy that others won't know that can be used for verifying that they're your buddy, and "Manual Fingerprint Verification."

The most 'complicated' out of the 3 is fingerprint verification. I believe that the fingerprint is unique to every PC, and remains the same.. (Correct me if I'm wrong.) In a conversation where you know that your buddy is actually your buddy, you can save his fingerprint for later and compare it for verification. Additionally, you can contact your friend via email, telephone, or some other form of communication in which you can have them pull up their fingerprint and confirm it. If they read out the same fingerprint that is shown on your screen, then they're not an impostor.

[Additional Information: https://otr.cypherpunks.ca/help/authenticate.php?lang=en]

Congratulations! You can now prevent people from impersonating your buddies and SEing you!

List of public XMPP servers: https://list.jabber.at/

* - Raz3r - May 8, 2015

Good tut, Op.
🤝

* - 'Cynical - May 8, 2015

(May 8, 2015 03:05 PM)Raz3r Wrote:  Good tut, Op.
🤝

I just wish to see XMPP/Jabber become more popular, just because it is generally decentralized and more secure/private than many other chat clients.

* - Revamp - May 8, 2015

Good Tut, Members need to stop using Skype.

* - Sunkist S0D4 - May 8, 2015

(May 8, 2015 03:09 PM)๖ۣۜRoku Wrote:  I just wish to see XMPP/Jabber become more popular, just because it is generally decentralized and more secure/private than many other chat clients.

Agreed, but I've seen a couple other tutorials on how to set it up. Never the less, thanks for contributing!

I'm sure others will find it helpful.

* - 'Cynical - May 8, 2015

(May 8, 2015 03:17 PM)Sunkist S0D4 Wrote:  Agreed, but I've seen a couple other tutorials on how to set it up. Never the less, thanks for contributing!

I'm sure others will find it helpful.

There are a few others, but many of them are over-complicated.. Face it, new kids coming into this community have short attention spans and need something that is straight to the point, yet descriptive.
That is what I aimed to create.

* - Serion - May 8, 2015

Been using XMPP for awhile. Allows for deeper conversations about different topics ;)

OP; Good tut for the newbies.

* - HIGH PAID FELLA - May 8, 2015

You did not even explained how it works, what a fingerprint is and how it can get used, and how to confirm somebody.

* - 'Cynical - May 8, 2015

(May 8, 2015 03:25 PM)Asterea Wrote:  You did not even explained how it works, what a fingerprint is and how it can get used, and how to confirm somebody.

For general purposes, that is not generally needed. But, I can add that topic to the thread in a few minutes.

* - HIGH PAID FELLA - May 8, 2015

(May 8, 2015 03:26 PM)๖ۣۜRoku Wrote:  For general purposes, that is not generally needed. But, I can add that topic to the thread in a few minutes.

So, if you talk to somebody on a regular base, you don't want to make sure you are talking to that person instead of somebody unkown etc.

* - Mr.BWA - May 8, 2015

im so glad to see this, i hate when people talk to me about hacking and illegal things with out OTR

* - 'Cynical - May 8, 2015

(May 8, 2015 03:27 PM)Asterea Wrote:  So, if you talk to somebody on a regular base, you don't want to make sure you are talking to that person instead of somebody unkown etc.

I added it to the thread..
I knew what authentication is used for; I just needed some time to type it up. :)

Jabber needs to get more attention.
The more people using an encrypted, no-logging, decentralized way to communicate, the better.

* - 'Cynical - May 13, 2015

Everyone should use XMPP / Jabber.

* - Lenchmob - May 13, 2015

Thanks for sharing this :)

* - Comedic - May 13, 2015

Nice tutorial OP, very well written.