Okay.
So now that we know how to create an x NPP account, configure pidgin to sign into this account, add
the user and communicate with friends.
In this lecture, I want to show you how to improve the privacy and anonymity of this method of communication
of X NPP using a plugin called OTR.
So as you can see right now, when we're sending messages, you can see in here at the bottom, right,
it's saying that our communication is not private.
To understand why our communication is not private, let's have a closer look on what happens when you
send a message.
So we have David and John here that want to communicate.
They're using an X NPP server to communicate.
It doesn't matter what server they use.
Like I said, they could be using two different servers.
So David has a message that is a secret message.
He sends it to the XMPP server that he uses and then this server might relate to other servers or directly
send it to John.
Then John Can opened the message and read it.
Now, pretty much all of the servers in the list I gave you in the previous lecture support TLS and
if you choose a grade A server, then that means they're using the latest and greatest specifications
for TLS.
So that means the communication between you, between the clients and the server are encrypted and hence
the red lines in here.
That means all of this communication is encrypted.
And if anybody manages to intercept this connection here or here, they will not be able to read the
message because the message will be encrypted.
It will be gibberish.
The only problem is listen to what I said.
I said, the communication between you and the server is encrypted.
So what that means is it means you will be able to read the message.
The server will be able to read the message and the receiver will read the message.
Now it's fine that you and the receiver can read the message.
The only problem is the fact that the server can read the message because the communication between
you and the server is encrypted.
But once the message is delivered to the server, the server will be able to read it.
Now, like I said, you want to make sure you use a server that you trust and read about the reviews
and read about their privacy policy.
And even if the server is great and will not share anything that you do and will not log anything that
you do.
It's still not great that servers can read what we type.
It's not very private.
Therefore, the solution to this is to use a plugin called Otar, which is short for off the record.
And the idea behind this plugin is to make this communication as close as possible to an off the record
private communication that you can have with a friend.
So whenever you're talking to someone about something privately and you don't write anything about it,
so it provides end to end encryption, it provides authentication.
So we'll be able to verify the person we're talking to.
It provides perfect forward secrecy and deniability.
Now, the way this works is so let's go back to our diagram.
We have David, who wants to send a message over an XMPP server that is used in TLS.
So as you can see, we have red lines here indicating that the communication is private.
But what happens is before sending this secret message, David is going to encrypt the secret message.
So the message will become gibberish.
And then and only then he will forward it to the x NPP server.
This means that the message that the server will receive will be gibberish.
It will not be readable.
Then the server will relay this message to John.
When John opens this message, it's still gibberish and he will have to use a key to decrypt it and
read the content of the message.
This way the only two entities that are able to read the content of the message are David and John,
the sender and the receiver.
And even though the XMPP server will read the message, the content of the message will be gibberish
because it got encrypted by David before sending it.
Not only that, anyone that intercepts the communication and here they will have to bypass two layers
of protection.
Now they'll have to bypass TLS and the encryption implemented by the OTR plugin.
So let's go ahead and see how we can configure this with pigeon so that we can encrypt our messages
and send them privately.
So right here, I'm already logged in to the account that we created previously.
And before I send any further on private messages, I'm going to go to tools plugins.
And I'm going to look for OTR or off the record.
We have it right here.
And as you can see, it's enabled by default.
And I'm going to click on Configure to configure this plugin.
And what I want to do right now is make sure that it is enabled.
I want to make sure that automatically initiate private messaging and require private messaging are
ticked so that even if I try to send any messages unencrypted in the future, pigeon will refuse that.
So I'll have to always use encryption.
That's done.
Now I'm going to close this.
And now when we come here, when we come to a conversation.
So let's close this and just show you the steps from the start.
So you'll double click because you want to talk to your friend and again before you do anything.
As you can see, it's saying the communication is not private.
So you can either click on this, you can click on the otter in here or on this icon.
So I'm going to click on this and we're going to select Start Private Conversation to enable OTR off
the record and start communicating with my friend privately.
So as you can see, it's telling us that it's generating a private key for me and it's done.
So I'm going to click on okay.
And right now, if I send a message, so let's say this is a test and send it if we go here.
As you can see, this is the friend that I sent a message to.
He automatically got a private key as well because I requested to initiate a private conversation.
And as you can see automatically for him, it's saying it's unverified.
So it changed from private to unverified.
We'll talk about what the unverified means later.
But basically this means that the communication between us now is encrypted.
And as you can see, we get the message.
So now if I say hello back and go to the other person, as you can see, we received it right here.
And basically this means that any message I send from here or from the other account is always encrypted
at my end and only decrypted at the end at the destination.
So even the server will not be able to read the contents.
So that's it for this lecture.
Now our communication is private.
As you can see, we still have one more notification in here saying that our communication is unverified,
so we bypass the private problem.
Now our communication is unverified.
I will talk about what that means and how to fix this in the next lecture.