Chat encryption?

Hello,

I wonder about encryption - I don't mean sensitive data like credit card numbers, but rather what is typed in chat and IM. I couldn't find any info on that.

Certainly one wants to be sure that often personal and intimate chat information cannot be eavesdropped by a packet sniffer on the network or the local corporate IT people. So, can one confirm that the chat communication is secure?

Thanks!

I'm almost sure it isn't. I think the only stuff that's encrypted are some portions of the login.

Well, technically, encrypting chat text would be no big deal and not create much of an overhead. I know that SL uses all sorts of ports, incl 443 https (but chat does not seem to use that). It would be nice to have some written info.

So I may try to investigate myself with a packet sniffer - it's an important issue for anybody who uses SL from a non-private location.

OK now I have checked myself with a sniffer. It seems all goes via port 12043 and is SSL encrypted, which is good news.

I was very surprised to discover that someone (inworld) was able to spy on and record my IMs. I knew that chat could be vulnerable, but I thought IMs were supposed to be secure! Any suggestions on prevention?

There is no way to record IMs in world, unless the person recording the IMs are the person you are IMing to.

Or is an alt of said person Or, perhaps, if the target of the IM shared the conversation with another...

There is no known mechanism to *intercept* an IM, even using a modified client or libsecondlife.

Sorry guys - there does seem to be a way of recording IMs! I was in an IM conversation with a friend, when she was IM'd by another person, with the transcript of our messages! I have spoken to several suppliers of bugging equipment - and they all said it wasn't possible to 'bug' IMs... but it happened to me! I believe the device used was able to record on a wide variety of channels. Has anyone else come across this problem?

The grid just doesn't work that way, Rivasider. There must be some other explanation for how the person got a hold of your IM conversation. Perhaps they'd installed a keylogger or other spyware on your friend's computer (or your computer)? Did they live in the same house as your friend? If so, they could have bugged the actual network traffic.

Simply put, chat and IMs are separate, and those devices that listen to chat traffic on a range of channels just won't get IM traffic. The only way this could have happened is if you were using some kind of third-party IM script system that sent messages over chat, or something weird like that.

I remain convinced that there is no possible way to intercept IM data without access to the physical network of the recipient or LL itself.

I know there is no way via LSL, and have been digging around heavily in the SL network protocol since June 2006 so I am arrogant enough to believe that I know what I am talking about... The data simply isn't routed to anyone else.

Regardless of how it happened, I sincerely hope that the people who believe that their IM's were intercepted have filed abuse reports so that LL will look into the matter.