WhatsApp on your computer: Pidgin plugin

[giovannibajo1]

Does pidgin still save your password in plain text (or base64-ized) in a configuration file in your home? I haven't used them in years because of this, and we also banned it in our company to avoid mistakes.

[aaren]

There is a plugin to interface with gnome-keyring:

https://code.google.com/p/pidgin-gnome-keyring/

[nodata]

The file it saves your password in is only readable by you.

Pidgin needs to supply the plaintext password to the server to authenticate.

[lucian1900]

libpurple saving passwords in plain text is the correct decision. If it did encrypt them, it would also have to hold the key, so it would only add a false sense of security.

The only improvement would be a hardware-backed secret storage mechanism, but those aren't exactly ubiquitous.

[vikas0380]

yes, they are still using the plain text passwords

"Purple does not now and is not likely to encrypt the passwords in the accounts.xml file, nor is it likely to be encrypted in a future release. "

[Vilkku]

There is a plugin called "Windows Credentials", which according to the description uses Windows credentials instead of saving the passwords as plaintext.

I am unfortunately not exactly aware of what this means in practice, but I doubt it is worse than the default behaviour. But for Windows only, one could assume.

[X4]

Yes it still does. It's stupid and and I don't know why they didn't fix it. :(

[kcbanner]

Some protocols use OAuth, such as Twitter.

[salient]

It would be nice if Whatsapp, which is so popular, would help make its users a lot more secure by adopting end-to-end encryption, perhaps like what TextSecure v2 is using.

Getting people to use services with proper encryption is going to be a very slow process unless we convince/pressure the big ones to do it.

[mxchael]

But you can't make any money with encrypted data.

[sturmeh]

So like Telegram, which is basically the same app but nobody uses it? (http://telegram.org/)

[thomasahle]

This is awesome! Must have taken a fair bit of hacking to get working, given WhatsApp's policies.

Does anyone know if there are mobile apps based on Pidgin? Pidgin/Purple solved the multi-chat-client problem so well for the desktop, I'd love it to do the same on mobile.

[X4]

Yes there is a pidgin web-client, I can't recall the URL though. Sorry.

[amjd]

If anyone's interested in hacking, there are a couple of unofficial APIs:

https://news.ycombinator.com/item?id=6913300

https://github.com/venomous0x/WhatsAPI

[govindkabra31]

will this work on adium?

[Axsuul]

Yea, those of us on OS X need something like this

[jullles]

it works, but someone has to compile a plugin for it..

[rfnslyr]

Pidgin is great. I have all my services hooked up to it: Aim/FB(when i had it)/Multiple Steam accounts/GTalk etc. Really great light weight chat client. Just wish there was a way to get Skype contacts on it.

[Attic]

There actually is a way, you can use Skype4Pidgin. However this requires you to have skype running, but you are able to chat with your skype contacts through Pidgin. I do have to note that I've used this with Finch (also uses the purple library) and I've had one incident that I was talking to one person and one of my messages was mysteriously sent to a group chat instead of that one person. I've only had that happen to me once and I've not had that with Pidgin.

Here's the link: http://code.google.com/p/skype4pidgin/