Secure Internet Chat How-To

The internet is inherently insecure

When you browse websites, chat with friends on Facebook, and check your email account, all the little bits that make up your messages and web page requests are sent out across the internet in plain text. That means that any zit-faced kid working at a datacenter or ISP can very easily read your emails or chat sessions by simply capturing the data flow from your computer as it moves across the network. It's not even hard to do, and it's well known among IT professionals that this sort of thing does happen on a regualr basis.

Keeping your conversations private from greasy datacenter geeks is one thing, but there is of course also the goal of simply exercising your right to have a private conversation with whomever you please. That's where our secure chat server comes into the picture. It's open access, so anyone can register for a chat account, and if you follow the instructions below (every step!), you can rest assured that your private chat sessions will remain private!

Step 1 - Install Pidgin

Go to http://www.pidgin.im/download/ and download Pidgin for your platform (supported operating systems are listed on the left side of that page). Open the downloaded file (or do whatever your OS requires to install a new program), and click through the install dialogs. Below is a photo of the installation screen on a Windows machine.



Step 2 - Create a new account

You'll need to register for an account on the chat server now. You should see a screen like this once the installation is complete and you run Pidgin for the first time:



Click the "Add" button, and you should see the following screen appear (below). Click the "Protocol" dropdown and select XMPP. Enter your desired username, then enter "chat.sprux.net" in the "Domain" field. The next field is "Resource" and can be something like "Office", "Home", "Laptop" or some other word to describe where you are chatting from. Enter a password (it should be strong, 8 characters or more with letters and numbers or other symbols). At the bottom of the window you need to check the box where it says "Create this new account on the server". Finally, click the "Add" button and proceed to the next step.



The next window will say "SSL Certificate Verification" in the title bar. This is a very important step! Click the "View Certificate" button and be sure all the information that appears matches what you see in the following images:




The fingerprint data you see above is outdated, and it should currently read:

89:69:0f:c2:ad:e2:17:6b:dc:aa:0c:b2:42:28:df:46:f6:15:92:5a

If the information doesn't match, then DO NOT ACCEPT IT. Close pidgin and send an email to admin@sprux.net and we'll look into the problem and get back to you.

If the information does match what you see in the image above, then you can close the window and click the "Accept" button in the previous window to accept the security certificate.


Finally, the last part of the account creation. Simply enter your username (same as you entered previously), full name and email (if you want, it's optional), and your password again, and click OK.



Step 3 - Disable Logging

VERY IMPORTANT!! If you really want your chats to be private and secure, you must disable Pidgin's logging feature. If you don't do this, then there will be a record of all your chats in a file written to your hard drive.

In your Buddy List, click on "Tools", then "Preferences" as shown below:



Then click the tab labeled "Logging" on the left side of the Preferences window, and un-check all three boxes. Then click the Close button at the bottom of the window.



Step 4 - Add Contacts to your Buddy List

In the Buddy List window, click the "Buddies" menu at the top of the window, then click "Add Buddy". You should see the screen shown below. When you enter a friend's username, you must also include the Domain name, as in "friend@chat.sprux.net". It looks like an email address, but it's not, it's how contacts are referenced on the server.



Once you have added a new buddy to your list, you have to wait for that person to authorize the connection before you can chat. Pidgin will alert you when you get a response from the person you invited to join your buddy list. Once you have added some contacts to your buddy list, you can chat securely with them by double-clicking their icon in your buddy list window.



Final Notes

There is one other component of this chat system that makes it even more secure: Our server (chat.sprux.net) is configured to not log any acitivity. That means it doesn't ever log chat sessions between users, and it also doesn't keep detailed logs of who logs in and out of the chat server. The ONLY thing it does that is similar to logging is, if you send a message to a friend who is not online when the message is sent, the server will store that message IN RAM until your friend logs in, at which time the message will be delivered. However, because the message is only stored in RAM, and not ever written to disk, this is a very secure way of handling offline chats because RAM is extremely volatile, and once the server loses power or the message is delivered and cleared from RAM, there is no longer any trace of it anywhere on the server. This is different from data that is written to disk, because once data has been written to a file on a hard drive, it can be recovered even after it has been deleted from the disk due to the magnetic nature of computer hard disks. Even if you don't understand this concept, you can be confident that your chat messages on chat.sprux.net are secure and are never logged or stored on our servers in a way that can ever be recovered. Privacy! We have a right to expect privacy when we converse with our friends and family, and this Sprux.net service is here to provide you with a way to ensure secure online communication.

If you have problems or something doesn't work right, you can always email admin@sprux.net for assistance, though we can't promise we'll always have time to get back to you! Happy chatting!