2012/2/25 Dimitris Glynos <dimitris@xxxxxxxxxxxxxxx>: > Pidgin transmits OTR (off-the-record) conversations over DBUS in > plaintext. This makes it possible for attackers that have gained > user-level access on a host, to listen in on private conversations > associated with the victim account. Basically, you're saying that if I have the rights of a user on a machine, I can access the private conversations of that user? Ooooh no. Well, I can also copy his keyfiles, no? And I can alter his settings. And spawn fake "Update didn't work, please enter root password to proceed" windows. I could alter his ~/.bashrc so that whenever he launches "sudo" or "su", a script is launched instead that grabs his password. So, please, what's the point?
