1641714 - Move all chat OTR strings to the localization area

Status: RESOLVED FIXED

(Chat Core :: Security: OTR, enhancement)

Description

[Kai Engert (:KaiE:)]

String freeze for TB 78 is in a few days.
If we want the OTR strings in TB 78 to be localized, we must move the strings over from content to locales/en-US now.

Comment 1

[Kai Engert (:KaiE:)]

Attachment: Bug 1641714 - Move all chat OTR strings to the localization area and improve the text. r=mkmelin,kaie,wsmwk

Comment 2

[Kai Engert (:KaiE:)]

https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=2504a8b78298b98b697d0bd1867cd2adf59025cf

Comment 3

[Magnus Melin [:mkmelin]]

Attachment: bug1641714_otr_string_fixes.patch

Wayne, do you have a moment to give these changes a native-speaker check?

Comment 4

[Kai Engert (:KaiE:)]

Comment on attachment 9152656 [details] [diff] [review]
bug1641714_otr_string_fixes.patch

The changes are correct technically.

I wasn't sure about the use of the term surveillance, because in order to attack, more than just "passive" surveillance attempts are required. A Monster-In-The-Middle (MITM) must actively manipulate the exchanged data to break the verification. However, performing such an attack is an attempt to apply surveillance to the encrypted connection, so your description of the situation seems acceptable.

Comment 5

[Kai Engert (:KaiE:)]

I've applied the changes to the patch in phabricator.

Keeping the attached patch here for Wayne's convenience.

Comment 6

[Magnus Melin [:mkmelin]]

Yes, that's what I'm trying to convey. A naive reading of verification can not infer how verifying and encryption hang together. "But I'm chatting with him right now, he sounds just like normal. Must be him."

Comment 7

[Wayne Mery (:wsmwk)]

Comment on attachment 9152656 [details] [diff] [review]
bug1641714_otr_string_fixes.patch

"surveillance" seems appropriate.  And generally good wording.   Some nits:
* in two places, "as well" can be removed from "wait for your contact to enter it as well."
* "both" is redundant in "You should both tell", unless you have added it for emphasis
* I would use "Do not" at "Don't use the same Internet connection"
* "fingerprint" is used in several locations.  Will all users know exactly what that is, and what it means in the context of this process?  Or are additional words needed to clarify?  

Onno, do you have any thoughts on the text https://bugzilla.mozilla.org/attachment.cgi?id=9152656&action=diff

Comment 8

[Kai Engert (:KaiE:)]

I agree that we should explain the term "fingerprint" at least once. Looking at the UI, the following string might be a good place to do so, as it's the one place where we need a confirmation as part of an action.

With Wayne's suggestion from comment 7, how about this:

auth-manualInstruction = Contact your intended conversation partner via some other authenticated channel, such as OpenPGP-signed email or over the phone. You should tell each other your fingerprints. (A fingerprint is a checksum that identifies an encryption key.) If the fingerprint matches, you should indicate in the dialog below that you have verified the fingerprint.

Comment 9

[Kai Engert (:KaiE:)]

Magnus, there's one change that I'm not completely happy with.
You changed "Purported fingerprint" to "Implied fingerprint".

The scenario is, we receive a key with the given fingerprint, and it may or may not be the correct key. But that's what we "see".
I think "imply" doesn't explain that well.

(FYI this string is shown below the message from comment 8, and we show it in addition to the user's own fingerprint with label "Fingerprint for you, <your-chat-ID>:".)

I have two suggestions:
either

• use "Observed fingerprint for <contact-chat-ID>"
  or
• drop the term, and simply use "fingerprint for <contact-chat-ID>"

Comment 10

[Kai Engert (:KaiE:)]

Comment on attachment 9152656 [details] [diff] [review]
bug1641714_otr_string_fixes.patch

Onno I have added Wayne's suggestion in phabricator. To see the latest proposal please see https://phabricator.services.mozilla.com/D77375

Comment 11

[Onno Ekker [:nONoNonO UTC+1]]

I'm not familiar with off-the-record messaging, but overall the strings look good to me.

Comment 12

[Magnus Melin [:mkmelin]]

(In reply to Kai Engert (:KaiE:) from comment #9)

• drop the term, and simply use "fingerprint for <contact-chat-ID>"

I think this is fine. I just thought

• purported was a strange word
• it's not the fingerprint that is purported, it is this fingerprint. It's just who that fingerprint belongs to that we don't know.

Comment 13

[Kai Engert (:KaiE:)]

I've removed the word "observed" in phab.

Ok to land?

Comment 14

[Kai Engert (:KaiE:)]

ok you accepted thanks

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/cfaf20a2e428
Move all chat OTR strings to the localization area and improve the text. r=mkmelin,kaie,wsmwk