Hacker News Reader

When would you use FB chat and care about the privacy of the communication?

At work, probably.

This includes the login I guess...

can someone confirm that login info is sent in the clear? that's pretty terrible.

yep. they could have at least supported SASL to have the login info encrypted and then transport the rest of the stream unencrypted, but they did not.

They claim they're using DIGEST-MD5, so not quite plaintext, but a broken hash algorithm

http://www.facebook.com/help/?faq=16742

http://www.facebook.com/help/?faq=16741

When I am using a real Jabber client.

Where does it say SSL/TLS is not supported?

When you try to connect with "Require SSL/TLS" enabled.

Just check the instructions for iChat it clearly says to uncheck SSL.

Has the AJAX-based chat built into the web application ever been encrypted?