Hacker News Reader

After seeing "off the record" chats synced across browser sessions a few times, I became convinced that Google was storing the chat session on its servers at least temporarily. I can't help but wonder if this is just a way to remind people that "off the record" really isn't, and nobody should be relying on that particular property.

View on HN

The correct way is for google to be storing encrypted off-the-record chat messages, decrypted by the client in javascript (or however the android client would do it). That way, Google would be able to persist chat history across devices if they share keys, but the stored ciphertext is useless to them.

Do we know if they're doing that?

They're almost certainly not doing that. That would be extremely difficult to implement in a way that works in regular browsers without special plugins and is still secure.

Reply on news.ycombinator.com