OWASP Off the record 4 Java Project
Privacy is daily reality for many internet users. Eavesdropping user's content and using it for various reason is not desired by many of the application users. Putting trust on communication channel, service provider or government not to intercept your content is not a good idea.
OTR framework solves this problem by cryptographically processing the users content in transit and at rest. No eavesdropper can read the content, not even the service provider
What is OTR ?
OTR4J stands for off-the-record for Java. end-to-end encryption (off-the-record) is a system of communication where only communicating users can read the messages, neither eavesdropper nor communication facilitator channels can read messages.
OTR4J provides simple framework and prototype that helps developers to easily implement end-to-end encryption into Java application. Example applications are messaging, file transfer, secure information transfer application
Why use otr4j ?
It provides high degree of privacy and security.
How does it work ?
Bob sends message to Alice
OTRClient bobClient = OTRClient.get(config); bobClint.login("bob", "password"); bobClient.sendMessage("Hello Alice", ALICE_USER_ID);
Alice reads messages
OTRClient aliceClient = OTRClient.get(config); aliceClient.login("alice", "password"); aliceClient.readMessages();
Copyright 2016 Jigar Joshi
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
News and Events
APIs for basic functionality is available
Basic client with in-memory storage is provided for reference
Privacy in transit is available
Message authentication and out of the band verification
User authentication for REST
MySQL based message store for server
Configurable toggles are available for various knobs of encryption
How can I participate in your project?
You can participate in project by multiple ways.
Feature Request Raise your feature request here with detailed information
Contribute code Pick an open issue, forkoff the github repository and create PR
Help in awareness One of the quarter goal is to spread awareness. you can help here by mentioning this project in your blog, tweets and through any other media.
If I am not a programmer can I participate in your project?
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers and software developers to help.
I have nothing to hide why should I care for privacy?
Some users have thinking that they have got nothing to hide and they are ok with sharing content. This is too local and narrow perspective to privacy concerns.
The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project contributors is found here. Your name will be recognized here for your help and volunteer work for this project
The first contributors to the project were:
- Jigar Joshi
- Want to see your name here ? Contribute please
Provide ability to strengthen privacy by providing stronger end-to-end encryption in transit and stronger encryption at rest to application developers by simpler API for most of the popular languages
As of March, 2017, the highest priorities for the next 3 months are:
This section will keep on updating
- Get other people to review the Code Project Template and provide feedback
- Better API: Simplify APIs and document them for Java
- Privacy at Rest: APIs for privacy at rest
- Awareness: Get 3 clients using this framework in real life [please let us know by email if you already use it. to keep track of the goal's progress]
Involvement in the development and promotion of OTR4J is actively encouraged! You do not have to be a security expert or a programmer to contribute.
Some of the ways you can help are as follows:
Are you a security researcher, privacy advocate ? help review & audit protocol design and implementation, suggest functional requirement,
Fan of privacy and OTR
Are you a privacy advocate on internet ? liked the project ? Help spreading awareness of this project
Please create the issues for feedback about
- What do like?
- What don't you like?
- What features would you like to see prioritized on the roadmap?
Minimum viable product for this project is a simpler Java API that provides stronger end-to-end encryption in transit and stronger encryption at rest