Ron <fdskljfoiewiorewuokdvsfds@FI74as32etwIOtrFewDS.co m> hath wroth:

>No, I don't want to encrypt the whole chat session, only during logon so
>no one can steal my password. I don't send sensitive data over instant
>messenger so I don't really care if the chat session is in clear text.

Oh. All of them use a challenge-response mechanism, where the actual
password is not sent. Instead a hash code derived from the
combination of the password and some random rubbish is sent. It's
quite safe. At one time, it was possible to crack the AIM password
from a capture file because they used a really crude random number
generator:
http://www.packetstormsecurity.org/Crackers/
Search for various AIM cracking tools.


--
Jeff Liebermann jeffl@comix.santa-cruz.ca.us
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558