#854773 hexchat-otr: /ME messages sent without OTR

Package:
hexchat-otr
Source:
hexchat-otr
Description:
hexchat plugin to support Off The Record (OTR)
Submitter:
Joonas Kylmälä
Date:
2026-10-29 18:12:29 UTC
Severity:
important
#854773#5
Date:
2017-02-10 08:20:22 UTC
From:
To:
Dear Maintainer,

I was using the hexchat OTR plugin. After connected with a person via
OTR the messages were sent encrypted just fine but then I decided to
use IRC's /ME command and send a message with that and the message was
not encrypted with OTR. There was no warning about that the message
would have been sent unecrypted and some confidential information
could have leaked. If it is not possible to encrypt /ME messages with
OTR maybe there is possibility to give a warning to the user before
sending the message?

Regards,
Joonas Kylmälä
#854773#10
Date:
2017-02-10 13:27:55 UTC
From:
To:
I think this should be severity:important. If encryption is not working as
expected, this has a major impact on the privacy of the user of this package…

It is surely possible to encrypt "/me"-messages with OTR.
Funnily irssi-plugin-otr (or was it pidgin-otr) once had the same bug and it
got fixed.