Technical blog and writings by Micah Webner.

Instant Messaging - Friend or Foe?

I was recently asked about installing instant messaging clients to allow young teens and pre-teens to join the online chat community. The main question was whether or not the client software was safe. This entry is my response to the question, because I don't think this question holds a simple answer. In today's Internet culture, safety has many different meanings. Because there are unpleasant people who would like to exploit vulnerabilities in our software, there are certain things we need to do to keep our computers safe. However, we also need to remember that there are things that we need to do to keep ourselves and our children safe from real-life threats that can be introduced or expanded by our Internet activities. And finally, there are the intangible threats to our social development and well-being. Like, for example, I really should be in bed so I can get up well in the morning and not be a grump at my daughter's last soccer game tomorrow morning. Then again, this answer has already been long-delayed, and I probably won't finish this post tonight. (note: I didn't. Post finished three days later.)

Personal Safety

I want to talk about the real-life risks first. It's easy to get our perspectives skewed in this area. Bruce Schneier recenly blogged about Rare Risk and Reaction to remind us of how we sometimes (with the help of the press, of course) tend to overreact to isolated incidents. He frequently links to articles demonstrating that we usually get the risks wrong.

The fact is that most children are attacked by people they know. The thing to remember in this context is that instant messaging can be a way for potential perpetrators to get to know children. The sheriff's offices in Southeast Michigan are doing a brisk business arresting adults who though they were meeting up with 14 year olds they'd found on the Internet, when in fact they had been communicating with law enforcement officers. However, it would be foolhardy to believe that they caught them all.

So does that mean that we should keep our children off of the Internet? Of course not. But we must be aware of the risks, and must also do our best to make our children aware of the risks.

I'm going to jump aside for a minute and mention what I like about Facebook. The Facebook site is structured to enable connections with people you know, or have reason to know through association, rather than just having random people come up and try to "friend" you. It's not foolproof, I'm sure, but the fact that the emphasis is on people you know in real life is a good thing.

The Internet, and instant messaging, is not really a safe place for underage people to meet new people. It's too easy for anyone to be pretending. Heck, it's hard enough to figure out with people you do know. (If you're not familiar with it, check out Eleventyseven's song, myspace.) I have it on good authority that one fine upstanding teen I know had, at one point, developed an entirely new online persona. I don't know any of the details. I'm not surprised that he's smart enough to do it, but I was a little surprised that he'd actually done it.

So parents need to monitor their kids' online activities and relationships. And they need to talk to their kids about not meeting people online, and definitely not to make arrangements to meet those people in real life. I found some really good articles about this a couple of years ago, and emailed the links out at the time. While the Register article kinda pokes fun at the quality of the attempt, Microsoft has posted some information designed to help parents understand the online language kids use to hide their activities. The first MSNBC article tells of a 14-year-old girl who had an online affair with a 35-year-old man right under her mother's nose, and a twelve-year-old with several adult online personas who carried on an elaborate charade for three years. Not really pleasant articles, but probably something most parents should read. The last two links provide additional resources.

L33tsp34k for the Luddite Classes

MSNBC - Teens' online lingo leaves parents baffled

MSNBC - What you don't know can hurt kids

A parent's primer to computer slang

Wired Safety

Chat Translator

Messaging Software and Computer Safety

While I'm not completely aware of all of the details, I know that there are some security risks involved with instant messaging and IRC (Internet Relay Chat) clients. Most IM and chat clients allow users to send files to each other, and this creates the opportunity to send viruses. Most of these should be stopped by having current antivirus on your machine and by using wise setups for file transfer within IM. For example, on AIM and GoogleTalk, I would set it to make the user confirm before friends send files, and don't accept files from strangers at all.

There are also some viruses and other malware out there that will do buddy list poisoning and other shenanigans, I think even stealing buddy list content so they can spread easier.

Trust comes in different levels. Get to know your friends' data habits. Trusting someone as a friend and possibly even close confidant does not automatically make them trustworthy when it comes to Internet security. I used to walk to school every morning with one of my best friends. Every day, he could not find his shoes when it was time to leave. He's a great guy (and a doctor now) but if we had Internet access back then, I probably wouldn't have trusted him to set strong passwords or to check files thoroughly before forwarding them. That's where you have to be wary about files being transferred over email, or over IM, or direct connect on IRC.

Selecting Software and Service Providers

So, what instant messaging service should you use, and what is this IRC stuff I keep mentioning? I'll take the latter first.

IRC is Internet Relay Chat. It is older than many other services on the Internet, including IM and the web. IRC is less used for personal one-to-one chatting and more for a group setting. There are several public server networks out there, and it is not that hard to set up a private or semi-private server, either. IRC is not as popular as it once was. It's probably used more by geeks (myself included) and is often used as a communications method for viruses, which makes it somewhat suspect to many network administrators.

Many good IRC clients exist in the Linux world. There are a couple in the Windows world, including mIRC, which I've never really used. One of the best was probably Microsoft Comic Chat, though it probably wasn't really ever accepted by "true" IRC users. Windows users can now use IRC via some of the multipurpose clients I'll mention below.

When AOL came on the scene in the 90's, they offered instant messaging as part of their service. (As did most of the other big dialup services that slightly predated the Internet boom.) Once the Internet boom was in full swing, AOL split their instant messaging out to form AOL Instant Messenger, or AIM. From what I can tell, AOL bought ICQ, which was also a pretty popular instant messenger at the time, to use as the foundation for their messaging protocol. ICQ is still around in its native form, but has become far less popular.

Other systems, including Yahoo! Messenger and MSN Chat came on the scene. MSN Chat was an IRC-based system that was later dissolved and replaced with tools like MSN Messenger, which ships with every copy of Windows and integrates with Windows Live services. The Jabber protocol came on the scene, and was adopted by Google to create Google Talk. There are many systems available. From what I have seen, the largest are those that combine with the other service offerings from AOL, Yahoo!, Microsoft and Google.

So how do you choose? I think the most likely approaches are services you know, and people you know. If you came onto the Internet scene as an AOL user, you are more likely to use AIM. If you have adopted Yahoo! or Google for your services, you may tend towards those. On the other hand, if everyone you know is already using AIM, then you would obviously tend towards selecting that service.

I have used IRC for a long time, and run a semi-private IRC server to host weekly family chats. We have been doing this for at least six years, possibly longer. I added AIM when it was requested by one of our vendors at work. I added Google Talk when it became available, as I already had a GMail account by that time. I added MSN to talk to some other church friends who use that service. I have a Yahoo! account so I can upload photos to Flickr, but don't really have anyone on Yahoo! to chat with. So what do I do? Run four different chat clients?

No, and not just because I got so irritated loading the latest AIM client that I deleted it, but that helped. Unless you enjoy suffering, I would recommend NOT loading AIM's client. Go sign up for an account, then download one of the all-in-one clients.

There are probably numerous clients out there that will talk to all of the services I've mentioned. I've only tried two. I tried Trillian, but it really didn't do it for me, so I decided to also try Pidgin. (It was actually still called gaim when I first installed it, but has since been renamed.) I am very happy with Pidgin, and use it to contact to multiple services simultaneously.

Time Leech and Social Development

No discussion of instant messaging safety can be complete without at least mentioning this aspect. Participation in online communities can be a healthy and useful extension of an active and vibrant social lifestyle. Over the years, online communities have given me unparalleled access to my peers in network administration, live sound, and other areas where I would otherwise have been on my own to learn things and grow. However, the Internet is an addicting place, and I've seen some evidence of changed behavior in the real world as a result of online activities. My boss was talking about his teenage daughter, who can carry on five IM conversations at the same time, but can only cope with having one friend over at a time. At least she still spends some time with her friends. On the flip side, I've seen my cousin's daughters seem to have found a healthy blend. They are very active online, but still hang out with friends, have goofy (in a good way) theme parties and do things besides sit at the computer. If they read this, I'd welcome their comments to this post.

So, in conclusion, instant messaging can have its dangers, but it can also be a good part of life. For young people, parental guidance and monitoring is key, just like any other Internet or social activities. I'm no expert on this topic, and I may have gotten some things wrong, or backwards, but these are my observations. Am I ready to let my daughter have that IM account she's asked about? I'm not sure. Maybe she should read this, and then we'll talk.