IChat with MobileMe + AIM, SSL

Question

I posted this some days ago in the MobileMe forum. I got no answer there, but I think this one should be the more appropriate place to ask about an iChat issue...
One of the potential benefit of setting up a MobileMe account in iChat is the fact that one can have an encrypted audio/video chat. Which is great.
However, there's a quirk, in my view. If I understand correctly, Apple creates and maintains an AIM account (on AOL servers) which has the same ID and the same password of the MobileMe account: which is not so great, but let's go on.
When setting up a new account (of the "MobileMe" kind), iChat, by default, connects with the AIM server without using ssl. This has nothing to do with the audio/video chat which could follow: this is just the initial authentication on the AIM server, and if I'm not mistaken the MobileMe password is sent in the clear. So it's all good and well to have ssl by default on www.me.com, but if you configure a MobileMe account in iChat you send out your password to potential eavesdroppers.
Is this the case?
Please note that I know that I can force ssl in the iChat options. What I'm pointing out is only that this is not the default behaviour.
Moreover, the first connection is made by iChat immediately after having entered the MobileMe username, without waiting for an explicit user command. Even if you do not enter your MobileMe password, iChat gets it from your keychain.
In other words, it seems to me that configuring a MobileMe iChat account implies sending out your MobileMe password at least once unencrypted, unless some convoluted tactics are adopted to stop iChat from connecting.
Is this the case?
I hope someone could confirm or (better) tell me I'm wrong here.

Answer 1

Hi,
On the issue that Apple Creates the AIM Accounts for you.
I have only found this in one Apple Document which suggested the same by the way it was worded.
Due to the fact if the Mobileme (Or @mac.com servers) go down iChat or any AIM app cannot check your password and sign you in the process if obviously different.
It seems that in all cases where AIM have agreements with Service like Apple or ISPs that their servers can check the names and passwords at the various servers involved
The other thing about this is that Apple allow passwords longer than 16 characters.
Using the first 16 characters only does not work which would be the simplest way the method you suggest would be used.  (you have to change your password)
I have done a partial test of your other issues.
I Opened my iChat Preferences and created a New account and chose MobileMe
I did not enter a password and clicked Done.
At this point iChat displayed a Buddy List and immediately a Dialogue  box asking for a Password.
Like the name I chose something fairly random. The Save to Keychain was not checked.
On Pressing OK the Dailogue box reappeared with the Save to Keychain ticked. I dismissed it.  (I checked the Keychain later and it was not Saved there)
In Accounts I went to the Server Setting tab.
It was set up wihout SSL being On.
That needs to be reported here http://www.apple.com/feedback/ichat.html  (And have further testing with a registered name)
In all my other accounts I have set up in iChat no Buddy List Window has appeared, saying it is Connecting, until I have pressed the Done Button.
I also know that if you delete the com.apple.ichat.AIM.plist and then restart iChat then your Accounts info is pulled back from the Keychain.
Deleting com.apple.ichat.plist and com.apple.ichat.AIM.plist will cause the Start Up Screens to reappear
This in the AIM options the "first" AIM valid Login details will be Prefilled.
From this I can see that if you have a MobileMe Name and it is use on your Mac somewhere then entering it in iChat may cause the password to be "collected" from the Keychain.
You can still decided to remove it before pressing Done.
The Account will not even try to log on until you have pressed the Done Button.
I tried also to set up an AIM name (I happened to have one not used on this computer)
This did not have the password in the Keychain for any other purposes so it was not pulled up.
The Buddy List did not appear until I pressed Done.
In fact the Add Account pane had closed and the Buddy list said Connecting before Little Snitch told me iChat was connecting to AIM (Again).
This means at no point did my fictitious @Me.com name Buddy List actually make contact with the AIM servers
I checked the Server Settings for this Account and this was a NON SSL login as well.
This surprised me as I seem to remember that the default was for SSL to be Enabled on it's introduction via Upgrade from iChat 3 (I am using iChat 4 on this computer).
You do seem to raise some valid concerns.
I have yet to test in iChat 5.
You should use the feedback site to raise these further.
10:33 PM      Saturday; June 4, 2011
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb( 10.6.7)
 Mac OS X (10.6.7),
"Limit the Logs to the Bits above Binary Images."  No, Seriously