Security of Google Talk

The packets are secure from the client to the server via them being encrypted via TLS (ssl's replacement)  and from the server to the other client.
GTalk is based on the Jabber protocol http://www.google.com/talk/about.html#privacy

GoogleDesktop might have something that your looking for, but I'm not sure
http://desktop.google.com/enterprise/about.html#admin
But I don't think there is centralized managment for Gtalk... you might use your own jabber server internally, there are tools for that.

IM typically is a 3rd party service. You sign in to Gtalk, AIM, MSN, and your on-line talking to that services servers, those servers then send your messages to other online buddies/contacts, and since each client initiated the contact to the IM's servers, your not listening for anything other than contact from those servers.
1.2.3.4 on port 45698 connects to (IM sever) 9.8.7.6 on port 443... no one can contact 1.2.3.4 on port 45698 unless their ip is 9.8.7.6... it's called an established session
or a stateful session: http://en.wikipedia.org/wiki/Stateful_firewall
-rich

Email is of course slow and insecure so I am considering Google Talk (IM).

=> You can use PGP encrypton that is a very strong security, but of couse not as fast as intime talk.
http://eu.pgpstore.com/ (Im sure there are also free PGP programs around)

1) how secure/insecure is this?
=> Atm Google talk is beta. Unless its stable I wouldnt recommend it if security is a issue. All over: no system is unbreakable.
Googles business is storing and analyizing data. So they store certain user data (how you configure Google talk, how long you very talking per session, timepoint of using GT, stored contatcs in GT, frequency and size of sent files, communication partner)
All over I didnt find anything they are storing/checking what is spoken over GT.
Sent data are encrypted like in most IM tools.

2) Is there a way that I can control passwords for all of the users?
=> No, Google talk is a single user program.

3) what port does G Talk use and is it always open (listening?) and is that a security risk?
=> As long as GT is open and set to "Online" its listening to GT server. Any programm with a open port to the Internet is vulnerable as soon as a exploit is known. IM programs are in general very secure against exploits (you dont hear a lot of IM exploits).
GT uses default port 5223. If its not working Google recommends port 443. Hacker programs will proably dock on those ports. So its recommandable to change the port to any other ID.

Is there a better way to achieve the same result?
=> Google talk is not better or worse than other IM tools. I have no security issue but Im happy with Skype. Of course they all have some unqiue features others wont have.
There are also providers you can find in Internet offering so called "meeting rooms" but they cost every time you use them and its only good for time based meetings.

As long as the dentist have http://www.experts-exchange.com/images/submitButton.gifa PC with unprotected customer dathttp://www.experts-exchange.com/images/submitButton.gifa on it online, they will not be less with a proved IM tool.

Oh, I just saw that PGP also offers IM encryption. You got more infos on the link above.

Hope I could help
Tayger

Are the employee's of this dental office going to use gTalk to relay protected health information over the network? If so then I you can't recommend that solution to your client. When you are dealing with HIPAA you have to be vigilant about the protection of the patient information. These are the issues I see with doing this.

1. Everyone has to create a google mail account. There is no mass password tool to facilitate this. You are at the mercy of your users using simple passwords.
2. Google by default turns on chat history. This means that patient information will be stored on google servers and is forever searchable by you.
3. Being that your data has now been stored by google you have lost control of the data. If an employee quits or is terminated they have permanent access to this information.

Just think of the ramifications of a disgruntled employee having access to this data once they've been terminated. They could then start an investigation into your clients HIPAA practices. With $10k per day fines per area of non-compliance that could really add up when they have blatant proof of your non-compliance.

If inner-office communication is a priority then I would recommend running a Wildfire server. This is based off of Jabber which is the same protocol that gTalk uses. You can use encryption which would be preferable. Best of all the data stays within your network!!

http://www.jivesoftware.org/