Longer answer: I’m not a cryptographer, but the protocol description and the levels of trust I have for the people who designed the protocol compel me to answer “no, that first exchange was not the key used for encryption” (since OTR uses Diffie/Hellman aka asymmetric aka public-key cryptography for key exchange).

See http://www.cypherpunks.ca/otr/Protocol-v2-3.1.0.html for a high-level description of the steps taken for the Authenticated Key Exchange (AKE) and https://en.wikipedia.org/wiki/Off-the-Record_Messaging#Implementation for an overview of the protection you get with OTR.

It’s not just public crypto – it also provides deniability (i.e. your messages are not digitally signed by you) and perfect forward secrecy (i.e. even successful cryptanalysis of one of your messages does not compromise your other messages).

OTR is pretty serious crypto, with a solid theoretical background and well-respected people implementing and improving the protocol and implementations.

UPDATE: See a more official response from the horse’s mouth:
http://lists.cypherpunks.ca/pipermail/otr-users/2012-May/002006.html

But I noticed on the chat history in browser that even before the first encrypted message is sent, the accounts exchanged some random large string of text and numbers. Much like the subsequent encrypted chats.

My question is: was the first exchange the key used for encryption? Because Google has that text, can they decrypt the chats?

Allow Chrome to save all cookies.
Install CCleaner and go to:

Options–>Settings
and check “Run CCleaner when computer starts” (unfortunately there is no option to delete cookies on shutdown…)

Options–>Cookies
Drag and drop the cookies you want to keep to the corresponding table on the right-hand side. For example: mail.google.com

This will do until someone found a better solution.
Hope it helps…

Please feel free to post this comment to other forums…

Regards,
fox

If one unchecks the “delete cookies when Browser is closed” option, the 2-step verification indeed saves the code, i.e. the problem is clearly not related to apps/estensions, but to the workaround using [*.]google.com: The cookies are not being deleted. However, there must be one single entry within a cookie that gets erased…

Any ideas?
Thanks,
fox

Now look at your cookies – if there is nothing there, the Google accounts cookie is being deleted and that’s why you’re asked for 2-step verification again. You’ll have to figure out what deletes that cookie.

Do post back with results!

I am using Google Chrome and do have the same problem. However, even when I allow the google account cookies to be stored via the exception option, I will have to log in using 2-step verification every single time…
Any idea why this still doesn’t work?

Thanks,
fox

Thanks for the donation, and all the effort it involved! We’re getting towards two-thirds of the target amount now.

Good travels!