5 ms·

I use IRC over SSL to avoid leaking my credentials (e.g. NickServ password). You can certainly assume that at least one person in a given channel is logging or

I use IRC over SSL to avoid leaking my credentials (e.g. NickServ password). You can certainly assume that at least one person in a given channel is logging or on a compromised connection, but that's not the whole point.

m00dy 11y ago
Absolutely, IRC over SSL is not pointless
crystalclaw 11y ago
That, and if you can do it, it's cool.
15155 11y ago
I wonder if some networks provide auth over TLS on the web: - User visits IRC network website - User logs in - User is given a single-use token or command containing a token - User sends token to NickServ - User is authenticated Not invincible to MITM, but at least it avoids leaking credentials in plaintext.
- deleted 11y ago
  [deleted]
- raimue 11y ago
  Many users run a permanent IRC connection with a bouncer or just run irssi/weechat in screen/tmux on a server. There may be occasional reconnects for them due to netsplits etc. Usually they also configure their bouncer/client to automatically authenticate when they connect. Using any sort of authentication involving a separate channel would stop them from authenticating without user interaction. Unless of course it could also be automated. However, I doubt it is easy enough to create a standard for this. If your only goal is to stop leaking the password in cleartext, that could also be achieved using established standards such as SASL or a challenge-response mechanism such as CRAM-MD5.
  - ibotty 11y ago
    Not that CRAM-MD5 is particularly secure.
- kylek 11y ago
  I really love Quakenet's nickserv alternative/bot, Q. It offers a way to do this with a /msg Q CHALLENGE command (https://www.quakenet.org/development/challengeauth https://www.quakenet.org/development/challengeauth ). ZNC (a popular irc bouncer) has a nifty authentication module that utilizes it, too (http://wiki.znc.in/QAuth/Module http://wiki.znc.in/QAuth/Module ).
WallWextra 11y ago
Yeah, it's not like twitter runs https to keep your tweets secret.

m00dy 11y ago

Absolutely, IRC over SSL is not pointless

crystalclaw 11y ago

That, and if you can do it, it's cool.

15155 11y ago

I wonder if some networks provide auth over TLS on the web: - User visits IRC network website - User logs in - User is given a single-use token or command containing a token - User sends token to NickServ - User is authenticated Not invincible to MITM, but at least it avoids leaking credentials in plaintext.

deleted 11y ago
[deleted]
raimue 11y ago
Many users run a permanent IRC connection with a bouncer or just run irssi/weechat in screen/tmux on a server. There may be occasional reconnects for them due to netsplits etc. Usually they also configure their bouncer/client to automatically authenticate when they connect. Using any sort of authentication involving a separate channel would stop them from authenticating without user interaction. Unless of course it could also be automated. However, I doubt it is easy enough to create a standard for this. If your only goal is to stop leaking the password in cleartext, that could also be achieved using established standards such as SASL or a challenge-response mechanism such as CRAM-MD5.
- ibotty 11y ago
  Not that CRAM-MD5 is particularly secure.
kylek 11y ago
I really love Quakenet's nickserv alternative/bot, Q. It offers a way to do this with a /msg Q CHALLENGE command (https://www.quakenet.org/development/challengeauth https://www.quakenet.org/development/challengeauth ). ZNC (a popular irc bouncer) has a nifty authentication module that utilizes it, too (http://wiki.znc.in/QAuth/Module http://wiki.znc.in/QAuth/Module ).

WallWextra 11y ago

Yeah, it's not like twitter runs https to keep your tweets secret.