3 ms·
So his reasoning is that they didn't implement SSL because SSL can be broken my accepting invalid certificates. It seems true that the payoff is higher for a s
by RealityVoid 11y ago
So his reasoning is that they didn't implement SSL because SSL can be broken my accepting invalid certificates.
It seems true that the payoff is higher for a successful MITM for IRC than a normal website, but such a MITM is far from guaranteed to happen.
Saying that such or such method of protection can be broken so it shouldn't be implemented means we shouldn't implement _any_ security measure - since there is not one 100% secure measure.
- dmix 11y agoI believe the distinction here is there would still be security against a passive attacker, just not an active one (via MITM or man-on-the-side). Which is what makes it worthwhile IMO as MITM is noisier than passive collection.
- blibble 11y agono, the reasoning is because it's more than two people, any third person can break the security by accepting an invalid cert, and the others who were careful have no way of knowing that their communications are compromised. given IRC is mostly about channels, this renders TLS mostly pointless for IRC. (TLS works fine with two endpoints communicating directly... mostly, it's still a kitchen sink protocol that probably needs replacing)