4 ms·
Private messages (next to credentials leak) are another reason for using SSL/TLS.
by n3t 11y ago
Private messages (next to credentials leak) are another reason for using SSL/TLS.
- jordigh 11y agoNo, because you have no guarantee that you're talking to whom you think you are. Private messages still go through the central server, and Eve could be listening on Carol's connection.
- n3t 11y agoYou are right. To be clear, I implicitly assumed that people I talk to wouldn't accept a fake certificate.
- pfg 11y agoMany ircds I'm familiar with include a "<user> is using a secure connection" message in their WHOIS response, so this is easily verifiable. Obviously, it's still not E2E-encrypted, so if you don't trust the ircd, you should use an additional layer that provides E2E encryption.
- wibbler2 11y agoone of the main points of the article is that people don't check fingerprints, and that you should use encryption layered on top of IRC if you want any real privacy
- pfg 11y agoIs there any evidence that IRC users are somehow more likely to accept self-signed SSL certificates? The IRC clients I'm familiar with rely on the OS trust store, just like most web browsers do. To me this seems like saying a webmail site shouldn't use SSL because the recipient might also use a webmailer and happily accept a self-signed certificate and bypass the browser warning. Sure, it's no replacement for E2E crypto, but to me that's a clear case of perfect being the enemy of good.
- blibble 11y agoas an example, irssi from debian jessie doesn't verify the certificate at all, or even display that it's accepted an untrusted certificate (I just tried it)
- tekromancr 11y agoSorry for hijacking this thread to respond to a sibling comment, but I think the original author of this article may be trying to post, but is being flagged.
- darklajid 11y agoYou can (depending on Karma, I think?) vouch for dead comments. I just did for two of the author's comments, I don't think they should be dead at all. 1) The author states that their opinion changed somewhat 2) The author explicitly names a compromised deployment (Freenode). Haven't fact checked that, but that _seems_ like a good argument 3) The architecture of the network (random organizations sponsor servers) seems like a plausible excuse for headaches/complications as far as I'm concerned.
- tekromancr 11y agoIt seems that a mod has come along and remedied the situation. I would have vouched, but I guess I don't have that feature. I don't even have enough karma for down votes, but when I saw what seemed like a high-quality dead comment without a contentious comment history, it only felt right to speak up.