4 ms·
I wonder if some networks provide auth over TLS on the web: - User visits IRC network website - User logs in - User is given a single-use token or command co
by 15155 11y ago
I wonder if some networks provide auth over TLS on the web:
- User visits IRC network website
- User logs in
- User is given a single-use token or command containing a token
- User sends token to NickServ
- User is authenticated
Not invincible to MITM, but at least it avoids leaking credentials in plaintext.
- deleted 11y ago[deleted]
- raimue 11y agoMany users run a permanent IRC connection with a bouncer or just run irssi/weechat in screen/tmux on a server. There may be occasional reconnects for them due to netsplits etc. Usually they also configure their bouncer/client to automatically authenticate when they connect. Using any sort of authentication involving a separate channel would stop them from authenticating without user interaction. Unless of course it could also be automated. However, I doubt it is easy enough to create a standard for this. If your only goal is to stop leaking the password in cleartext, that could also be achieved using established standards such as SASL or a challenge-response mechanism such as CRAM-MD5.
- ibotty 11y agoNot that CRAM-MD5 is particularly secure.
- kylek 11y agoI really love Quakenet's nickserv alternative/bot, Q. It offers a way to do this with a /msg Q CHALLENGE command (https://www.quakenet.org/development/challengeauth https://www.quakenet.org/development/challengeauth ). ZNC (a popular irc bouncer) has a nifty authentication module that utilizes it, too (http://wiki.znc.in/QAuth/Module http://wiki.znc.in/QAuth/Module ).