4 ms·

Many ircds I'm familiar with include a "<user> is using a secure connection" message in their WHOIS response, so this is easily verifiable. Obviously, it's stil

by pfg 11y ago

Many ircds I'm familiar with include a "<user> is using a secure connection" message in their WHOIS response, so this is easily verifiable. Obviously, it's still not E2E-encrypted, so if you don't trust the ircd, you should use an additional layer that provides E2E encryption.

wibbler2 11y ago
one of the main points of the article is that people don't check fingerprints, and that you should use encryption layered on top of IRC if you want any real privacy
- pfg 11y ago
  Is there any evidence that IRC users are somehow more likely to accept self-signed SSL certificates? The IRC clients I'm familiar with rely on the OS trust store, just like most web browsers do. To me this seems like saying a webmail site shouldn't use SSL because the recipient might also use a webmailer and happily accept a self-signed certificate and bypass the browser warning. Sure, it's no replacement for E2E crypto, but to me that's a clear case of perfect being the enemy of good.
  - blibble 11y ago
    as an example, irssi from debian jessie doesn't verify the certificate at all, or even display that it's accepted an untrusted certificate (I just tried it)
tekromancr 11y ago
Sorry for hijacking this thread to respond to a sibling comment, but I think the original author of this article may be trying to post, but is being flagged.
- darklajid 11y ago
  You can (depending on Karma, I think?) vouch for dead comments. I just did for two of the author's comments, I don't think they should be dead at all. 1) The author states that their opinion changed somewhat 2) The author explicitly names a compromised deployment (Freenode). Haven't fact checked that, but that _seems_ like a good argument 3) The architecture of the network (random organizations sponsor servers) seems like a plausible excuse for headaches/complications as far as I'm concerned.
  - tekromancr 11y ago
    It seems that a mod has come along and remedied the situation. I would have vouched, but I guess I don't have that feature. I don't even have enough karma for down votes, but when I saw what seemed like a high-quality dead comment without a contentious comment history, it only felt right to speak up.

by pfg 11y ago

wibbler2 11y ago

one of the main points of the article is that people don't check fingerprints, and that you should use encryption layered on top of IRC if you want any real privacy

pfg 11y ago
Is there any evidence that IRC users are somehow more likely to accept self-signed SSL certificates? The IRC clients I'm familiar with rely on the OS trust store, just like most web browsers do. To me this seems like saying a webmail site shouldn't use SSL because the recipient might also use a webmailer and happily accept a self-signed certificate and bypass the browser warning. Sure, it's no replacement for E2E crypto, but to me that's a clear case of perfect being the enemy of good.
- blibble 11y ago
  as an example, irssi from debian jessie doesn't verify the certificate at all, or even display that it's accepted an untrusted certificate (I just tried it)

tekromancr 11y ago

Sorry for hijacking this thread to respond to a sibling comment, but I think the original author of this article may be trying to post, but is being flagged.

darklajid 11y ago
You can (depending on Karma, I think?) vouch for dead comments. I just did for two of the author's comments, I don't think they should be dead at all. 1) The author states that their opinion changed somewhat 2) The author explicitly names a compromised deployment (Freenode). Haven't fact checked that, but that _seems_ like a good argument 3) The architecture of the network (random organizations sponsor servers) seems like a plausible excuse for headaches/complications as far as I'm concerned.
- tekromancr 11y ago
  It seems that a mod has come along and remedied the situation. I would have vouched, but I guess I don't have that feature. I don't even have enough karma for down votes, but when I saw what seemed like a high-quality dead comment without a contentious comment history, it only felt right to speak up.