4 ms·
one of the main points of the article is that people don't check fingerprints, and that you should use encryption layered on top of IRC if you want any real pri
by wibbler2 11y ago
one of the main points of the article is that people don't check fingerprints, and that you should use encryption layered on top of IRC if you want any real privacy
- pfg 11y agoIs there any evidence that IRC users are somehow more likely to accept self-signed SSL certificates? The IRC clients I'm familiar with rely on the OS trust store, just like most web browsers do. To me this seems like saying a webmail site shouldn't use SSL because the recipient might also use a webmailer and happily accept a self-signed certificate and bypass the browser warning. Sure, it's no replacement for E2E crypto, but to me that's a clear case of perfect being the enemy of good.
- blibble 11y agoas an example, irssi from debian jessie doesn't verify the certificate at all, or even display that it's accepted an untrusted certificate (I just tried it)