4 ms·

This doesn't protect users from snooping by the IRCD admin, which is what e2e encryption/p2p chat is about -- removing the ability of the service provider to se

This doesn't protect users from snooping by the IRCD admin, which is what e2e encryption/p2p chat is about -- removing the ability of the service provider to see the content of the private messages between users. IMO IRCD in no way qualifies as "encrypted p2p chat".

Tharkun 9y ago
Plenty of OTR-like plugins for your IRC client of choice. IMO IRC is still the best chat experience.
walrus01 9y ago
I was describing more of a multi person chat (not p2p) for company internal use , such as an irc channel with ten or fifteen people. Much harder to do proper forward-secure crypto for one-to-many messages. If you run and control your own ircd the risks of snooping by the ircd admin are about the same as if you unknowingly have a rootkit/advanced peristent threat installed on your end point client workstation.
ken 9y ago
That's why I said it may or may not qualify. What's the threat model? What's the usage environment? (It's "encrypted p2p" between two users if one of the users is also the admin.) For example, if the purpose of this requirement is to keep a business team's communications out of the hands of other businesses, then local IRC+SSL accomplishes that, even though the local administrator can still snoop on it. Being able to say that company secrets never left the company was a big hit with our investors, and it didn't matter that it was technically possible for our sysadmin to snoop on them because he had physical access to all our workstations anyway. If you don't have a trusted administrator, all is not lost. Each user can run their own ircd on the same VPN. It's less convenient to set up but any IRC client can handle multiple servers. Again, it depends on your requirements. (Are there 5 users, or 5000?) Like any other technology, IRC can be used as part of a secure system. It has the advantage that it's free and easy to run yourself. Without knowing more context, though, it may or may not be practical.

Tharkun 9y ago

Plenty of OTR-like plugins for your IRC client of choice. IMO IRC is still the best chat experience.

walrus01 9y ago

I was describing more of a multi person chat (not p2p) for company internal use , such as an irc channel with ten or fifteen people. Much harder to do proper forward-secure crypto for one-to-many messages. If you run and control your own ircd the risks of snooping by the ircd admin are about the same as if you unknowingly have a rootkit/advanced peristent threat installed on your end point client workstation.

ken 9y ago

That's why I said it may or may not qualify. What's the threat model? What's the usage environment? (It's "encrypted p2p" between two users if one of the users is also the admin.) For example, if the purpose of this requirement is to keep a business team's communications out of the hands of other businesses, then local IRC+SSL accomplishes that, even though the local administrator can still snoop on it. Being able to say that company secrets never left the company was a big hit with our investors, and it didn't matter that it was technically possible for our sysadmin to snoop on them because he had physical access to all our workstations anyway. If you don't have a trusted administrator, all is not lost. Each user can run their own ircd on the same VPN. It's less convenient to set up but any IRC client can handle multiple servers. Again, it depends on your requirements. (Are there 5 users, or 5000?) Like any other technology, IRC can be used as part of a secure system. It has the advantage that it's free and easy to run yourself. Without knowing more context, though, it may or may not be practical.