3 ms·
> If a client just automatically accept self-signed certificates, its just snake oil. It forces attackers to use a active attack rather than a passive one. Whi
by a1369209993 6y ago
> If a client just automatically accept self-signed certificates, its just snake oil.
It forces attackers to use a active attack rather than a passive one. Which is the only security most IRC can have anyway, since the attacker could just join the channel and listen in that way, since most IRC networks are public.
- Fnoord 6y ago> It forces attackers to use a active attack rather than a passive one. The MITM or eavesdrop can happen on a bridge. If the client doesn't check the certificate and accepts any, its about as good as plaintext. It could be worse, even, due to the false sense of security. > Which is the only security most IRC can have anyway, since the attacker could just join the channel and listen in that way, since most IRC networks are public. IRC network private or public is irrelevant. There were, for sure, private channels back in the days (90s). Back then you could set a channel secret (hidden) and set a password on it, effectively making it a private channel (would not show up in /whois or /list). Bots could kick people who are unknown based on filters. For example, without an auth to an Eggdrop, you could get insta kickbanned even _with_ the correct password. Then there's PMs which are one on one (except for server(s)). If one of the IRC servers is compromised though (or tapped, or whatever), that makes sniffing a channel or PMs child play. There's also the problem of data integrity. If you are asking for (or giving) help in #linux and someone can change the data on the fly, [...] FWIW, UnrealIRCd, even back then, innovated (or invented) a lot of new features on top of IRC. Some of these added security, though I don't know examples out of my head.