7 ms·

IRC Server as Tor Hidden Service on OpenBSD

93 points by ecliptik 4y ago

drKarl 4y ago
It's hidden, but is it encrypted?
- bawolff 4y ago
  All hidden services encrypt the connection (its part of the tor protocol), so yes.
  - jazzyjackson 4y ago
    In case the parent meant "end to end" encrypted, no, of course the IRC server can see all the messages, but if you're the one setting up the chatroom for you and your friends, it's a bit of a moot point, the chat will be encrypted and anonymous as far as anyone outside the chat is concerned.
    - hkt 4y ago
      Various IRC clients have OTR plugins though, for the truly paranoid: https://irssi.org/documentation/help/otr/ https://irssi.org/documentation/help/otr/ https://github.com/onezero1/xchat-otr https://github.com/onezero1/xchat-otr There's more listed here from the people who built and designed the libraries: https://otr.cypherpunks.ca/software.php https://otr.cypherpunks.ca/software.php NB, OTR is old and I can't vouch for its crypto, do your research if for some reason you're connecting to an irc server with a hostile admin where you absolutely have to exchange compromising information. (Duh)
      - upofadown 4y ago
        OTR is inherently 1 on 1. Any idea how you can make it work for group discussions?
        blueflow 4y ago
        Nobody on IRC uses OTR, people just talk unencrypted, trusting the server. It isn't that bad tho when its your friends IRC server.
        Eupraxias 4y ago
        Exactly. People should use IRC as a tool for communications that don't really need encryption. If you are someone's high-value target, don't use IRC.
        bawolff 4y ago
        I think the point is more - there is no point end to end encrypting if the middle man (the irc server) is also part of the conversation (your friend). encryption cannot protect you from the person you are talking to only from the people trying to evesdrop.
        hkt 4y ago
        I've used it to talk to people in the past. It is uncommon but not unheard of.
- sedatk 4y ago
  I don't know why you were downvoted, I had the same question. Port 6667 means to me that it's plaintext, but it looks like hidden services don't have the "exit node leak" problem clients have with plaintext protocols because they're not involved in the traffic with the hidden services. It looks like the traffic's encrypted all the way.
rawoke083600 4y ago
Man I wished we can go back to IRC, compared to the shitshow that is discord ! Slow client, stupid login circle-jerks, desktop-clients-vs-webclient and and and. Yea yea I'm old, but dammit in "my day", it was easier to communicate and the "tech" didn't get in your way. IRC was basically a "done product" and new features were usually spearheaded via "scripts" from users with a need. It seems the "new features" in discord are product-managers trying to justify their job and keep adding feature-upon-feature and making it more of a xmass-tree-met-a-coder-on-crack situation ! I wished there was a product manager (I'm looking at you Spotify, netflix etc) that said, ok these next few quarters we are going to reward ourselves for 'REMOVING Features'. We need the area of "Bring your own client" to really take off. Ok i'm done venting (one should not comment before coffee on HN) :P
- qzx_pierri 4y ago
  I miss IRC too, but I don't miss the doxxing and DDoS nonsense. I don't have to setup a znc bouncer to connect to Discord. I don't have to take any precautions. It just works. I hate the client though, so I feel you on that. The lack of terminal integration with Discord is painful.
  - foodstances 4y ago
    That is mostly solved with ChanServ and NickServ services. Channels can't be taken over with DDoSes because ChanServ protects them and attackers can't get your real IP because NickServ provides host masking.
    - hericium 4y ago
      It's such a shame IRCnet refused to adopt services.
    - k__ 4y ago
      Wasn't that already a thing in 2001? I was on euIRC and basically "grew up" with those services.
anthk 4y ago
Not a bad guide. However, never, EVER change your root login shell in OpenBSD. You've just opened a can of worms. Set up doas for that, and keep using zsh as your regular user if you want. Simple /etc/doas.conf: permit :wheel Use nvi from packages (it's nvi2 actually, base vi it's nvi) instead of nvim, much faster. It's basically base vi with UTF-8 support. Run :exusage and :viusage from within nvi. Also, my ~/.exrc: set showmode ru ts=2 set sw=2 set iclower
- hsbauauvhabzb 4y ago
  What’s bad about the root shell?
  - eurasiantiger 4y ago
    If you change it and for whatever reason it doesn’t work, you will be unable to login as root and the only way to fix it is to reboot into single user mode on a local console. Not exactly the best of things if your machine is not in the same room with you.
  - mingus88 4y ago
    In addition to what eurasiantiger said, it's been a best practice for decades to keep the root environment default and untouched. At a behavioral level, you don't want to make root's environment so comfortable that you use it more than you should. By keeping it vanilla /bin/sh you encourage admins to log off and do their usual work in their usual environment. At a technical level, as soon as you start customizing the root env you open a lot of doors for dynamically linked dependencies to whatever shell+goodies you switch to, which expose root to potential vulnerabilities. You also increase the risk that updates will break root in some obscure way, which will not have been tested by the OS Q/A process.
PetitSasquatch 4y ago
There's one important step missing from the guide, for newcomers to OpenBSD anyway: man afterboot
mwest 4y ago
Thanks for the guide! I've always felt setting up the server is the easy part. The more complicated bit is setting up the clients, especially for friends who aren't as tech savvy, or just don't want to bother figuring out all the moving parts. I see you mention client setup in passing at the end, but do you have a suggestions for a more complete guide for setting up things client-side? I've yet to find one.
Gigachad 4y ago
Sounds like a massive pain in the ass for just messaging friends. Both IRC and Tor are pretty mobile hostile. Would be much more practical to use an end to end encrypted IM platform on the clearnet. Matrix fits pretty well here. That said, I'm told almost the majority of traffic observed through tor is IRC. For botnet control.
- thrown_22 4y ago
  Some people want anonymity. Mobile phones do not provide it.
  - youguyssuck 4y ago
    Yes they do? You can install system wide Tor on android. If you are referring to the fact that phones emit signals that can be triangulated, that doesn't interfere with anonymity in and of itself.
    - Shared404 4y ago
      The fact that towers can ID which phones go where does interfere however.
    - mingus88 4y ago
      I mean, it literally interferes with anonymity in the most fundamental way. "Everywhere you go, even when you're not actively using your phone, it's still listening." - Edward Snowden With a SIM card, you are by definition always tracked and identified individually. It's how the technology is designed to function. You can remove the SIM card, harden your OS, randomize your Wifi MAC but at that point you aren't really using a _cell phone_ anymore.
      - youguyssuck 4y ago
        You could use the same argument for the radios in your home and WiFi. And anonymity is about your name. If they can locate your phone but not be used to identify you then it doesn't break anonymity.

93 points by ecliptik 4y ago

drKarl 4y ago

It's hidden, but is it encrypted?

bawolff 4y ago
All hidden services encrypt the connection (its part of the tor protocol), so yes.
- jazzyjackson 4y ago
  In case the parent meant "end to end" encrypted, no, of course the IRC server can see all the messages, but if you're the one setting up the chatroom for you and your friends, it's a bit of a moot point, the chat will be encrypted and anonymous as far as anyone outside the chat is concerned.
  - hkt 4y ago
    Various IRC clients have OTR plugins though, for the truly paranoid: https://irssi.org/documentation/help/otr/ https://irssi.org/documentation/help/otr/ https://github.com/onezero1/xchat-otr https://github.com/onezero1/xchat-otr There's more listed here from the people who built and designed the libraries: https://otr.cypherpunks.ca/software.php https://otr.cypherpunks.ca/software.php NB, OTR is old and I can't vouch for its crypto, do your research if for some reason you're connecting to an irc server with a hostile admin where you absolutely have to exchange compromising information. (Duh)
    - upofadown 4y ago
      OTR is inherently 1 on 1. Any idea how you can make it work for group discussions?
      - blueflow 4y ago
        Nobody on IRC uses OTR, people just talk unencrypted, trusting the server. It isn't that bad tho when its your friends IRC server.
        Eupraxias 4y ago
        Exactly. People should use IRC as a tool for communications that don't really need encryption. If you are someone's high-value target, don't use IRC.
        bawolff 4y ago
        I think the point is more - there is no point end to end encrypting if the middle man (the irc server) is also part of the conversation (your friend). encryption cannot protect you from the person you are talking to only from the people trying to evesdrop.
        hkt 4y ago
        I've used it to talk to people in the past. It is uncommon but not unheard of.
sedatk 4y ago
I don't know why you were downvoted, I had the same question. Port 6667 means to me that it's plaintext, but it looks like hidden services don't have the "exit node leak" problem clients have with plaintext protocols because they're not involved in the traffic with the hidden services. It looks like the traffic's encrypted all the way.

rawoke083600 4y ago

Man I wished we can go back to IRC, compared to the shitshow that is discord ! Slow client, stupid login circle-jerks, desktop-clients-vs-webclient and and and. Yea yea I'm old, but dammit in "my day", it was easier to communicate and the "tech" didn't get in your way. IRC was basically a "done product" and new features were usually spearheaded via "scripts" from users with a need. It seems the "new features" in discord are product-managers trying to justify their job and keep adding feature-upon-feature and making it more of a xmass-tree-met-a-coder-on-crack situation ! I wished there was a product manager (I'm looking at you Spotify, netflix etc) that said, ok these next few quarters we are going to reward ourselves for 'REMOVING Features'. We need the area of "Bring your own client" to really take off. Ok i'm done venting (one should not comment before coffee on HN) :P

qzx_pierri 4y ago
I miss IRC too, but I don't miss the doxxing and DDoS nonsense. I don't have to setup a znc bouncer to connect to Discord. I don't have to take any precautions. It just works. I hate the client though, so I feel you on that. The lack of terminal integration with Discord is painful.
- foodstances 4y ago
  That is mostly solved with ChanServ and NickServ services. Channels can't be taken over with DDoSes because ChanServ protects them and attackers can't get your real IP because NickServ provides host masking.
  - hericium 4y ago
    It's such a shame IRCnet refused to adopt services.
  - k__ 4y ago
    Wasn't that already a thing in 2001? I was on euIRC and basically "grew up" with those services.

anthk 4y ago

Not a bad guide. However, never, EVER change your root login shell in OpenBSD. You've just opened a can of worms. Set up doas for that, and keep using zsh as your regular user if you want. Simple /etc/doas.conf: permit :wheel Use nvi from packages (it's nvi2 actually, base vi it's nvi) instead of nvim, much faster. It's basically base vi with UTF-8 support. Run :exusage and :viusage from within nvi. Also, my ~/.exrc: set showmode ru ts=2 set sw=2 set iclower

hsbauauvhabzb 4y ago
What’s bad about the root shell?
- eurasiantiger 4y ago
  If you change it and for whatever reason it doesn’t work, you will be unable to login as root and the only way to fix it is to reboot into single user mode on a local console. Not exactly the best of things if your machine is not in the same room with you.
- mingus88 4y ago
  In addition to what eurasiantiger said, it's been a best practice for decades to keep the root environment default and untouched. At a behavioral level, you don't want to make root's environment so comfortable that you use it more than you should. By keeping it vanilla /bin/sh you encourage admins to log off and do their usual work in their usual environment. At a technical level, as soon as you start customizing the root env you open a lot of doors for dynamically linked dependencies to whatever shell+goodies you switch to, which expose root to potential vulnerabilities. You also increase the risk that updates will break root in some obscure way, which will not have been tested by the OS Q/A process.

PetitSasquatch 4y ago

There's one important step missing from the guide, for newcomers to OpenBSD anyway: man afterboot

mwest 4y ago

Thanks for the guide! I've always felt setting up the server is the easy part. The more complicated bit is setting up the clients, especially for friends who aren't as tech savvy, or just don't want to bother figuring out all the moving parts. I see you mention client setup in passing at the end, but do you have a suggestions for a more complete guide for setting up things client-side? I've yet to find one.

Gigachad 4y ago

Sounds like a massive pain in the ass for just messaging friends. Both IRC and Tor are pretty mobile hostile. Would be much more practical to use an end to end encrypted IM platform on the clearnet. Matrix fits pretty well here. That said, I'm told almost the majority of traffic observed through tor is IRC. For botnet control.

thrown_22 4y ago
Some people want anonymity. Mobile phones do not provide it.
- youguyssuck 4y ago
  Yes they do? You can install system wide Tor on android. If you are referring to the fact that phones emit signals that can be triangulated, that doesn't interfere with anonymity in and of itself.
  - Shared404 4y ago
    The fact that towers can ID which phones go where does interfere however.
  - mingus88 4y ago
    I mean, it literally interferes with anonymity in the most fundamental way. "Everywhere you go, even when you're not actively using your phone, it's still listening." - Edward Snowden With a SIM card, you are by definition always tracked and identified individually. It's how the technology is designed to function. You can remove the SIM card, harden your OS, randomize your Wifi MAC but at that point you aren't really using a _cell phone_ anymore.
    - youguyssuck 4y ago
      You could use the same argument for the radios in your home and WiFi. And anonymity is about your name. If they can locate your phone but not be used to identify you then it doesn't break anonymity.