3 ms·

Does it support TLS? Or is everything unencrypted on the wire?

by codetrotter 2y ago

melomac 2y ago
Qba'g lbh jbeel, ebg13 jvyy cebgrpg lbh!
- mckn1ght 2y ago
  ~?=J 2 ?__3 H@F=5?VE FD6 C@Ecf[ J@F =67E E96 4=F6 C:89E E96C6 :? E96 4JA96CE6IEP
  - deleted 2y ago
    [deleted]
  - Terretta 2y ago
    tr '\!-~' 'P-~\!-O'
amatecha 2y ago
The unofficial *nix ports allowed some basic encryption but this was never supported by the original Mac (and later Win) clients. Since the protocol was plaintext, it was easily reverse engineered, thus "hx" was born :)
V99 2y ago
TLS did "exist" (well, as SSL), but this was a time when you'd maybe see it used on a few websites that had it on just the specific pages that took a credit card. It was well before most other protocols were worrying about the security or privacy of being intercepted at all. Decades before TLS by-default-because-why-not started becoming a thing (largely because of LetsEncrypt). Especially for an app that was mostly for pirating stuff. Your email and it's login/passwords, IRC, instant messaging, regular browsing, etc all happened in plain text. And despite the physical networks being super vulnerable back then. Ethernet was mostly connected by hubs/ring/shared coax, so every device received every other's packets. WiFi was just coming around and is a shared medium. Several rounds of inept security schemes failed to even keep people who don't know the network password from intercepting nearby traffic. Most networks didn't have security on yet anyway. The Hotline protocol was/is mostly binary messages sent over TCP with a 4 character text message type followed by a corresponding packed data structure of the related data. (https://hotline.fandom.com/wiki/Protocol#Session_Initialization https://hotline.fandom.com/wiki/Protocol#Session_Initializat...)
- incanus77 2y ago
  > TLS did "exist" (well, as SSL), but this was a time when you'd maybe see it used on a few websites that had it on just the specific pages that took a credit card. Indeed, I had forgotten about this. You'd go from the regular site on HTTP to the credit card page on HTTPS and back again. For a time, it was important to check that the page that you were actually entering the card details on was on HTTPS before you clicked the submit, and that the target was also HTTPS.
superkuh 2y ago
Are you worried someone is going to MITM you? Hotline works just fine without encryption. That said, some people felt as you do even back in the early 2000s and the KDX server/client software set is basically Hotline with TLS. It was only introduced at the tail end of the scene though and not widely adopted. There are some servers that support both kdx and hotline clients.

Does it support TLS? Or is everything unencrypted on the wire?

melomac 2y ago

Qba'g lbh jbeel, ebg13 jvyy cebgrpg lbh!

mckn1ght 2y ago
~?=J 2 ?__3 H@F=5?VE FD6 C@Ecf[ J@F =67E E96 4=F6 C:89E E96C6 :? E96 4JA96CE6IEP
- deleted 2y ago
  [deleted]
- Terretta 2y ago
  tr '\!-~' 'P-~\!-O'

amatecha 2y ago

The unofficial *nix ports allowed some basic encryption but this was never supported by the original Mac (and later Win) clients. Since the protocol was plaintext, it was easily reverse engineered, thus "hx" was born :)

V99 2y ago

TLS did "exist" (well, as SSL), but this was a time when you'd maybe see it used on a few websites that had it on just the specific pages that took a credit card. It was well before most other protocols were worrying about the security or privacy of being intercepted at all. Decades before TLS by-default-because-why-not started becoming a thing (largely because of LetsEncrypt). Especially for an app that was mostly for pirating stuff. Your email and it's login/passwords, IRC, instant messaging, regular browsing, etc all happened in plain text. And despite the physical networks being super vulnerable back then. Ethernet was mostly connected by hubs/ring/shared coax, so every device received every other's packets. WiFi was just coming around and is a shared medium. Several rounds of inept security schemes failed to even keep people who don't know the network password from intercepting nearby traffic. Most networks didn't have security on yet anyway. The Hotline protocol was/is mostly binary messages sent over TCP with a 4 character text message type followed by a corresponding packed data structure of the related data. (https://hotline.fandom.com/wiki/Protocol#Session_Initialization https://hotline.fandom.com/wiki/Protocol#Session_Initializat...)

incanus77 2y ago
> TLS did "exist" (well, as SSL), but this was a time when you'd maybe see it used on a few websites that had it on just the specific pages that took a credit card. Indeed, I had forgotten about this. You'd go from the regular site on HTTP to the credit card page on HTTPS and back again. For a time, it was important to check that the page that you were actually entering the card details on was on HTTPS before you clicked the submit, and that the target was also HTTPS.

superkuh 2y ago

Are you worried someone is going to MITM you? Hotline works just fine without encryption. That said, some people felt as you do even back in the early 2000s and the KDX server/client software set is basically Hotline with TLS. It was only introduced at the tail end of the scene though and not widely adopted. There are some servers that support both kdx and hotline clients.