Removed

Written by on Monday 04 May 2009

Removed due to near constant misrepresentation of the presented argument.

TLS was never presented as useless, but at the time the article was written (2009) we believed for chat rooms open to the public it added little value.

legacy

Please log in to post comments.

This actually explains alot, and your example shows that it's pretty much unnecessary. Great column, slug. Keep it up!

Munk3N said on Thursday 14 May 2009

I disagree. Even if it falls short at several places it protect the 'aware' users against people sniffing the network when you're AUTH'ing (or handling chanlev or whatever it is that you do which doesn't have a *cookie command.) And it protects 'aware' users against MITM attacks pretty efficiently!

Deepa said on Sunday 17 May 2009

I don't dispute your second sentence, but the third obviously isn't true when you're in a channel with >=2 people as I have explained in detail above.

slug said on Sunday 17 May 2009

Well I agree that SSL is useless, mostly because we should not trust the IRC server operators :) An client encryption is better, and not visible to IRCops & co About AUTH security, this is indeed an issue. SSL would prevent this if the fingerprint is checked, but CHALLENGEAUTH solves it even better, also in the case where the fingerprint is not checked. So SSL is useless. See http://www.quakenet.org/development/challengeauth/ for details.

dinesh2 said on Wednesday 20 May 2009

I'm thinking more of protecting the session than the data being transmitted.

Deepa said on Saturday 20 June 2009

Very good article on IRC SSL security. While it states most of the issues, I have to disagree that it doesn't provide a security layer to the educated personality, for example where You and Bob are talking privately over SSL. As every other encryption mechanism, you will have to trust the other party to be sure the conversation is really secure, and when you do, you're able to use the SSL feature with it's purpose.

Heth said on Wednesday 23 June 2010

moo

meeb said on Wednesday 08 February 2012

Can't help but note that i logged in using HTTPS, i thought it was useless :(

fuq-netolol said on Tuesday 14 February 2012

Yep, 100% agree, also it must also increase the load on the IRCd having the encryption there... good explain

Raids said on Tuesday 28 February 2012

Yeay, let's not put a fence here. It will break eventually anyway and thereby provides false security.

Sami345 said on Wednesday 08 August 2012

Oh, I dont know how the added security balanceswith the increased server load, but in general I'd say where there is a way to improve security it should be used. But maybe they shouldnt have built trains, since they were only a little faster than carriages, but the cost increase for all the rails and the fact that only rich people can afford it and the average person can only afford riding a horse or a carriage anyways will make them futile. also traveling at over 20mph will give you whiplash!

stealz said on Wednesday 08 August 2012

I tend to think that ssl adds quite a bit of security. First off all if I am in a network of some sort where an administrator is monitoring network traffic or whatever, it makes a difference if it is sent in plain text or encrypted. second of all, if someone wants to spy on me because i am chatting about top secret shizznizz doesnt necessarily mean he knows I am talking to carol about it and monitor her network traffic, too, if he even has the means to.

stealz said on Wednesday 08 August 2012

Especially with the recent law changes in germany where ISPs are going to be required to log some of your internet activity for a certain time (weeks/months) I'd much prefer if it'd not be in plain text. If anyone wants to know what I wrote there would still be legal hurdles for them to see what carol was able to read. I am not talking about top secret haxor code, I just want to preserve my privacy to a reasonable extent.

stealz said on Wednesday 08 August 2012

"Hey its not 100 bazillion % secure with ssl so why even bother"... Seriously? Using that as explanation for not doing it is only an attempt at justifying the first part "they havent gotten around to it yet"

wjd said on Thursday 14 April 2016

This is complete nonsense, considering this: https://www.quakenet.org/articles/102-press-release-irc-networks-under-systematic-attack-from-governments

rarpatman said on Sunday 15 May 2016