Hacker News Reader

Comment by n3t | Hacker News Reader

Private messages (next to credentials leak) are another reason for using SSL/TLS.

No, because you have no guarantee that you're talking to whom you think you are. Private messages still go through the central server, and Eve could be listening on Carol's connection.

You are right. To be clear, I implicitly assumed that people I talk to wouldn't accept a fake certificate.

Many ircds I'm familiar with include a "<user> is using a secure connection" message in their WHOIS response, so this is easily verifiable. Obviously, it's still not E2E-encrypted, so if you don't trust the ircd, you should use an additional layer that provides E2E encryption.

one of the main points of the article is that people don't check fingerprints, and that you should use encryption layered on top of IRC if you want any real privacy

Is there any evidence that IRC users are somehow more likely to accept self-signed SSL certificates? The IRC clients I'm familiar with rely on the OS trust store, just like most web browsers do.

To me this seems like saying a webmail site shouldn't use SSL because the recipient might also use a webmailer and happily accept a self-signed certificate and bypass the browser warning. Sure, it's no replacement for E2E crypto, but to me that's a clear case of perfect being the enemy of good.

as an example, irssi from debian jessie doesn't verify the certificate at all, or even display that it's accepted an untrusted certificate

(I just tried it)

Sorry for hijacking this thread to respond to a sibling comment, but I think the original author of this article may be trying to post, but is being flagged.

You can (depending on Karma, I think?) vouch for dead comments.

I just did for two of the author's comments, I don't think they should be dead at all.

1) The author states that their opinion changed somewhat

2) The author explicitly names a compromised deployment (Freenode). Haven't fact checked that, but that _seems_ like a good argument

3) The architecture of the network (random organizations sponsor servers) seems like a plausible excuse for headaches/complications as far as I'm concerned.

It seems that a mod has come along and remedied the situation. I would have vouched, but I guess I don't have that feature. I don't even have enough karma for down votes, but when I saw what seemed like a high-quality dead comment without a contentious comment history, it only felt right to speak up.

Reply on news.ycombinator.com