Are there any security risks to using IRC? reddit / irc ---------------------------------------------------------------------- SayOuch · 2013-06-13 23:08 I enjoyed using IRC in the past but someone told me that there are security risks associated with using it. Have you had any problems? Are there any precautions I can take when using it? Thanks! ---------------------------------------------------------------------- kellyzdude · 2013-06-13 23:37 They largely depend on which network you're on, but... 1. Depending on your client and the network it can be really easy to get your public-facing IP address. Some networks mask your IP, but via things like DCC your client may just make it available on request. 1. Most connections are, by default, plaintext. More and more networks are opening up SSL-enabled ports, but you almost have to try in order to know you're connecting across an encrypted link. 1. Subpoint of the above, just because YOU are connected via an encrypted link, doesn't mean that everyone else in the channel is, which means anything you say in the channel may still be traversing an unencrypted link somewhere and be more prone to snooping. It really comes back to how you define "Security." IRC is an outbound protocol, you need not allow any incoming connections to participate, so on that front it is fairly secure. You can, via things like DCC, allow incoming connections for things like one-on-one chat away from the central server, or more commonly for file transfers. Additionally, scripting in clients can open you up to potential security issues. So how do you ensure you're secure? 1. If you can, disable DCC unless you know you need it. 1. Only install scripts or run commands if you are absolutely sure you know what they do. If you aren't sure, ask a reputable source. 1. Treat the channel as an open space. If you wouldn't say it in public, consider not saying it in what you deem a private space unless you are absolutely sure it's private. Others may suggest bouncers, proxies, not caring. The choice is yours, just follow the rules of the IRC community you're connecting to and above all, be careful. I've been on IRC for some 15 years and have not yet had a security issue that I could say IRC was responsible for. ---------------------------------------------------------------------- ctrlx0 · 2013-06-14 03:42 The same risks as any other service. ---------------------------------------------------------------------- gitarr · 2013-06-14 06:47 A good way of solving problem #1 is to use a shell account, or VPS with a bouncer like znc on it to basically serve as a proxy between you and the network. ---------------------------------------------------------------------- Weyland · 2013-06-14 08:18 A proxy with benefits I always like to say. ---------------------------------------------------------------------- kellyzdude · 2013-06-15 02:06 Yep. They can also provide other benefits, like letting you stay online and collecting logs even when you are unable to be connected. I also use mine to be connected from 2-3 different places (at one point I was connecting from something like 4 different devices at any one time) with only one nickname presence in the channel. My favorite game was finding and annoying the 'creepers' who would use the hostname I had assigned to my VPS to determine where I was from.. ---------------------------------------------------------------------- [deleted] · 2013-06-23 01:54 One thing I think many people forget is that passwords are not sent to Nickserv and Chanserv over an encrypted connection when your connection to the server isn't encrypted. I also doubt that absolutely every admin bothers to store their passwords in good hashes. Rule 1 of computer security applies: Don't use the same password in more than one place. edit: Also, PMs go through the server. This is more of a privacy thing than security in general. If you want more privacy from PMs over IRC (queries), look up "Blowfish encryption for [your client's name here]". You can also try "FiSH encryption for [client]". OTR might also be something to look at. (Sorry for directing you to a search engine, the solutions are different for each client.) Your chatting partners will also need the addon. You can also do Blowfish encryption for channels, but this is impractical for many open communities. /edit ---------------------------------------------------------------------- EsotericForest · 2013-06-28 15:54 Disabling DCC and forcing SSL (connect on port +6697, including the +) on most servers will stop a lot of basic sniffing and IP gathering. Of course, hopefully that network uses hostmasking.