Have a question about IRC and how someone was able to find me while using a VPN. reddit / irc ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 16:44 So I have a question really about security and I need an IRC operator to really answer this. So I have someone in an IRC chat that is able to locate me even though I changed my user name and or VPN/IP. So I'm not sure if he has someone that's an operator that's helping him or what but I want to know how these people are able to see when I create a new account and log on under a different name while using a VPN. What is sticking to my computer that they are able too see? ---------------------------------------------------------------------- tavaryn · 2015-12-20 16:49 Maybe your ident or realname? ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 16:51 Yeah but my question is. If I'm using a new nick and and everything, what is it that's sticking to me that anyone would be able to see? ---------------------------------------------------------------------- tavaryn · 2015-12-20 16:56 Are you changing your ident and realname as well as your nick? If so, maybe it's just your typing style? ---------------------------------------------------------------------- TheOneThatFailed · 2015-12-20 17:36 You use the same channel? If so that could be the case, he just know your style, or well, perhaps he works for the NSA. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 17:50 No I never knew to change those. So if I log in with a nick and then get off. Then log in with a new nick and email using a different ip how am I keeping the same ident as before? What am I missing? ---------------------------------------------------------------------- tavaryn · 2015-12-20 18:26 What client are you using? ---------------------------------------------------------------------- ne7split · 2015-12-20 18:26 Snoonet IRC operator here. We have a function that allows users to check for clones of nicknames (i.e. if you're logged in as "hello" and "world" at the same time, and someone requests a clone-match on "hello", it'll display both those nicks). We will also, in the case of troublemakers, cross-check IP address ranges vs nicknames if someone requests a more detailed check. It's probably this. People often write with a very specific and personal style, and I can often tell when people are using this kind of method to ban evade in my own channels. I sincerely doubt he works for the NSA, however. If this is for a legitimate reason, you could also be identified also by your client through CTCP's version command. Perhaps the user noticing you also just says "hey FamousAndUnique" to everyone who joins the channel. My advice is that if you're trying to remain totally unknown in an IRC channel, you probably shouldn't be there in the first place. If you're evading a ban (which I feel like you probably are) then you're breaking network rules. If the other user has doxxed you then they are breaking network rules. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 18:54 Not using a client just we chat ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 18:54 Webchat ---------------------------------------------------------------------- tavaryn · 2015-12-20 19:15 Anything that lets you connect to irc is a client. Your client sends version info, they can tell which webchat you use. Try changing to mirc or hexchat. ---------------------------------------------------------------------- MillenniumFalc0n · 2015-12-20 19:17 Sure your VPN is connected before you connect to irc? If it is an irc operator wouldn't be able to see your real host either so that couldn't be it. ---------------------------------------------------------------------- blueredscreen · 2015-12-20 19:47 iirc xchat last stable release was in 2010. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 20:44 Ok, yes I was 100 positive because I always (whatismyip) before doing anything. So it's either they got my "MAC address" or they can just see webchat and assume it's me. Everything else is hidden. So the question now becomes, is my Mac attached to my ident? Because all my ident says is webirc like everyone else. What is the host based off of? ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 20:45 Also when I /Whois I can see that's it's showing a cloned ip meaning it's not my real ip. ---------------------------------------------------------------------- MillenniumFalc0n · 2015-12-20 20:50 IRC networks do not see your mac address. A host mask is comprised of your nick, username, and ip address/hostname. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 20:53 So could it be (not emptying the cache or a time lapsed thing? How long before time lapses and IRC resets/dumps? ---------------------------------------------------------------------- MillenniumFalc0n · 2015-12-20 20:54 What? There is no cacheing issue that would affect your hostname. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 20:55 If I didn't clear the cache and used same browser would that keep info? Well one things for sure, there has to be a way ---------------------------------------------------------------------- MillenniumFalc0n · 2015-12-20 20:57 No, ip address has nothing to do with browser cache. The most likely scenario is that you've slipped up with the vpn. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 21:18 If I slipped up with the VPN and /Whois myself and it read the ip it would have said my real ip, so that can't be it. I took a screen shot and can see my ip wasn't there ---------------------------------------------------------------------- wobblyweasel · 2015-12-20 21:56 did they give you any links and did you click those links? ;) ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 22:01 Hell no, I ain't that stupid. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-20 22:04 That's one reason I don't use IRC apps, there are to many exploits for those. But it's got me floored that I can't figure this shit out. I know it's not my ip, and someone said it ain't the cache, and not the Mac well what else is it. Has to be either ip didn't switch or the cache wasn't cleared before I joined back in keeping information that would link back to me. ---------------------------------------------------------------------- tavaryn · 2015-12-21 00:09 Meant to type Hexchat but I was distracted haha. ---------------------------------------------------------------------- [deleted] · 2015-12-21 00:11 [deleted] ---------------------------------------------------------------------- Princess_Pwny · 2015-12-21 14:48 I was having thoughts about DCC and CTCP. If I version myself, I get the response: > CTCP VERSION reply from Princess_Pwny [NetGod@no-1mp.oht.7f7am5.IP]: KVIrc 4.3.2 git:git-5837-gf24e64c 'Aria' 20151216 - build 2015-12-16 00:52:00 UTC - Windows 8 Professional (x64) (Build 9200) If I change my IP with a VPN and nickname, real name and ident, the IRC client version is mighty specific. Specific enough maybe, combined with ctcp time results you could take a rough stab that it would be me. If you look at what channels I go to, you can build a pretty comprehensive profile. DCC (which is commonly used for file transfer via irc) connects via your unmaksed IP. Although I don't think it's too likely, I do know my irc client will initiate DCC transfers to grab avatars. You could get my local IP using it. I don't exactly know how a VPN would change this, but depending on the VPN software and IRC client I won't rule out getting your real IP. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-21 17:08 Yeah I think I figured it out. It's the time lapse from the time I logged on then logged out turn around made a new nick with another ip and then straight back on. I didn't let anytime go by before doing this nor did I clear the cache which would also relay back to the same credentials before, especially if you use the same web browser to log back in on. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-21 17:13 Also, I don't use a client for IRC, I use webchat IRC, so essentially it would be the same as your web client, instead of pulling info from your web client that would essentially have your real ip if you've never and always have kept VPN on while connecting through it, (unless there is a way to clear the cache and or information on it before connecting again. I know for a fact they don't have my real ip simply because I use tor and VPN, if one fails the other will catch it. Also, I ran the same check, and a simply (/Whois) will tell you what ip is showing. I use no avatars, always change nicks, fake emails, and never a name I've ever used. So even if one doxxed me, they get nothing. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-21 17:31 I hate to say it guys, but I'm glad this happened because it shows that IRC isn't as safe as people say. Some people claim that they don't keep logs and this and that, well they have to keep something in order to see who was there and how to find them. If a user can do this, the NSA, FBI, or some idiot can simply point someone in your direction and that may lead to problems and or doxxing. No More IRC for me. But given that the latest incident involving the couple that had something to do with terrorism in California, at least I know that secure emails are still good, because the FBI is bitching they can't get into them. So "mail pigeon" is still good. ---------------------------------------------------------------------- DefunctKernel · 2015-12-21 23:40 What are you using for your VPN and how are you tunneling your connection? Could be any number of things such as a DNS leak, correlation attack (unlikely tho) etc... Or perhaps you're connected to somewhere else the other person is connected to and when your VPN dies, it dials home to a server (website/IRC) before the VPN re- connects. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-21 23:47 I might be able to except that. But I have VPN enabled through my router and I use it connected on my device, also, I use tor which hides ip as well. Also, when this happened I logged out, then logged back in with a new nick, different ip, but never cleared the cache. Also, being that I immediately logged back in, I bet something stuck to my system and when I logged back on it showed. I've reached out to everyone I know. Some of these are IRC operators as well. They told me it's a big possibilities it was NsA. No too sure though why they would be watching or doxxing me, I'm a good boy, I've never done anything wrong except chat on an IRC! ---------------------------------------------------------------------- DefunctKernel · 2015-12-22 21:56 TOR can be prone to DNS leaks, as can VPN connections that aren't set up properly. There is a possibility of it being a correlation attack however that's quite unlikely to be honest. I'd put my money on a VPN that's not configured properly or doesn't drop the interface when the VPN drops. It doesn't matter how many times you change your IP if your rDNS points to your home connection... ---------------------------------------------------------------------- Saber_UK · 2015-12-22 22:05 >That's one reason I don't use IRC apps, there are to many exploits for those. [citation needed] ---------------------------------------------------------------------- FamousAndUnique · 2015-12-22 22:14 Again, when you have a VPN hooked through the router, then a completely different VPN hooked through the device, then you use tor. I just could see three thing failing, No Way, not saying it's not possible, but you'd have to have access to my device manually, or have a Trojan installed to it, there is no way in hell that'd going to happen. ---------------------------------------------------------------------- DefunctKernel · 2015-12-23 01:15 What protocol are you using to tunnel your VPN connections and are you using commercial providers for your VPNs? Edit: You do not need to compromise a box in order to get geolocation data or to 'unmask' a user. As I mentioned earlier, TOR is prone to DNS leaks (and other issues) and is far from a privacy panacea. It's very unlikely to be NSA and much more likely to be human error somewhere. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-23 04:05 I use IKE connect and yes both are commercial. From what im understanding from a IRC operator, it's most likely a time lapse error. Meaning I didn't let any time lapse before reconnecting, I also think it has a little to do with not clear in previous history and or cache. If you logged onto something no matter what and didn't clear your cache and then logged back into the same site, I know for sure there are piggy backing issues with data dragging data and information so to speak. ---------------------------------------------------------------------- FamousAndUnique · 2015-12-23 04:07 Also, again. My computer constantly runs DNS Leak software and notifies my in real time of any leaks immediately so I can respond to the leaks. Not a rookie user here, anything is possible, but it's not leaks due to using virtue boxes, Vpn's & Tor. ---------------------------------------------------------------------- penguinv · 2015-12-24 23:06 I dont know what mail pideon is. What is that? I do know that pidgin (the program) has a mode called OTR that is quiet. > Off-the-Record Messaging - OTR OTR library and toolkit. This is the portable OTR Messaging Library, as well as the toolkit to help you forge messages. You need this library in order to use the ... > duckduckgo told me that.