Secure IRC on Linix reddit / irc ---------------------------------------------------------------------- crsf1re · 2017-09-04 13:54 Hey guys, I know the title is pretty unprecise so I'll try to explain what exactly I mean. At the moment I'm configurating my First Linux OS, Arch Linux. I also want to use an IRC service, but I have read many stories about unsave Clients, information leaks and even tracking and exploitation attacks that I'm a little bit scared about IRC services. So here are my questions: 1.) Which Clients do you use? 2.) What do you do to stay save while using IRC's? 3.) Any other good tips for IRC beginners? ---------------------------------------------------------------------- Madbrad200 · 2017-09-04 14:01 Hexchat, adiirc or smuxi are pretty good clients. ---------------------------------------------------------------------- crsf1re · 2017-09-04 14:02 Thank you. But how secure are they? ---------------------------------------------------------------------- iownall555 · 2017-09-04 14:12 Generally if you want to protect yourself there's a few things you can do. * Use SSL to connect to the server * Disable DCC inside your client (some networks do this as well) to prevent people from sending you files. * Use a long NickServ password and consider using SASL to authenticate. It's more secure and generally a bit more convenient as well. * Keep your client up to date. * Do not tell your password to anyone including staff. Staff will never ask for your NickServ password. * Do not load or execute scripts you randomly receive from people. On a lot of clients scripts basically have full access as you would on a terminal so keep this in mind when using them. * Request a vhost or cloak if you don't have one. This will hide your IP address from most other non-staff users (note: use Tor, a proxy, a VPN or a BNC for full anonymity. Don't rely on network cloaks). Some networks such as Snoonet already do this however others such as Freenode don't by default. Keep in mind a lot of networks can sometimes refuse or require a minimum registration period. Also please for the love of all that is good. **Don't use IRC as root.** ---------------------------------------------------------------------- crsf1re · 2017-09-04 14:17 Thank you for your advice. I'll inform myself about the topics you mentioned ---------------------------------------------------------------------- A-UNDERSCORE-D · 2017-09-04 15:10 This depends on your definition of secure. are you looking for unexploitable software? do you want people to be unable to read your messages over the internet? do you want a client that logs? ---------------------------------------------------------------------- crsf1re · 2017-09-04 15:19 I am especially focusing on my privacy, so I do not want to be tracked and also I do not want anybody to be able to see information about me that they should not see ---------------------------------------------------------------------- DTSCode · 2017-09-04 16:30 Cloaks don't hide your IP address. Just because they don't show up in a Whois doesn't mean it's not accessible. There are many ways, most without you being aware it's even happening. If you really want to hide your ip, use tor or a proxy service such as an irc bouncer. ---------------------------------------------------------------------- A-UNDERSCORE-D · 2017-09-04 17:40 well your IP will always be visible to the server, as said by a few other people some networks offer cloaking. otherwise you may want to remove CTCP responses ---------------------------------------------------------------------- redditcdnfanguy · 2017-09-04 18:27 Always run through a VPN. ---------------------------------------------------------------------- iownall555 · 2017-09-04 23:42 > Just because they don't show up in a Whois doesn't mean it's not accessible. Unless you make a habit of pissing off IRC opers on slightly less than reputable networks I think this is perfectly fine for most users. That said though you're right about using tor or a bouncer. I'll fix my answer up nonetheless. ---------------------------------------------------------------------- DTSCode · 2017-09-04 23:53 It has nothing to do with pissing off opers. Any user can get it. All it takes is a simple google search. There are quite a few scripts that automate it. ---------------------------------------------------------------------- CannedDeath · 2017-09-05 05:45 One way I've seen used is to get your target to click a link to a website you control then check the access logs. There's also other stuff like using progressively narrower wildcard or CIDR bans. ---------------------------------------------------------------------- jarymut · 2017-09-05 08:47 You missed one IMHO important part: IRC will never be secure in a sense, that everyone has access to whatever you write, even when they are offline at a time (search for IRC logs). It's not email or IM. Is Reddit secure? It mostly is, as long as you don't do something completely stupid. Information leaks? Probably in some cases someone said too much about themselves or thought they are talking to someone they trust, while they did not.