Can I prevent users from joining chat in a traditional way?
(unrealirc)
reddit / irc

----------------------------------------------------------------------
[deleted] · 2022-06-30 02:59

[deleted]

----------------------------------------------------------------------
skizzerz1 · 2022-06-30 05:14

No. Someone can decompile your app and figure out everything it does
to connect if they wish, and then replicate those bits such that it is
effectively invisible to your server that they aren’t using the
official app. You can add in stuff to make that process as annoying as
possible, but it will always be achievable.

For a solution that blocks the vast majority of attempts however,
something as simple as requiring a connect password should work.

----------------------------------------------------------------------
memphisgrit · 2022-06-30 11:53

Finding the server IP is easy...

...but anyways, even the massive network, MSN, couldn't keep unauthed
users from joining.

They attempted to make it so only their webchat users could join but
we figured out how to use mIRC and sockets to trick the server.

----------------------------------------------------------------------
[deleted] · 2022-06-30 16:46

[deleted]

----------------------------------------------------------------------
[deleted] · 2022-06-30 17:59

[deleted]

----------------------------------------------------------------------
skizzerz1 · 2022-06-30 18:01

I was talking about a server password (aka i:line password) rather
than a per-nick/account password. This is something the ircd natively
supports and will stop casual attempts to connect without the app to
fail.

If something is really important for you to manage or verify, the best
way for you to do it is server-side. Then it doesn’t matter off they
connect with the official app or not because the validation is
happening somewhere they can’t control. That’s just security 101 (aka
never trust the client).

So, a combo of the two above things is what I’d suggest—a casual
deterrent for people who are slightly curious combined with a security
posture that doesn’t set you up for massive failure in the future.

----------------------------------------------------------------------
anths · 2022-06-30 19:30

I don’t know unrealircd specifically, but this should be possible, if
you’re willing to ignore the issue of folks decompiling your app, at
least. A server password, as noted elsewhere, would be simplest. I’d
look at having your server validate a client certificate on connect. I
sort of doubt unrealircd can do this directly (I’ve never seen it, at
least), but there are tls proxies that will.

----------------------------------------------------------------------
[deleted] · 2022-07-01 00:34

[deleted]

----------------------------------------------------------------------
[deleted] · 2022-07-01 01:39

[deleted]

----------------------------------------------------------------------
skizzerz1 · 2022-07-01 18:37

Can’t change conf files via oper commands, best you have is /rehash to
load the changed configuration (no need to restart)

----------------------------------------------------------------------
[deleted] · 2022-07-02 00:05

[deleted]