IRC for "illegal purposes" AKA privacy. reddit / irc ---------------------------------------------------------------------- How_To_IRC · 2023-10-05 05:43 so in a previous post, someone floated the idea that IRC is used for "illegal purposes" now i do not support breaking the law, but i do support communication methods that are outside the surveillance of the government or private 3rd parties, also known as a persons right to privacy, and that i do support. so i would like to ask, how does IRC either support illegal purposes or a persons right to privacy? thank you ---------------------------------------------------------------------- McGoodotnet · 2023-10-05 07:37 Back in the day we had IP restricted ftp sites. One had to send a custom command "site invite nickname" to the ftp site. A bot connected to the ftp site would then invite you to the channel. Then once inside the channel you would need a blowfish decryption key to see what anyone was saying. Privacy was quite necessary given the nature of the files being transferred. The scheme provided IP restriction and blowfish encryption. ​ If you would like to play with something similar to our setup fire up a debian instance and load this... https://github.com/teqnodude/glftpd-installer ---------------------------------------------------------------------- ManiaGamine · 2023-10-05 12:26 IRC has never been particularly uh secure due to its inherently open nature and due to the fact that while encryption (SSL/TLS) is fairly standard now there are/is still a substantial amount of non-encrypted traffic on IRC so it ultimately doesn't matter *how* you go about it or what you go about if you are not following good security practices in general and IRC security practices are inherently weak in that regard. Now as a long (and I mean long) term IRC advocate and user I can tell you up front that I'm not discounting IRC or suggesting that it not be used. I'm simply highlighting that in terms of security from actual surveillance (especially from governments) IRC is definitely on the weaker side out of the box. Traffic on IRC used to be all plaintext (before any SSL implementations) but the ability for agencies to scoop up and reliably monitor traffic was limited. Now agencies have massive toolsets to scoop up and monitor all traffic but IRC like many protocols does support encryption. But the weakness remains if the IRCd (server) in question does not enforce encryption (SSL) OR the channel operators enforce it. At the server level it is very uncommon for it to be enforced (Essentially not allowing non-SSL connections) but on the channel level it depends on the IRCd implementation. UnrealIRCd and I believe inspircd have channel mode +z which essentially prevents anyone who isn't using SSL from joining the channel and at least in Unreal the channel will automatically get +Z if all clients that are in the channel are using SSL. If not it will not set or be able to be set. So if everyone in the channel is using encryption and their encryption is secure as is the encryption on the server then in theory a +z restricted channel should be safe from spying, however there are some caveats one has to consider. For example with any client<>server application there is some degree of implicit trust that the client has to give the server with regards to security. As in you as the client have to trust that the server is properly implementing security on its end and isn't compromised thereby potentially compromising everything downstream. Ultimately in closing I would say. If a bad actor government (or even corporate) entity really wants to spy on you IRC probably isn't the way to go at least not out of the box. You'd want to significantly layer it with additional security measures (Such as routing through TOR) and essentially make the job of any would be bad actor harder and more expensive to spy on you, but that also increases your footprint which can in turn increase the scrutiny that might be aimed your way. After all those who hide the most tend to have the most to hide at least from the perspective of those who would spy on those who hide things. Also as an aside. IRC operators and administrators can pretty much always bypass security on their servers if they needed to and some have been implementations over the years of spying/logging and even hiding (allowing opers to be invisible on/in channels) plugins and modules for a few IRCds and while they are hard to find and definitely not endorsed or allowed by any of the mainstream IRCds it is something to keep in mind from a security point of view. ---------------------------------------------------------------------- Jon_Hanson · 2023-10-05 13:54 It would be easier to use something like Signal if you’re worried about that. ---------------------------------------------------------------------- CoolKA2277 · 2023-10-05 14:11 Couldn't the server see/log what you sent? ---------------------------------------------------------------------- zeamp · 2023-10-05 17:58 Nice try, Kevin. ---------------------------------------------------------------------- rrenou · 2023-10-05 18:20 "I'm not breaking the law, I'm only planting weed in my backyard for my own usage, it's my own privacy". ---------------------------------------------------------------------- technfaith · 2023-10-06 19:04 Laws and Loopholes goes together like Reddit comments and popcorn :D ---------------------------------------------------------------------- empress-tom · 2023-10-07 19:04 I am also a long time IRC user (since 1998) and would like to distinguish myself from the insanity of my cohorts that is defending IRC after acknowledging *it isn't entirely safe to use the protocol*. What is with everyone? IRC has felt old since 2005. We need an alternative. One that captures the independent and flexible nature of IRC we know and love, with a *modern* set of features and security measures. I get the nostalgia. I really do. IRC will always have a special place in my heart. But it's time to take it off life support, because needs have changed and the protocol clearly can't change enough to meet them. ---------------------------------------------------------------------- empress-tom · 2023-10-07 19:09 Some laws are unjust or unethical anyways, and *must* be violated or else we risk becoming party to horrible abuses out of a desire to be a good law-abiding citizen. Laws need to meet a standard, you shouldn't follow them for the sole reason that "they are laws". For me, it would matter which law is being violated. ---------------------------------------------------------------------- reercalium2 · 2023-10-24 17:43 yes which is better if you control the server instead of a company like reddit or discord