bugWeeChat - Bugs: bug #24947, SSL/TLS support works, but no...

 
 

bug #24947: SSL/TLS support works, but no support for verification of server certificates

Submitter:  Gary D. Huffman, II <gdhuffman>
Submitted:  Wed 26 Nov 2008 08:08:35 PM UTC
 
Category:  irc plugin Severity:  3 - Normal
Item Group:  security Status:  Fixed
Privacy:  Public Assigned to:  flashcode
Originator Name:  Open/Closed:  Closed
Release:  * 0.2.6 IRC nick: 
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Sun 03 Jan 2010 09:07:58 PM UTC, comment #2: 

Done with task #7492

Sebastien Helleu <flashcode>
Project Administrator
Sun 16 Aug 2009 02:47:33 PM UTC, comment #1: 

I understand your point of view (for me it's more feature request than bug).
It should be added after version 0.3.0.

Sebastien Helleu <flashcode>
Project Administrator
Wed 26 Nov 2008 08:08:35 PM UTC, original submission:  

More and more IRC servers are supporting SSL/TLS every day.  I'm pleased to see more people taking an interest in their privacy and security.  It is important to keep in mind how easily a man in the middle attack can take place, and therefore circumvent the entire purpose of the encrypted session.

As WeeChat is truly the geekiest IRC client; it seems appropriate that it have the most robust handling of encrypted sessions.  Since many networks use a combination of round-robin DNS and self-signed certificates, I propose the following logic:

Best case is the certificate is signed by a trusted CA.  If so, verify the certificate, display the trusted CA name and encrypted session statistics (public/symmetric key type and bit sizes), and continue connecting.

Typical case is the certificate is self-signed, and will vary depending on which server in the round-robin DNS the client lands on.  In this case, display the encrypted session statistics (this time including the key fingerprints as well), and present the user with the option to continue for this session only, or to store the server certificate permanently.

Possibly add an option (for the truly paranoid/security minded) to ignore the OS's list of trusted CAs, so they can always verify key fingerprints manually.  Maybe even later down the road, permit the encrypted storage of trusted key fingerprints (via keyring managers, etc).

Sorry if you guys don't consider this a bug, but I certainly consider it more of a bug than a feature request. I saw a feature request for something similar a year or so ago, but as far as I can tell no progress has been made. I would like this to be prioritized -- the net is an increasingly hostile environment. Thanks guys. Keep up the good work! :)

Gary D. Huffman, II <gdhuffman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by gdhuffman (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-01-23 flashcode Open/ClosedOpen Closed
    2010-01-03 flashcode StatusPostponed Fixed
    2009-08-16 flashcode Item Groupother security
        StatusNone Postponed
        Assigned toNone flashcode
        Categoryother irc plugin

    Back to the top


    Powered by Savane 3.9