Add a New Comment (Rich Markup)
Comment Type & Canned Response: None No canned response available
Done with task #7492
I understand your point of view (for me it's more feature request than bug). It should be added after version 0.3.0.
More and more IRC servers are supporting SSL/TLS every day. I'm pleased to see more people taking an interest in their privacy and security. It is important to keep in mind how easily a man in the middle attack can take place, and therefore circumvent the entire purpose of the encrypted session.
As WeeChat is truly the geekiest IRC client; it seems appropriate that it have the most robust handling of encrypted sessions. Since many networks use a combination of round-robin DNS and self-signed certificates, I propose the following logic:
Best case is the certificate is signed by a trusted CA. If so, verify the certificate, display the trusted CA name and encrypted session statistics (public/symmetric key type and bit sizes), and continue connecting.
Typical case is the certificate is self-signed, and will vary depending on which server in the round-robin DNS the client lands on. In this case, display the encrypted session statistics (this time including the key fingerprints as well), and present the user with the option to continue for this session only, or to store the server certificate permanently.
Possibly add an option (for the truly paranoid/security minded) to ignore the OS's list of trusted CAs, so they can always verify key fingerprints manually. Maybe even later down the road, permit the encrypted storage of trusted key fingerprints (via keyring managers, etc).
Sorry if you guys don't consider this a bug, but I certainly consider it more of a bug than a feature request. I saw a feature request for something similar a year or so ago, but as far as I can tell no progress has been made. I would like this to be prioritized -- the net is an increasingly hostile environment. Thanks guys. Keep up the good work! :)
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 6 latest changes.
Copyright © 2022 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.9