bugWeeChat - Bugs: bug #24947, SSL/TLS support works, but no...

 
 

bug #24947: SSL/TLS support works, but no support for verification of server certificates

Submitted by:  Gary D. Huffman, II <gdhuffman>
Submitted on:  Wed 26 Nov 2008 08:08:35 PM UTC  
 
Category: irc pluginSeverity: 3 - Normal
Item Group: securityStatus: Fixed
Privacy: PublicAssigned to: Sebastien Helleu <flashcode>
Originator Name: Open/Closed: Closed
Release: 0.2.6IRC nick: 

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 03 Jan 2010 09:07:58 PM UTC, comment #2:

Done with task #7492

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Sun 16 Aug 2009 02:47:33 PM UTC, comment #1:

I understand your point of view (for me it's more feature request than bug).
It should be added after version 0.3.0.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Wed 26 Nov 2008 08:08:35 PM UTC, original submission:

More and more IRC servers are supporting SSL/TLS every day. I'm pleased to see more people taking an interest in their privacy and security. It is important to keep in mind how easily a man in the middle attack can take place, and therefore circumvent the entire purpose of the encrypted session.

As WeeChat is truly the geekiest IRC client; it seems appropriate that it have the most robust handling of encrypted sessions. Since many networks use a combination of round-robin DNS and self-signed certificates, I propose the following logic:

Best case is the certificate is signed by a trusted CA. If so, verify the certificate, display the trusted CA name and encrypted session statistics (public/symmetric key type and bit sizes), and continue connecting.

Typical case is the certificate is self-signed, and will vary depending on which server in the round-robin DNS the client lands on. In this case, display the encrypted session statistics (this time including the key fingerprints as well), and present the user with the option to continue for this session only, or to store the server certificate permanently.

Possibly add an option (for the truly paranoid/security minded) to ignore the OS's list of trusted CAs, so they can always verify key fingerprints manually. Maybe even later down the road, permit the encrypted storage of trusted key fingerprints (via keyring managers, etc).

Sorry if you guys don't consider this a bug, but I certainly consider it more of a bug than a feature request. I saw a feature request for something similar a year or so ago, but as far as I can tell no progress has been made. I would like this to be prioritized -- the net is an increasingly hostile environment. Thanks guys. Keep up the good work! :)

Gary D. Huffman, II <gdhuffman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by flashcode (Posted a comment)
  • -unavailable- added by gdhuffman (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 23 Jan 2010 09:58:58 AM UTCflashcodeOpen/ClosedOpen=>Closed
    Sun 03 Jan 2010 09:07:58 PM UTCflashcodeStatusPostponed=>Fixed
    Sun 16 Aug 2009 02:47:33 PM UTCflashcodeItem Groupother=>security
      StatusNone=>Postponed
      Assigned toNone=>flashcode
      Categoryother=>irc plugin

    Back to the top


    Powered by Savane 3.1-cleanup1