[liberationtech] Stop using public IRC networks

[carlo von lynX]

*** Why we should move away from public IRC networks:

Even for things as simple as discussing the furniture of our office space we should not let our discussions go straight into XKEYSCORE. On mailing lists there is a rough chance of staying on topic but in chatrooms it is inevitable to also chat about private things, disclose information about our friends. Things that by human rights charters we are not allowed to share with Big Brother. We didn't break the Internet, but we have a responsibility to take measures, anyway.

On public IRC networks surveillance is likely to happen. Even if all participants use TLS to connect to the servers, most of the IRC servers in the network will see a copy of each spoken message. Even so-called private messages travel the backbone and stop by a lot of servers, so OTR is good - but still helpless about your metadata and about the public exchanges you have about where to go in the evening or how you got distracted from work. Excellent food for the JTRIG and KARMA POLICE agency programs.

With so much interesting and competent content going in and out of popular IRC networks it is naive to expect that agencies have neither broken into any of the servers (one is mostly sufficient - depending on the tree structure - to scoop up most of what happens on the entire network), nor have they set-up a MITM attack by which servers are confronted with falsified certificates and likely silently engage in fully surveilled interaction. I would be surprised if any IRC server were to do certificate pinning, probably just like most XMPP implementations it doesn't even check the validity of the certificate. It is therefore really really easy for a global attacker to get a complete view of the communications happening on an IRC network. Let alone that any individual operator of the servers can himself be targeted by KARMA POLICE or JTRIG, thus granting access to the authorities "voluntarily."

Chat server networks were built on trust, and trust is a very erosive concept. We must conclude these networks are securitywise a failure. Both in the case of XMPP and even more so with IRC.

It's really not that hard and there is nothing so public about a chatroom that it deserves forever storage, forever being available as material that can be used against us and offers zero space for true social interaction - unless we want to shoot ourselves in the foot and disclose private social things to the insolent constitution-disrespectful authorities.

*** Where can we go to have a private chat?

In a post-Snowden world, where can we go to quietly idle and occasionally chat like we have done for decades? In our opinion there are two answers. On isolated servers, if you have a reason to trust the server, or on a distributed chat system. Unfortunately the latter are still in dire conditions. See the secushare comparison for that.

It should go without saying that using any commercial offering such as Whatsapp or Facebook is likely worse than using an IRC network. Maybe Telegram chatrooms are at least safe from the Western authorities.. so for once it is somebody else snooping on you.

*** Is IRC Safe From Bulk Collection?

The IRC protocol as such isn't any better or worse than other unencrypted-by-default protocols as long as you keep your hands off the interserver connectivity features. So any isolated IRC is fine, just as any isolated PSYC server. Maybe PSYC offers a few more practical features.

It is rather unlikely an agency would make an extra effort in targeting a solitary server that is doing its job for a tiny mostly harmless community – unless you placed it in a hosting center that gets scooped in its entirety anyway. Should the server have obvious vulnerabilities, then it is still a welcome target for systematic intrusions such as HACIENDA, but if it is a well-kept up to date free software system it is strategically very unreasonable to use up a 0-day vulnerability or backdoor just for a few conversations more – especially if the targeted community features competent hackers that might just recognize the method employed and document it publicly, thus making the 0-day invaluable for future use.

So it really doesn't make as much sense to attack a small community of hackers as it totally makes sense to collect a public IRC network's low-hanging fruit. 

So we recommend to everyone who runs a channel on any public IRC network, no matter which, to please consider setting up an isolated chat server system instead.

Best regards from youbroketheinternet.org.

Version with hyperlinks available at http://about.psyc.eu/IRC


P.S. Aymeric: liked your last post, just not finding time!

-- 
  E-mail is public! Talk to me in private using encryption:
         http://loupsycedyglgamf.onion/LynX/
          irc://loupsycedyglgamf.onion:67/lynX
         https://psyced.org:34443/LynX/