How secure are passwords that are set via IRC's /nicksrv?

Question

I just registered a nickname on IRC and had to use a password to register it. Given that I've only used IRC, but never understood the P2P mechanics of it, I'd like to know:

• Is the password I registered with Nickserv hashed, and replicated to all other nodes in the IRC network?

• Is there a salt for that password? (what is it?)

• Can anyone become a peer in IRC and see the hashed version of my password?

• If none of the above applies, and Nickserv is centrally run, who runs it?

• What other risks should I be aware of?

Answer 1

I can only speak for the UnrealIRCd that I helped run many years ago, but I'll give this a go:

• NickServ is a service bot running on a single node. It connects to all nodes so you can communicate with it without the plaintext password going over replication. As such, your password is only actually on one server.
• By default, NickServ passwords are hashed using MD5, no salt. We had a mod that used your email address as a salt, but don't expect much on most IRC servers.
• An IRC network's peer servers are privately networked, requiring a password and common configuration to link them together. You can't just start your own server and become part of the network without the network admins configuring it.

As far as risks go:

• Some servers use alternative nick registration (e.g. disable NickServ and make a bot that has the same name) so custom schemes are entirely possible. This might be a good thing, or a bad thing. It depends on the implementation, which is probably a black box.
• IRC traffic isn't encrypted or authenticated by default. You can configure SSL on the IRCd and client, though. I highly recommend doing so. The network should be using SSL for server-to-server replication.
• On older networks, you'll sometimes see bots like X for nick authentication. Some users do /nick NickServ to catch auth attempts. Make sure you read the MOTD and other docs before trying to authenticate.

Answer 2

As a semi-current IRCop, I wouldn't count too much on the security of the passwords. IRC is a protocol from the good old days of the Internet when security wasn't much of a consideration. If you aren't using SSL for your connection to the server, then it is going to be sent in the clear. A decent services config should limit how many servers have to have access to the information and rogue nodes can't simply connection, but security is generally an afterthought for most legacy systems on the Internet and IRC is no exception.