If I run an IRC server, and my friend and I connect over TLS and chat, is the conversation essentially end-to-end encrypted because all computers that see the plaintext messages are owned by one of the participants?
1
-
Related: If you and your friend each run a TLS web server, the two if you can communicate very securely (without IRC). See security.stackexchange.com/questions/256443/…– mti2935Jul 31, 2022 at 14:09
Add a comment
|
2 Answers
No. End-to-end encryption means that the middle man cannot see anything. Even if you own the IRC server, it is not end-to-end encrypted. It's probably safer than using a public IRC server, but not as safe as using OTR or another client-side text encryption plugin that supports IRC.
The fact that the IRC server has access to your communications means it is, by definition, not end-to-end encrypted. Just because you trust the server doesn't change this.
-
What if the client program runs on the same machine as the server? e.g. I allow port 6697 on my router, I connect to localhost:6697, my friend connects to <my ip>:6697– SomeoneJul 30, 2022 at 22:54
-
@Someone In that case it boils down to semantics. If you define your system as one "end" then yes. If you only define the process itself as the "end", then no. For all intents and purposes, yes.– forestJul 30, 2022 at 22:55
-
okay. So in that case it is as secure as "real" e2ee, but depending on the definitions one uses it might not be "real" e2ee?– SomeoneJul 30, 2022 at 22:56
-
@Someone If you trust your computer, then yes. It is effectively e2e because there is no 3rd party that has any access to the plaintext data.– forestJul 30, 2022 at 22:56
-
Okay. I've used IRC on a LAN with the router, server, and one of the clients all running on one device (my phone with mobile hotspot enabled, running a server in Termux and a regular Android client), and the other user was connected to my hotspot. I was using an encrypted WiFi connection, but not TLS. Is that effectively e2ee?– SomeoneJul 30, 2022 at 22:58
No, IRC isn't end to end encrypted.
End to end encryption is not something you see usually. A few communication applications use it, because is something difficult to implement, and most use cases don't need it.
On IRC, the connection between the clients and the server are encrypted, but the server holds the keys to every connection. The server have access to the clear text of every single message.
The owner of the server have plaintext access to every single message sent on the server. Unless the clients themselves are encrypting the messages before sending, the owner have access to every single one of them.
It's the same with email, with FTP servers, with almost every online chat service...
answered Jul 30, 2022 at 22:46
-
1...Unless the clients themselves are encrypting the messages before sending. Jul 30, 2022 at 22:51
-
1