search

ircv3 / ircv3-ideas

46 stars 3 forks source link

Alternatives to WebPKI #50

Open GIJack opened 5 years ago

GIJack commented 5 years ago

The Web PKI is great because it comes default with everything. Its not so great because it has quite a few known weaknesses. In addition it only works on the public internet. It's pretty useless on TOR(yes, I know you can get a .onion signed), I2P, VPNs, and LANs

idea:

Optional spec for clients to add certificates per server at config time. This solves the use case of a private server on a private network such as a VPN or LAN.

RyanSquared commented 5 years ago

This is very on the edge of "out of scope" for IRCv3. There's no capability, no stuff changed for the protocol itself. I think this would probably be better for something like ircdocs and (self-promo) ircdocs/best-practices where this client UX could be standardized.

SadieCat commented 5 years ago

Client UI design seems pretty out of scope for IRCv3.

Also, if you're on a private server that isn't internet accessible you can make your own CA and provide root certs for your users to install (or install them automatically if you control the hardware).

edk0 commented 5 years ago

I agree that this is out of scope. On a technical note, though, Tor and I2P have network-layer security already; it'd seem redundant to specify a way to use certs on top.