Open DarthGandalf opened 9 years ago
Comment by ctrlaltca on 18 Mar 2012 19:53:03 The basic kvirc support for ssl is meant to provide communication security, not authentication. If you want to implement authentication, it can be done using scripting: please have a look at [http://www.kvirc.ru/forum/topic,1095.0], ticket #1170, revision r5889 Hardcoding certificate fingerprints inside kvirc is probably a bad idea, due to out slow release cycle. Adding a dynamic certificate datastore to kvirc, some certificate checking facilities and maybe providing some base certificates is probably a nice idea. Or could provide a way to interface with the system certificate datastore.
Comment by wodim on 05 Apr 2014 13:59:54 This is a complicated matter. Most servers with SSL use a self-signed certificate anyway.
My opinion is that two things can be implemented:
Modified by HelLViS69 on 02 Jan 2015 14:50:35 Version: 4.0.4 Insomnia → 4.2.0 Equilibrium
Comment by DarthGandalf on 03 Feb 2015 00:00:02 https://github.com/znc/znc/issues/156 and http://www.cs.utexas.edu/%7Eshmat/shmat_ccs12.pdf for some background and possible solutions.
+1 for the proposed suggestion above. In fact +1 for upgrading this to higher priority.
Yes please :+1:
There's plenty of ideas, just needs a brave, talented and willing developer who has interest in this with spare time to spare to implement it. That is the only stopper for all these reports ;)
We have $context.getSSLCertInfo
already supported in KVirc http://www.kvirc.net/doc/fnc_context.getsslcertinfo.html so that should help some.
This is a security related bug for KVIrc, and should be fixed in the next public release.
hahahahaha hilarious 5 years on not even development versions support any better or more robust methods. IMO its terrible, but there we have it
edit removed all the extra labels, I could just wack 50 labels on it, but that wont help devs take any action into this issue
Inspired by ZNC: store the server's fingerprint (this is, the result of $context.getSSLCertInfo(fingerprintContents, remote)
) in serverdb.kvc. On connection, if the fingerprint in serverdb.kvc is different from what the server is sending us, ask the user what to do (trust this time/trust always (would store the new fingerprint in serverdb.kvc)/abort).
I wonder though if networks with many servers have different fingerprints for every one of them.
Reported by da2ce7 on 17 Mar 2012 02:45:10 UTC In the current version of KVIrc, the program will blindly connect to the same server with a different SSL certificate. (Identified by its Fingerprint).
This is a major security issues, as people connecting to their bounces may get their password stolen, or connecting to IRC servers, have their nick-server passwords/identities/channels taken from them.
KVIrc should follow the standard practice used by SSH:
(Maybe KVIRC should ship with a list of known good SSL certificate fingerprints, for the popular servers, such as Freenode.org)
If KVIrc just displays a warning however connects anyway, the damage is already done, as the malicious attacker already has the passwords, and identification information.
This is a security related bug for KVIrc, and should be fixed in the next public release.
Migrated from: https://svn.kvirc.de/kvirc/ticket/1274
Edited Thu 4 Aug 15:08:40 UTC 2016
A shortlist of ESSENTIAL SSL support bits.
in short a better way to manage SSL connections and all related tasks