Admins spy users PM's?

Mary · SearchIRC Admin Joined: 03 May 2003 Posts: 692

Theres some interesting news on IRC-Junkie today. The article describes M_Spy, a module for UnrealIRCd beta19. Asmo quotes the author: "m_spy allows you to see users' private and channel messages (both PRIVMSGs and NOTICEs) sent from anywhere on the IRC network in real time." The rest of the article can be found on:

http://www.irc-junkie.org/index.php#newsitem1073592421,82974,

Comments?

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Not good. I won't be using it.

I was happy when they got rid of +I, and now someone has to do this.

Oh well, I don't use any modules for Unreal anyway, so it wouldn't matter to me, but I hope the author is kind enough to put something into the script that shows something to a user when they connect (ie in the version) so networks not running it can prove they aren't.

You know any network running Unreal will be assumed to be using it-although I figure most won't. I definetely won't.

I would also see the running of such a module as implied ability to monitor users actions, thus making the network running such module legally liable for anything going on, including stuff in PM. I wouldn't want to have such liability so thats a secondary reason to never use it, the first reason being simply ethical, PM stands for PRIVATE message.

tiko · none Joined: 24 Sep 2003 Posts: 49

In beta 19, the Unreal team made the /module command publicly available. Users can see for themselves whether or not the spy module is loaded.

Asmo · none Joined: 06 May 2003 Posts: 28

chrishogben · Lurker Joined: 09 Sep 2003 Posts: 218 Location: UK

I would just like to add, that i already know of a network that uses these methods. Although they clearly state on the main page they are doing this, sometimes it's easy to forget, and blabber something private to someone else. Whats more, they log all messages to a single channel on the network, and TAKE ACTION based on the messages going through.

Either this admin is very paranoid, or is doing his bit to stop everything illegal.

Just my two cents Smile

Rob_ · Idler Joined: 13 Dec 2003 Posts: 309

The problem with thinking that /modules being made public will help, at all, is that anyone can modify the ircd, they can modify the modules command to simply not show the questionable modules they use. There really is no way to be sure what you say in /msg is actaully private - unless you trust the admins of the network. Sadly there is no way a user can detect if there message's are being monitored.

On the issue of protecting the network, and fighing illigal activities etc, i'll merely quote Benjamin Franklin "Those who would sacrifice essential freedoms for temporary safety deserve neither." As most IRC based illigal activity would not take place on a network who a) are likly to monitor traffic, b) are small enough that its feasable for admins to monitor traffic c) is even publicaly accessable - it seems remarkably weak to attempt to use this argument as any form of justificaiton for this sort of privacy invasion, how will idea's grow if people are affraid to express new/un-conventainal ones? :)

Overall the existance of this module is a moot point (it may bring some discussion to this topic, which may be good as people will be more aware of it), some admins have been hacking there ircds to do this for years, others would rather close down thier whole network before allowing it, some attempt to draw a line somewhere in-between (this is a very dangerous line to try and draw, and in my opinion will almost always end up with you finding yourself standing on the side you didnt want to be on wondering how you crossed it without noticing).

Its alot like emails in a sense, everyone assumes emails are private, much like you assume your mail is, i read somewhere someone attributed that to the name, they claimed people should think of them more as "e-postcards" as the postman can easily read them as (s)hes delivering it :) The only way to be sure your as secure as you need to be, is for you to examine how private your messages are, and act accordingly, you may think about impleemnting client side encryption, public key cryptography is avaialbe in most contries now-a-days and can almost certainly be secure enough for any irc conversation, you may refuse to discuss certain topics on irc, or email, or even over the phone :P, but i strongly suspect most people just will carry on using irc to discuss whatever they wish, i know i will, and i can only hope they choose to do it on networks whos admins are open to frank discussion about what it is thier network actaully does to/for its users, alot of ppl will be supprised to find how helpful most (obviously not all) irc admins can be if you just ask them polite questions about the network.

I just thought i'd throw my 2 cents in, as i havent posted on any forums in a while :)

Rob

Shes · Guest

That's aint new. The only innovation that i may think is that's now a module... even if i'm sure it does exist for most current ircd in use. I once saw one similar for the ircu.

It looks like you are so innocents... It's quite common on major networks, even if we do not use any module.
It's all about what is said, and what is really happening.

Shes

Rob_ · Idler Joined: 13 Dec 2003 Posts: 309

i wonder how many admins would be prepared to say "yes, my network, <insert network name> does/can monitor user messages" - assuming the admins who do it, believe there is nothing wrong with doing it, i would assume they wouldnt mind admiting to it too? :)

Rob

Jason · Posted: Jan 09, 2004 10:18am Post subject:

It has always been understood that IRC is not secure. It takes one line of code to add in the ability to log messages, but because of the way IRC routes messages, you only have access to data that deals with your server in some way, or if your server is between two servers that have data going through them.

DCC Chat is better, at least if you want to omit the IRC network from your discussions.

You can take even further steps, but it begs the question of why one who requires such confidentiality would be risking their discussions on a public chat server in plain text.

Mary · SearchIRC Admin Joined: 03 May 2003 Posts: 692

Asmo brings up some very good points. This is a useful tool fighting abuse... but at what cost?

SdgNem · none Joined: 22 Oct 2003 Posts: 23

Shes · Guest

mregit, the network you are talking about is concerned with this topic. The admins who does won't ever admit it... even if it's for fun or drones related.

tcpdump is our friend.

Shes

SdgNem · none Joined: 22 Oct 2003 Posts: 23

Of course network administrators that run UnrealIRCd and this module are going to be concerned with word of this module getting public attention. I know that I would be if I was still using this module but I realized that to me, the cons of this module outweighed the pros of it as far as ethics goes. It really isn't and wasn't meant for this feature be available in this IRCd, which is why the Unreal coding team took out +I to begin with and won't put it back and haven't made any way for administrators that run this IRCd able to readily download through a module or otherwise. This was written as a 3RD party module and really shouldn't have been released to everyone that wanted it.

moonman · Lurker Joined: 15 Jul 2003 Posts: 212

i wont run it, ever. one of the worst things ive heard, ethically speaking, in a while to come out in an ircd.

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Of course, the implied reasoning with this module is anyone running Unreal will be running it.

All its going to do for my network is cause more support issues, more explanation that we have an acceptable use policy prohibiting any mode or module that allows user spying.

I'm glad to hear people can check themselves-then at least I can prove we're not running it.