IRC-Junkie.org - IRC News » Webchat

Mibbit has been compromised

Kottizen — Sun, 14 Aug 2011 10:15:11 +0000

On August 14 a cracker group claiming to be “hackers” named HTP broke into Mibbit, the popular web chat client for IRC. According to their temporarily “rescue” blog the break-in only affected their IRC network, their primary blog and their Wiki. NickServ passwords in clear text were released later the same day by the HTP, as well as personal information regarding several staff members. Both their IRC O-line passwords as well as their NickServ passwords, home addresses and phone numbers were published to the public via a range of file hosting services, and Pastebin.

Something perhaps even more concerning is that the group has revealed not only channel logs, but logs of private messages. It appears like Mibbit has been logging what people have said in PM to each other over their network. According to official statements, this was only a test. Some people have heard that Mibbit has been logging all messages going through their systems. Mibbit has never logged anything, unless a user wants to enable logging. The leaked message logs were captured by a staff member, and not by Mibbit’s system, according to official statements. While this is fully legal, the level of ethicality has been questioned.

The web IRC client that can be used to connect to almost any other network, which is what made them famous, has not been affected. It is operating normally.

All NickServ passwords were stored in plain text, and that raised a concern for those who are interested and engaged in enforcing security. According to staff member pottsi password hashing was not done because that would “means sendpass and getpass would not work”. Another staff member, Joshua, claimed that password hashing was not done because it was too much work to convert all passwords. This has however proven to be incorrect, at least if they used a plain copy of Anope. In Anope’s module database, there is a module called enc_switchover. It’s fairly easy to migrate from one encryption method, or none, to another, using that module. In addition to that, the Anope module ns_resetpass will allow users to reset their passwords despite encryption taking place.

Many people, especially IRC administrators, are now questioning Mibbit’s reliability and some are considering to block access from the web service, just like one of the largest networks, freenode, did a couple of years ago. This is mainly due to the question whether they log messages there too, which would go against many networks’ policies.

The Mibbit team is now working very hard to bring all services back up again. At the time of writing, ChanServ and NickServ on their network is down and staff members are forced to use /samode if they need to get op. They advice everyone who had a NickServ account registered in April or earlier, this year, to change password.

Mibbit has been compromised is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

lightIRC 0.9.9 released

phrozen77 — Sat, 03 Apr 2010 17:41:49 +0000

The free Flash IRC client lightIRC has been released on April 1st and that totally wasn’t an April Fools joke.

lightIRC 0.9.9 Channel View

The webchat client adds new translations for Greek, Portuguese, Italian, Catalan and Bulgarian and is now available in a whopping total of 20 languages.

The need to access an authentication-file on lightirc.com has been removed and therefore it can now run on a LAN without any kind of Internet-access.

lightIRC 0.9.9 Channel Central

There have been a few miscellaneous fixes and a little code cleanup according to author valentin and the changelog also mentions a feature removal – The proxy feature has been dropped since it wasn’t “running good enough for production environments”.

The download of version 0.9.9 as well as the complete changelog can be found here.

lightIRC 0.9.9 released is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

wsIRC Webchat is now at version 1.0

phrozen77 — Fri, 19 Feb 2010 16:46:27 +0000

wsIRC, a new webchat client, is now at version 1.0 – their first release version.

wsIRC Channelview

As you can see from the screenshot, the most important functions are already there: right-click menus for miscellaneous functions such as /WHOIS or /PRIVMSG’ing users, a Channel-Central to handle the most basic modes and bans. Registering your nick or channel through a simple popup is implemented and the usual buttons for smileys, font-color and style are available too.

Even without registering, your settings are remembered (if you wish to do so) and available when you go online the next time. If you register with wsIRC you can even create simple client-side scripts which you then can use anytime you log on IRC with their client.

Another nice toy that has been implemented is what happens when someone posts a link to a YouTube video: you’ll then see a small preview picture of it in the channel or PM window – neat!

Embedding the client into your own website is allowed and encouraged – there’s a simple tool that lets you create an IFrame or direct link with the options you chose which you then may embed into your site – great for providing your visitors a simple option to engage in your community.

wsIRC Embedding Code Generator w/ Preview

To keep abusers at bay, the service puts your real IP into the GECOS/realname field and also checks the DroneBL DNSBL.

The webchat also offers a mobile version which works on iPhones and Windows Mobile devices as well as others when “a good JavaScript support is offered”.

All in all i really have to say it’s a nice client, even more so when you consider it is just at version 1.0 – i’m curious what more they can come up with

wsIRC Webchat is now at version 1.0 is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

lightIRC Flash webchat releases 0.9.8

phrozen77 — Sun, 07 Feb 2010 13:38:02 +0000

The lightIRC project just released version 0.9.8 of their free Flash webchat which contains a bunch of bugfixes and feature additions.

lightIRC Webinterface

The biggest improvement probably is that the client now offers “basic SSL support” which is still marked being beta at this point.

A whole host of new parameters for better customization has been added – you now can predefine the ident, realname and quitmessage the client uses. Also a new translation has been added, lightIRC now speaks Polish

A detailed changelog as well as the download can be found here.

lightIRC Flash webchat releases 0.9.8 is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

lightIRC Flash webchat is updated to version 0.9.7

phrozen77 — Sun, 17 Jan 2010 08:48:42 +0000

The lightIRC project just announced a new version of their Flash webchat, 0.9.7, which has the “longest changelog ever” and that it is “going straight to version 1.0″.

The list of bugfixes and feature additions is indeed pretty long – two new translations have been added (French and Albanian), you can now save your nickname and preferences so it remembers them once you come back and it also supports highlighting of your nickname now – to name just a few.

The UI also had a few usability improvements – /whois output in the user central looks cleaner now and the default bans are now set to match *!*@host instead of nick!*@*.

The full changelog as well as the download can be found here.

lightIRC Flash webchat is updated to version 0.9.7 is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.