I'm a newbie to Bitlbee, using it with libpurple to aggregate all my messaging. It's very cool, but I have some security concerns, which I'd like to clarify.
When connecting from an IRC Client (I'm using weechat.el on emacs) to a local Bitlbee gateway it seems I cannot keep the infomation encrypted end-to-end due to Bitlbee's lack of support for client SSL?
This means information is transmitted in cleartext:
weechat.el --SSL--> WeeChat(Relay) --PLAIN--> Bitlbee --SSL--> |Firewall| --> Skype/Facebook
The only advice I can find relates to securing the connection from an external network, using stunnel. Whilst good advice, this is no use locally as stunnel will ultimately still talk to bitlbee over an unsecured connection, so having a local stunnel is surely a waste of time?
I understand that having an unsecure localhost connection is a relative low risk, but it does mean that identification of the user on the client and any messages sent can technically be sniffed over the lo interface, by someone with root access to the server?
In an ideal world this information would never appear across any connection in cleartext.
A few questions I have
Is it possible provide end-to-end SSL encryption from client to Bitlbee?
If not, what steps beside co-locating the client and server on the same server (or using stunnel) are recommended? Obviously I can block all incoming traffic on port 6667, but is there anything else?
Can anyone clarify the actual risk of packet sniffing on localhost connections?