Are you implying that discord, slack, et al have a better privacy model?

Signal, keybase, iMessage all have a better privacy model.

Signal requires a phone number. Keybase is an identity service. iMessage requires a phone number and is not verifiable.

IRC on the other hand allows ephemeral usernames, you have the option to use e2e encryption if you choose, etc.

iMessage doesn't require a phone number. You can use it with just an email address.

I mean, you do need an Apple ID to do it that way. But I don't think there's anything stopping you from creating throwaway Apple IDs.

> "... IRC has no real place in the world of someone hoping to preserve their privacy."

Why is that? IRC supports SSL, of course, and many IRC networks offer "cloaks" (to hide your IP address from other users) and/or permit connections via Tor.

The privacy story for SSL is no better than the privacy story that Slack offers. Basically, you're proposing a level of privacy that only asymptotically approaches the most popular unencrypted web chat program in the world.

Cloaks aren't reliable and there are a few tricks to uncloak a user anyway.

I think this is getting aside of the topic of what privacy really is for most people. IRC by default does not encourage endless selfies or oversharing that the modern social networks promote.

I've never seen an ircd cloak instruction page misrepresent what they can and cannot do. While protecting IP addresses is important (which the GDPR also believes in), I think it's also important to not lose perspective of the bigger dangers out there right now such as default user behaviour and conditioning. For example, IRC has never led to huge numbers of people publicly humiliating themselves by bitching about their employers, etc.

Tricks? Can you elaborate?

Like what outside of taking the scope outside of the IRC client (external link, etc)

An IRC cloak is programmed into the ircd itself ensuring that ones IP address is not exposed. I don’t think you can just hack that. If you use the external link trick, everyone is susceptible to that no matter what app/platform they use unless you use a VPN or Tor.

That depends on the ircd, but on Freenode you could decloak using the services to ban the user from channel using IP ranges and see if they trigger (I think. It has been a few years since I this trick used, and it might've not even been bans). Extremely inefficient, but if you have a bouncer with auto rejoin on...

In any case there are some really obsessed people who probably know a hundred ways to take over your channels at the very least. Seeing some of these people do their thing is one of the reasons why I steer clear of IRC these days.

Channel takeovers aren't really a thing on modern networks with good services.

The Freenode decloak trick still works, though.

Speaking as a freenode staffer:

1) There are a number of ways to decloak somebody purely via irc/ircd fuckery - though it's liable to require several minutes of dedicated effort to do so.

2) There's a non-zero likelihood that if you try any of those ways we will spot you and k-line you.

3) That likelihood is not a guarantee, so when cloaking people we always make sure to warn them first that cloaks aren't 100% reliable and if users really want to protect their IP address they want a VPS, a VPN, or tor.

4) No, I'm not going to be any less vague about 1, just because it's not actually hard doesn't mean I want to encourage it.

“Supports” is the real non starter. “Requires” is what we are looking for.

Most networks support a channel mode that only lets people connected to the server via SSL join the channel.

Some networks only let people connect via SSL.