Is it secure to use PJIRC chat?

Hi,

Is it secure to use the IRC applet on a website?

The files are:
irc.cab/.jar
pixx.cab/.jar
irc-unsigned.jar
secured-irc.cab
secured-unsigned.cab

Or will a hacker could use the accss or commands through the chat to compromise the security of a IIS server?

If You know of some security issues, please summarize them and list a solution, if You know them :)

Maybe its secure if whole website is through SSL?
Or maybe I should use specific securedirc files?
loopstudioAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

PhateonCommented:
Any HTTP is NOT secure. It is always suggested that you use HTTPS. pjIRC per se is a project which has been developed with clear non-malicious intentions. However, if you were to unpack & recompile them .java archives, you can create a backdoor. It is always good to use a site which is trusted rather than using a site which is not trusted.
0
loopstudioAuthor Commented:
A)
So I hear You say.. If the whole site is in HTTPS and the PJIRC files are downloaded "as is" from original website, then everything should be as safe as possible?

B)
and/or do I need to do something specific to use the
secured-irc.cab
secured-unsigned.cab
files? Or will PCIRC work fine and secure in normal setup?

C) So all the commands thats possible to fire/write in the chatwindow, there should be no security-compromising commands?
0
loopstudioAuthor Commented:
an D)
Isnt there something about that people can log on to my chatgroup from whatever chat-client, maybe not using PCIRC, and will it through that way be unsecure?
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

PhateonCommented:
What I meant was, if you use plain HTTP, people can sniff, edit, replay,etc. your HTTP session.
With an HTTPS session, you are better off! They can only replay.
0
Dave HoweSoftware and Hardware EngineerCommented:
the traffic is not secure - ie your traffic to the IRC server is no more secure than it would be if you were using a local client (such as chatzilla or mirc)

however, the applet does not induce any vulnerabilities in your webserver - you are merely serving it, like any other web page or content, and it runs locally on the remote machine.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
loopstudioAuthor Commented:
ok, so its just the "text" that poeple write forth and back in the chat traffic that can be sniffed?
And nothing can go through to my webserver, even I have their cab & jar files on my server?

If the above is true, I will close and reward points :)
Thanx
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Security

From novice to tech pro — start learning today.