1. Home
2. Usenet Glossary
3. Privacy & Security

What encryption on a Usenet connection does and does not do. This section defines TLS, ports, certificates, cipher negotiation, and account security, and is written to be accurate about the limits of each rather than reassuring, because the difference matters.

Search the Usenet glossary Search

27 terms in this category.

Encryption in Transit

Protection applied to the link between a newsreader and a news server, normally TLS on port 563. It conceals article content, group names, and credentials from anyone watching the network in between, including an access provider. The server at the far end still decrypts and processes everything, and the fact that a connection was made to that server's address stays visible.

TLS Certificate

The digital document a news server presents when an encrypted session opens, binding its hostname to a public key and carrying the signature of a certificate authority. Newsreaders check the name, the expiry date, and the signing chain before continuing. A mismatch, a lapsed date, or an untrusted issuer produces a certificate error and either a warning prompt or a refused connection.

Cipher Suite

The negotiated bundle of algorithms an encrypted NNTP session uses for key exchange, authentication, bulk encryption, and integrity checking. Client and server settle on one during the handshake, choosing the strongest both support. Modern suites built on AES-GCM or ChaCha20 cost little processor time even at gigabit speeds, while obsolete RC4 and 3DES suites are switched off on current servers and cause handshake failures with dated clients.

VPN

Short for virtual private network: an encrypted tunnel carrying a machine's traffic to an operator's server, which forwards it onward. The local access provider sees a connection to that operator and nothing about destinations beyond it, while the operator sees what the access provider otherwise would. It relocates who holds the connection records rather than eliminating them, and changes nothing about what is lawful.

VPN with Usenet

Running newsreader traffic through a tunnel in addition to, or instead of, TLS on port 563. Since NNTP over TLS already hides content and group names from an access provider, the tunnel mainly changes which network observes the connection to the provider. It adds a hop, frequently costs throughput on high-speed lines, and has no effect on the provider's own records.

ISP Throttling

Deliberate rate limiting applied by an access provider to traffic classified as bulk transfer, historically including plaintext NNTP on port 119. The symptom is a download that plateaus far below the line rate, often only during peak evening hours. Encrypted sessions on port 563 defeat classification by payload, but destination address and sheer transferred volume remain visible, so shaping can still be applied.

Deep Packet Inspection

Inspection of packet payloads rather than addresses alone, letting a network operator classify traffic by protocol signature and apply policy accordingly. Plaintext NNTP on port 119 is trivially identifiable this way. TLS defeats payload inspection, but destination address, port number, connection timing, and transferred volume stay exposed, and those alone often suffice to guess what a session is carrying.

Anonymous Posting

Posting an article without a traceable identity in the From or Path headers, historically arranged through remailers or mail2news gateways. The injecting server still records the originating address, and providers keep posting logs to answer abuse complaints, so the practice conceals an author from other readers far more effectively than from the server operator. Most of the supporting infrastructure has shut down.

Anonymous Remailer

A relay that stripped identifying headers from a message and re-sent it under a generic address, letting people post to Usenet or send mail without exposing an address. Early cypherpunk designs gave way to chained, encrypted Mixmaster systems in the 1990s. Legal pressure, abuse, and the shrinking of text Usenet closed nearly all of them; the few survivors carry little traffic.

X-No-Archive

A header a poster could add, set to yes, asking archiving services not to retain the article beyond its normal expiry on news servers. Compliance was always voluntary: large archives honoured it, private mirrors and search sites often did not. Because copies propagate to thousands of servers within seconds, the header never guaranteed disappearance, and text quoted into replies survived regardless.

Header Privacy

What an article's headers disclose about its author. From, Organization, User-Agent, a Date carrying a time zone, and the injecting site recorded in Path each narrow an identity, and Message-ID formats have historically leaked hostnames or precise timestamps. Servers rewrite or append headers during injection, so a poster never fully controls the set that eventually propagates across the network.

PGP

Pretty Good Privacy, a public-key system released in 1991 for encrypting and signing messages, later formalised as the OpenPGP standard and implemented today mainly by GnuPG. On Usenet it mattered less for encryption than for signatures: control messages, moderated-group approvals, and periodic FAQ postings carried PGP signatures so that servers and readers could confirm an authorised sender before acting.

PGP Signature

A block appended to an article that cryptographically binds its text to the holder of a private key. Anyone holding the matching public key can confirm the content was not altered in transit and originated with that key. Authentication runs to the key, not to a legal identity, and nothing is concealed: a signed article stays fully readable by every recipient.

PGPMoose

A mid-1990s scheme letting the moderator of a moderated newsgroup sign approvals with a shared key, so news servers could automatically reject forged Approved headers. It reduced the flow of articles slipped into moderated groups without passing a moderator. Running the checks required patched server software, adoption stayed narrow, and almost no site verifies these signatures today.

Cancel-Lock

A header scheme, standardized in RFC 8315, letting a poster prove authority to cancel or supersede an article. The original carries a hash commitment, and a later cancel carries the matching secret for servers to verify. It replaces the classic arrangement in which any party could forge a cancel for anyone else's article, and it explains why many servers now discard unauthenticated cancels.

Sender Authentication

Any mechanism for confirming an article genuinely came from the party named in it. Usenet's original design had none, since headers were trusted as written, which made forgery and sporgery straightforward. Later additions such as PGP-signed control messages, PGPMoose approvals, and Cancel-Lock covered narrow cases. Ordinary article headers remain unauthenticated, so a From line on its own proves nothing at all.

Credential Stuffing

Automated login attempts using username and password pairs leaked from unrelated breaches, on the assumption that people reuse them. This is how Usenet accounts are actually taken over in practice, far more often than through any attack on the encrypted connection. Warning signs include unexplained usage on a metered block and connection-limit errors from sessions the owner never opened.

Two-Factor Authentication

A second login step beyond a password, usually a time-based code generated by an app. On Usenet services it normally guards only the billing or control panel, because NNTP itself has no standard second-factor mechanism and newsreaders authenticate with a plain username and password over TLS. Many providers therefore issue a separate NNTP password so one leak does not expose the account portal.

Malware in Binaries

Hostile executables distributed inside posted archives, sometimes disguised as installers or codec packs, sometimes hidden in password-protected files that resist scanning. Binary groups carry no moderation or reputation layer, so nothing filters what is uploaded, and an NFO file or a filename can be fabricated as easily as the archive itself. Scanning after extraction remains the only practical check.

Fake Release

A post whose name, advertised size, and NFO describe one thing while the archive holds something else, typically padding, advertising, or malware. Fakes persist because a release name is only text and nothing on Usenet verifies it. Indexers depend largely on user reports to flag them, and a mismatch between claimed size and actual article count is an early signal.

Port 443 Fallback

Offering encrypted NNTP on TCP port 443, the number normally used by HTTPS, for networks that block or filter 563. The protocol inside the tunnel is unchanged; only the port differs. It works because restrictive networks tend to permit 443 unconditionally, though an operator using deep packet inspection or address-based rules can still recognize and block the sessions.

Self-Signed Certificate

A TLS certificate signed with its own key rather than by a recognized authority, so nothing independent vouches for the hostname it claims. Clients reject it by default and report a certificate error. Small or private servers sometimes use one, and accepting it means trusting a key on first sight, which leaves the session open to anyone able to substitute a different certificate.

Certificate Pinning

Configuring a client to accept one specific certificate or public key for a server instead of anything a trusted authority happens to sign. It blocks interception by a rogue or compromised certificate authority, a realistic concern on managed corporate networks. The cost is upkeep: when the server renews its certificate, the pin must be updated or every connection fails with a certificate error.

Password Manager

Software that generates and stores a distinct random password per account behind a single master secret. For Usenet accounts the practical benefit is blunting credential stuffing, since a password reused nowhere else cannot be harvested from another site's breach. It also makes long provider-issued NNTP passwords workable, given that newsreaders store credentials in plaintext or lightly obscured configuration files.

Account Compromise

Unauthorised use of a Usenet account, almost always following password reuse or sharing rather than any break in the encrypted transport. The symptoms resemble oversubscription: refusals once the connection limit is reached, a metered block draining faster than expected, or logins from unfamiliar addresses. Remedies are a password change, removal of stale IP authentication entries, and terminating active sessions.

TLS Version

Which revision of the transport security protocol a session negotiates. SSL 2 and 3 along with TLS 1.0 and 1.1 are deprecated and disabled on current news servers, leaving TLS 1.2 and 1.3 in ordinary use. Version 1.3 drops obsolete ciphers and shortens the handshake to a single round trip, which helps clients opening and closing many connections.

Perfect Forward Secrecy

A property of key exchange, obtained through ephemeral Diffie-Hellman, in which every session derives a key that is discarded once the session ends. Should a server's long-term private key later be stolen or compelled, previously recorded traffic still cannot be decrypted, because that key never encrypted it. TLS 1.3 requires the property; under TLS 1.2 it depends on the negotiated cipher suite.

See the full Usenet glossary.