Earlier quoted context omitted.
Isn't that Android only?
The iOS client will (hopefully) be released in the next few months.
John McAfee releases secure anti-surveillance messaging app ‘Chadder’
51–60 of 68 posts
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#52I think the biggest problem here is that the application claims to be "anti-surveillance" yet it doesn't really solve the surveillance problem, namely meta-data. If anything this application helps surveillance by filtering out the communication from "regular" communication. We have had encrypted messaging for ages now. I cannot tell what's new here.
Has anyone even publicly discussed how to mitigate metadata collection? I don't recall any such discussion, but this also isn't really my area of interest.
I'd imagine a system that's completely a p2p mesh network. "Oh, hello, peer. I have 17 blocks for delivery on the network." Those 17 blocks might be pieces of messages for said peer; they might be destined for other nodes anywhere in the network; maybe they're noise. And don't forget to hand those blocks off to other nodes as well, because maliciously dumping blocks could be a thing...
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#53Oh wow. It uses a very innovative REST key exchange protocol. Encryption: * Messages are encrypted with AES 128 CBC * Random key for each message * The AES key is sent to the server, and exchanged for some key-id * They key id is prepended to the message Decryption: * Split message into key id and encrypted part * Download key from server * Decrypt message Edit: Decompile it to see for yourself
It's based on "scrambls", and they have a description of their protocol here:
https://developer.scrambls.com/bin/view/Main/P4ComponentInte...
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#54Even if it's not directly relevant to the product in question but I always think it's a bit weird to promote a "secure" product and don't even have SSL enabled on your own website. It's not like it's expensive to get a simple certificate these days.
It doesn't ask you for any information. What would be the benefit of enabling SSL?
SSL is not only for secrecy, it provides integrity as well.
For example: You cannot be sure the links are valid. The javascript- and/or youtube iframe might be modified/malicious.
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#55Do the phones have to be online at the same time in order to send the first key or does a Chadder server distribute the keys to each pair of users but simply not store the key after it's distribution? Sorry if this question sounds ignorant, the details and best practices of encryption are way over my head.
Their server stores all the keys
https://developer.scrambls.com/bin/view/Main/P4ComponentInte...
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#56I think the biggest problem here is that the application claims to be "anti-surveillance" yet it doesn't really solve the surveillance problem, namely meta-data. If anything this application helps surveillance by filtering out the communication from "regular" communication. We have had encrypted messaging for ages now. I cannot tell what's new here.
Has anyone even publicly discussed how to mitigate metadata collection? I don't recall any such discussion, but this also isn't really my area of interest. I'd imagine a system that's completely a p2p mesh network. "Oh, hello, peer. I have 17 blocks for delivery on the network." Those 17 blocks might be pieces of messages for said peer; they might be destined for other nodes anywhere in the network; maybe they're noi…
Not really my topic either but I guess messaging via TOR or alike is the best solution.
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#57Having access to source is no guarantee of security or correctness (see Heartbleed) but relying on any of these secure messaging apps seems optimistic. Writing correct crypto code is hard and John McAfee's involvement offers no assurances.
Yes. And this is a college project that uploads all keys to their backend.
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#58Some observations:
- This uses an external service 'scrambls' (https://scrambls.com/) which seems to do per-message symmetric key management. Therefore, the owners of this service can read all your messages.
- The thing which seems to be sent along with the ciphertext is an 'XID' which is sent to scrambls and exchanged for the raw AES message encryption key. There doesn't seem to be any binding to the recipient in this step(?)
- The encryption of messages is AES-CBC with PKCS#5 padding. There is no message integrity, so therefore this provides no confidentiality under CCA2.
In conclusion, this is the sort of thing you should expect from a secure messaging app. (TextSecure excepted.)
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#59Earlier quoted context omitted.
Libre isn't prerequisite either. Access to buildable source is.
Doesn't libre require access to source code? According to the free software definition [1], it's one of the essential freedoms: >The freedom to study how the program works, and change it so it does your computing as you wish. Access to the source code is a precondition for this. [1] https://www.gnu.org/philosophy/free-sw
Absolutely, libre implies code.
Access to compilable code can happen in more ways than fully libre release though.
I think that is what the parent post to yours meant.
Re: John McAfee releases secure anti-surveillance messaging app ‘Chadder’
#60Oh wow. It uses a very innovative REST key exchange protocol. Encryption: * Messages are encrypted with AES 128 CBC * Random key for each message * The AES key is sent to the server, and exchanged for some key-id * They key id is prepended to the message Decryption: * Split message into key id and encrypted part * Download key from server * Decrypt message Edit: Decompile it to see for yourself
[deleted]