Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BitTorrent Chat - Private instant messaging via secure, distributed technology

labs.bittorrent.com

Post reply on HN
Print view View original

31–40 of 112 posts

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#31

Post by StavrosK »

egeozcan wrote: post #26
utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

I must say, I have very limited knowledge on encryption, but, can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches? I mean it would take a while, maybe a week, to get some results but hey, I think it's a possibility.

Encryption isn't hashing. The same block would encrypt to a very large number of ciphertexts.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#32

Post by y0ghur7_xxx »

egeozcan wrote: post #26
utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

I must say, I have very limited knowledge on encryption, but, can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches? I mean it would take a while, maybe a week, to get some results but hey, I think it's a possibility.

can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches?

no. the same message does "never" encrypt to the same cypher:

    $ echo lol | gpg -e -r F8669BB7 --armor
    -----BEGIN PGP MESSAGE-----
    Version: GnuPG v1.4.11 (GNU/Linux)
    
    hQEMA2gTLr1USDZGAQf/YbbnzHvNfdqbs6hmdmIaaiZOSfW9P6Bc8tdF4MG/JbP+
    RTxbLpi4W+vXs+WrD9jdik8KuDdZV54O1mb6Ido3xrYeEPBo0Vje2eVpgUy01VUa
    2RM76NvsX1VN9rap6KvHuO/h7IFwDuAtvUUcDyFH+qK2UEHordFi+mWKqICocQt0
    WWgpCk5BVgM/1q2c2ruWxVuZs/IMh9LQGZ1i7hpkJHAYqovhghROmGarUuJYXGDi
    s6rSMpjxbXDhPMYbbhbBI4pRhgKtN2FMlKyI3XoH+LCFHsOyBmazroVYWFu+gafH
    6LU2Z65OQyJWqX5CLdwab4qpUQdht6lqkUHRJB9xdtI/AfTFF7BbRP8PR+q9GVAe
    r4I812VmBn3hwBHJzNiFDEGVkt/IDpd6M/X2Vi0xJx0LUaICL+swPVudenPuvlnt
    =zeUd
    -----END PGP MESSAGE-----
    
    
    
    $ echo lol | gpg -e -r F8669BB7 --armor
    -----BEGIN PGP MESSAGE-----
    Version: GnuPG v1.4.11 (GNU/Linux)
    
    hQEMA2gTLr1USDZGAQgAo4ZEHGWKSgwVmbC7crACvTXVtlgP4n8J/3oSohct9zrM
    SqPd4L5TWsjOh+2LlG7WQbPnpn4Tcv9c4RyPNb+1C/fWRmGhV+a3QhuC+rrus5c6
    /FPwsHTjO30N0AnCMzoXAaqDRRGw859BKazEZyxIHherU+o7wNRKrW6U1ikRd/Pu
    BwHChUZHBRmZhomrtYPbQ5cNAJQtPMj94Z8OuZeCEzPNBr3opevoMs2j+9ysOtkF
    7Cam3jTKLM3GwHSm4c7WzhdJJsXbnOn8ODYRBf++4oJChPIqeT2EssigAQuuhHlk
    pDhM40zB7hAd6MJM52cZpM3UqTe/iI4vHSrQ+pw/otI/AWY6s4aIlF5AAzoM0wAR
    FzobJ5Vbp7fBgA1SiOhEhSAdT/U2yy2jQcQN53yyX9Vqtunh3dNmCGaNNavszK8+
    =YDLc
    -----END PGP MESSAGE-----
    $

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#33

Post by mahyarm »

blake8086 wrote: post #19

Wouldn't this still allow an adversary to build a social network of all participants? They would know: Who talked to who How often they talk When they talk How much information they exchange Their IP addresses In fact, the only they wouldn't know is precisely what was said, but that's often a very small, non-critical piece of the puzzle.

Still a far greater improvement to knowing the content of your conversations! If your design removes performance in exchange for removing metadata, and nobody uses it, it might as well not exist then.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#34

Post by killerpopiller »

jewel wrote: post #12
lolololololo wrote: post #5

If they don't release the source, like BitTorrent Sync, they might as well just ditch this whole thing right now.

I feel the same way. I've been working on an open source clone of btsync because I don't feel like closed-source products can be trusted. I've just documented the protocol so far, so there's no working code yet, but it's at https://github.com/jewel/clearskies .

that would be great, good luck

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#35

Post by nly »

BitTorrent was never designed with downloader privacy in mind (and not just because of the trackers, the DHT, PEX and the core protocol are all leaky as hell). Just because something is decentralised, it doesn't follow that privacy is somehow intrinsic.

Why do we have any reason to trust BitTorrent, Inc. over any other organisation? At best all these self-centered attempts are going to fragment the messaging market and make make even more unlikely we'll see an open, federated chat protocol reach popular use.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#36

Post by bluedevmonkey »

entropyneur wrote: post #23
bluedevmonkey wrote: post #7

What's with [RetroShare](retroshare.sourceforge.net)? Another question: What's the sense of a tool that nobody of your friends uses, especially in social networking? The will not migrate until Facebook etc. shut down

AFAIK every successful IM platform out there is successful because of this effect . Users push their peers to adopt the new IM because without their friends it's not very useful to them. Of course there should be a good reason for the "seed" users to get on the new platform in the first place.

apparently there is no reason for them.

even with PRISM and others, people are too lazy for that.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#37

Post by hershel »

utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

In theory , bitmessage looks cool. But according to a review:

" Although it is very nice that people are working on creating secure and anonymous messaging systems, I am afraid that BitMessage is weak to a variety of attacks. I fear that the people working on it do not have sufficient expertise, in the fields of security and anonymity, to design and implement a proper cryptographic communications system + anonymity network. After reading the two design .pdf documents, I have identified a variety of weaknesses and overall poor design choices in the BitMessage protocol. "

And he continues to show those weaknesses.

https://bitmessage.org/forum/index.php?topic=1666.0

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#38

Post by chimeracoder »

ajross wrote: post #25
egeozcan wrote: post #20

Earlier quoted context omitted.

Exactly. "Yeah, we designed something, just trust us and hand over all your data". They don't have to make it free, just open the source!

To be fair: charging for peer-to-peer software that is freely redistributable doesn't work as a business model. You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. That doesn't invalidate the point above though that in the modern world a tool like this can only be considered "secure" if the implementation(s) are completely op…

> You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product.

This is where the distinction between "free" (as in freedom) and "open source" is helpful.

You can, hypothetically, release the source code of a project under a license that prohibits compilation of that source code (or, prohibits running anything other than the paid binary of the source code). This would allow people to view and theoretically vet the code; they just can run it (legally) without paying for it.

Not that I would like to encourage such behavior, or think that it's valuable. But it's an important distinction to remember.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#39

Post by wmf »

egeozcan wrote: post #29
ajross wrote: post #25

Earlier quoted context omitted.

To be fair: charging for peer-to-peer software that is freely redistributable doesn't work as a business model. You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. That doesn't invalidate the point above though that in the modern world a tool like this can only be considered "secure" if the implementation(s) are completely op…

You are right. I see a lot of companies that do well with the support model though. What's their business model with this as it is today anyway?

Only enterprise companies can survive on the support business model; it doesn't work for consumer or SMB because they just won't buy support contracts (I'm not counting scams).

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#40

Post by nwh »

chimeracoder wrote: post #38
ajross wrote: post #25

Earlier quoted context omitted.

To be fair: charging for peer-to-peer software that is freely redistributable doesn't work as a business model. You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. That doesn't invalidate the point above though that in the modern world a tool like this can only be considered "secure" if the implementation(s) are completely op…

> You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. This is where the distinction between "free" (as in freedom) and "open source" is helpful. You can, hypothetically, release the source code of a project under a license that prohibits compilation of that source code (or, prohibits running anything other than the paid binar…

There would be no assurance that the binary is compiled from the source though.
Post reply on HN