Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BitTorrent Chat - Private instant messaging via secure, distributed technology

labs.bittorrent.com

Post reply on HN
Print view View original

41–50 of 112 posts

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#41

Post by AJ007 »

utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

Correction its called Silent Circle, not secure circle.

I'm happy to see the surge of interest and new projects, but most of the offerings are between embarrassing and pathetic. Either the concept is being exploited for marketing purposes, the individuals involved just aren't appropriately skilled at what they are doing, or there are actual nefarious purposes. (I would agree, Bitmessage, and similar schemes could prove to be the best of the bunch.)

One could respond this is just paranoia, secure software doesn't really need to be open source. Or, we should trust someone because they did something very good in their past. What the NSA leak showed us is that paranoia is real.

Politics aside, and I've said this here before, this isn't just an issue of the NSA. For 99%+ of individuals, what the NSA is doing isn't going to damage them personally. However, those techniques damn well can. What the NSA is doing, other intelligence services are doing too. In some circumstances private companies are doing it as well. It doesn't matter if you aren't a terrorist, if you work on anything that could be very interesting or very profitable you are at a real risk of being targeted for electronic spying.

Standards need to be established:

a) If its closed source, it can not be audited and thus can be considered neither secure or insecure.

b) If it forces automated updates, it can not be secure.

c) If it runs on a leaky platform (all mobile devices so far) it can not be secure.

That should tell us, in my opinion, that the number one goal of secure chat would be a secure mobile platform -- that includes both operating system and hardware. If you take a look at the fine print on Replicant, the fully free version of Android, you'll notice nearly every supported phone has major potential holes, save for one really ugly looking thing.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#42

Post by c0ur7n3y »

hershel wrote: post #37
utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

In theory , bitmessage looks cool. But according to a review: " Although it is very nice that people are working on creating secure and anonymous messaging systems, I am afraid that BitMessage is weak to a variety of attacks. I fear that the people working on it do not have sufficient expertise, in the fields of security and anonymity, to design and implement a proper cryptographic communications system + anonymity n…

That's a pretty old thread. They've made a lot of progress since then.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#43

Post by foobarqux »

c0ur7n3y wrote: post #42
hershel wrote: post #37

Earlier quoted context omitted.

In theory , bitmessage looks cool. But according to a review: " Although it is very nice that people are working on creating secure and anonymous messaging systems, I am afraid that BitMessage is weak to a variety of attacks. I fear that the people working on it do not have sufficient expertise, in the fields of security and anonymity, to design and implement a proper cryptographic communications system + anonymity n…

That's a pretty old thread. They've made a lot of progress since then.

Is it forward secure now?

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#45

Post by eps »

AJ007 wrote: post #41
utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

Correction its called Silent Circle, not secure circle. I'm happy to see the surge of interest and new projects, but most of the offerings are between embarrassing and pathetic. Either the concept is being exploited for marketing purposes, the individuals involved just aren't appropriately skilled at what they are doing, or there are actual nefarious purposes. (I would agree, Bitmessage, and similar schemes could pro…

Name one platform that is not "leaky".

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#46

Post by hershel »

c0ur7n3y wrote: post #42
hershel wrote: post #37

Earlier quoted context omitted.

In theory , bitmessage looks cool. But according to a review: " Although it is very nice that people are working on creating secure and anonymous messaging systems, I am afraid that BitMessage is weak to a variety of attacks. I fear that the people working on it do not have sufficient expertise, in the fields of security and anonymity, to design and implement a proper cryptographic communications system + anonymity n…

That's a pretty old thread. They've made a lot of progress since then.

What i don't see (maybe haven't looked hard enough) are another security review/s.

Until bitmessage is thoroughly reviewed by serious people ,and results are displayed in a prominent place, it would be hard to trust.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#47

Post by nwh »

utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

Bitmessage is awful for the user, and for security. Minutes to send a message due to the POW requirements, but a botnet can send as much spam as it wants. It's more an excuse to be associated with Bitcoin than to introduce any real security.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#48

Post by ajross »

chimeracoder wrote: post #38
ajross wrote: post #25

Earlier quoted context omitted.

To be fair: charging for peer-to-peer software that is freely redistributable doesn't work as a business model. You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. That doesn't invalidate the point above though that in the modern world a tool like this can only be considered "secure" if the implementation(s) are completely op…

> You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. This is where the distinction between "free" (as in freedom) and "open source" is helpful. You can, hypothetically, release the source code of a project under a license that prohibits compilation of that source code (or, prohibits running anything other than the paid binar…

> release the source code of a project under a license that prohibits compilation of that source code

Such a license would qualify for neither "open source" nor "free software" under the relevant official definitions though.

Yes, it would be reviewable for bugs and probably preferrable to a blob. But without the ability to verify the complication you'd have no assurance that the proprietary code was actually built with the reviewed source. Basically this would just be a stunt.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#49

Post by [deleted] »

ajross wrote: post #48
chimeracoder wrote: post #38

Earlier quoted context omitted.

> You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. This is where the distinction between "free" (as in freedom) and "open source" is helpful. You can, hypothetically, release the source code of a project under a license that prohibits compilation of that source code (or, prohibits running anything other than the paid binar…

> release the source code of a project under a license that prohibits compilation of that source code Such a license would qualify for neither "open source" nor "free software" under the relevant official definitions though. Yes, it would be reviewable for bugs and probably preferrable to a blob. But without the ability to verify the complication you'd have no assurance that the proprietary code was actually built wi…

[deleted]

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#50

Post by esrauch »

ajross wrote: post #48
chimeracoder wrote: post #38

Earlier quoted context omitted.

> You make money in open source by selling related services (e.g. github, Android) or support (Red Hat). You can't do it by licensing the product. This is where the distinction between "free" (as in freedom) and "open source" is helpful. You can, hypothetically, release the source code of a project under a license that prohibits compilation of that source code (or, prohibits running anything other than the paid binar…

> release the source code of a project under a license that prohibits compilation of that source code Such a license would qualify for neither "open source" nor "free software" under the relevant official definitions though. Yes, it would be reviewable for bugs and probably preferrable to a blob. But without the ability to verify the complication you'd have no assurance that the proprietary code was actually built wi…

If the license said that you were in violation if you executed the built code but there was instructions to build the exact version that is distributed it would still allow people to verify that the binary was built from the provided source.

I recall Transgaming Wine had a model that was effectively this, it was difficult for a laymen to build the source and binaries couldn't be distributed freely but the source was still available.

Post reply on HN