Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BitTorrent Chat - Private instant messaging via secure, distributed technology

labs.bittorrent.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#81

Post by hnha »

utnick wrote: post #9

There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…

if everyone gets every message, people will store those. and at some point in the future it will be possible to decrypt them all. that makes it something I won't use.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#82

Post by Sami_Lehtinen »

Where is the detailed technical documentation? I would really like to read it. I've read all documentation for other projects, making false claims without any facts is way too easy.

Just finished reading all this: http://code.google.com/p/phantom/ boringly Tor-like project.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#83

Post by XorNot »

saurik wrote: post #78
lawnchair_larry wrote: post #77

Earlier quoted context omitted.

That doesn't sound reasonable. I don't care who you are, auditing the source version is orders of magnitude easier than auditing the binary version. I say this as someone who has been reverse engineering binary code for well over a decade. This doesn't even account for the fact that requiring reverse engineering skill already eliminates the majority of potential auditors, whether due to ability or due to lack of time…

Look, I'm sorry, but let's take an extreme example here to demonstrate how you are arguing something different than I am: if you are seriously trying to tell me that you have an easier time analyzing the source code for "grep" vs the binary for "false", something is seriously seriously wrong; the binary for false can seriously be less than 50 bytes large. If you show me an open source system and a closed source syste…

The NSA is not omniscient anymore then the security services of any other nation are.

Most of what they do probably is just exploiting known bugs since they commit the resources to finding them as a basic part of their mission. You talk about a threat model, but you're proposing one which assigns a ludicrous amount of capability to an organization which, fundamentally, is still staffed and draws upon the same pool of human-talent that everyone else does (that is, graduates of universities principally in the western world).

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#85

Post by Shish2k »

fooqux wrote: post #8

I like that this and Tox are tackling this issue, but they seem to be missing a huge piece of the puzzle: the so-called metadata. If you can hide who the messages are being sent to, you can protect yourself against them spying on who your friends are, which to me, is just as important. Also, if you don't know who the recipient of an encrypted block of text is, it makes it near-impossible to brute force the private ke…

> they seem to be missing a huge piece of the puzzle: the so-called metadata.

I wonder if the broadcast approach would help there? Be constantly throwing out GPG encrypted data to the entire network, anyone with the private key can pick it up. No "to" or "from" headers, and traffic analysis is hard since the flow of traffic is constant:

https://github.com/shish/firehose (Very alpha)

The main downside there is that bandwidth requirements are huge, you can only have a few thousand people on each shard :<

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#86

Post by XorNot »

mahyarm wrote: post #33
blake8086 wrote: post #19

Wouldn't this still allow an adversary to build a social network of all participants? They would know: Who talked to who How often they talk When they talk How much information they exchange Their IP addresses In fact, the only they wouldn't know is precisely what was said, but that's often a very small, non-critical piece of the puzzle.

Still a far greater improvement to knowing the content of your conversations! If your design removes performance in exchange for removing metadata, and nobody uses it, it might as well not exist then.

This seems pointless when we have things like Off-the-Record messaging, which for all intents and purposes solves the content and trust problem, and even includes a legal defence against encryption cracking (cracking a message gives you everything you would've needed to forge the message in the first place, meaning it can't be mathematically proven to have come from you - something GPG and X509 do not).

Distributed chat systems only are advantageous because you get away from having centralized servers, but you still have a bootstrap problem to get everything up and running.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#87

Post by XorNot »

plg wrote: post #15

I remember the old days when one person on a unix machine could chat with another person on a unix machine using the unix talk command, (piped over ssh for security) I had many a conversation with my thesis supervisor this way, once when I was in France and he was in Japan. PS no third party server involved, obviously. Just my box and the recipient box. I suppose one could do a man in the middle attack but we would a…

Not a day goes by when I'm working on an IT related problem that I don't hit a moment of "if we had IPv6 this would simple"

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#88

Post by darklajid »

Karunamon wrote: post #6
lolololololo wrote: post #5

If they don't release the source, like BitTorrent Sync, they might as well just ditch this whole thing right now.

In any other context I would dismiss this comment as a troll, but yeah.. Any program that passes itself off as "secure" and is closed source, in this climate, is immediately suspect.

I think that's missing a major point (I'm kind of agreeing with you/considering that required for 'secure', I'm not on Saurik's side of the debate):

Open source means it's not going away. I won't, ever again, buy into a network that I cannot keep alive. Which is one of the reasons I don't use Whatsapp and actively prevent my family from using it. No G+. Leaving GTalk (Sorry, 'Hangout').

BTSync? Nope, unusable. BTChat? Same. Even if some highly trusted party would explain to me that BTChat is the most secure network, period: As long as I don't see the means to keep that thing alive it is just another potential trap.

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#89

Post by IanCal »

y0ghur7_xxx wrote: post #32
egeozcan wrote: post #26

Earlier quoted context omitted.

I must say, I have very limited knowledge on encryption, but, can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches? I mean it would take a while, maybe a week, to get some results but hey, I think it's a possibility.

can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches? no. the same message does "never" encrypt to the same cypher: $ echo lol | gpg -e -r F8669BB7 --armor -----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.11 (GNU/Linux) hQEMA2gTLr1USDZGAQf/YbbnzHvNfdqbs6hmdmIaaiZOSfW9P6Bc8tdF4MG/JbP+ RTxbLpi4W+vX…

As someone who doesn't know the structure of the output, what's the significance of:

    hQEMA2gTLr1USDZGAQ
At the start of each output? Is that 'lol' encrypted then followed by random bytes, or does it contain header information?

Re: BitTorrent Chat - Private instant messaging via secure, distributed technology

#90

Post by xenonite »

saurik wrote: post #60
hendzen wrote: post #58

Earlier quoted context omitted.

Actually, there has been some recent research [0] in cryptography that shows it is possible to produce binaries that are obfuscated in such a way such that they are computationally infeasible to deobfuscate (see the linked reference for a formal definition of indistinguishability obfuscation). [0] - http://eprint.iacr.org/2013/451.pdf

Yes. Even more simply, it is an impossible problem in the general case to even determine in a given x86 binary what parts are code and what parts are data (there was someone at RV '04 that published a paper on that result while working on his CodeSurfer binary analysis tool). This does not, however, contradict my argument: as we can take a binary and generate really horrible C code from it (by just emulating via C, u…

Even more than that, if one wants to insert backdoors in OOS, one could easily do that getting barely noticed.

A program might be open source, still the binaries offered for download might be compromised. Who is able to notice that now?

You might compile the software yourself, but the majority of users wont.

You might have reverse engineered a closed source software, but I guess you won't do that for the OSS binaries.

Post reply on HN