Earlier quoted context omitted.
Name one platform that is not "leaky".
The most promising new protocol, in my opinion, is Pond: https://pond.imperialviolet.org/
I was referring to (c) in AJ007's comment.
BitTorrent Chat - Private instant messaging via secure, distributed technology
91–100 of 112 posts
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#92Earlier quoted context omitted.
That doesn't sound reasonable. I don't care who you are, auditing the source version is orders of magnitude easier than auditing the binary version. I say this as someone who has been reverse engineering binary code for well over a decade. This doesn't even account for the fact that requiring reverse engineering skill already eliminates the majority of potential auditors, whether due to ability or due to lack of time…
Look, I'm sorry, but let's take an extreme example here to demonstrate how you are arguing something different than I am: if you are seriously trying to tell me that you have an easier time analyzing the source code for "grep" vs the binary for "false", something is seriously seriously wrong; the binary for false can seriously be less than 50 bytes large. If you show me an open source system and a closed source syste…
Oh, I agree with you on that; it's just that, when the program is closed source, it is already a big enough reason to dismiss it.
"It's open source, therefore trustworthy" is not valid, I agree. But "it is closed source, therefore untrustworthy" is valid, and that's what most people are saying.
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#93Earlier quoted context omitted.
Yes. Even more simply, it is an impossible problem in the general case to even determine in a given x86 binary what parts are code and what parts are data (there was someone at RV '04 that published a paper on that result while working on his CodeSurfer binary analysis tool). This does not, however, contradict my argument: as we can take a binary and generate really horrible C code from it (by just emulating via C, u…
Even more than that, if one wants to insert backdoors in OOS, one could easily do that getting barely noticed. A program might be open source, still the binaries offered for download might be compromised. Who is able to notice that now? You might compile the software yourself, but the majority of users wont. You might have reverse engineered a closed source software, but I guess you won't do that for the OSS binaries…
Honest question: if the source code is compiled with the same compiler (although different computer), will it give a different binary with a different hash?
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#94Do you think a secured chat solution using WebRTC, can fall short from this?
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#95There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ). Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won't be able to read your messages, so not sure if not having a server is that big of a win here. I'm also guessing metadata would be exposed to various people on t…
I must say, I have very limited knowledge on encryption, but, can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches? I mean it would take a while, maybe a week, to get some results but hey, I think it's a possibility.
While cryptography does teach us that some methods are weak against such attacks, but since they are using asymmetric crypto, that means each of my messages would be encypted with the RECIPIENT's public key. thus you really dont know WHICH messages are encrypted with teh same key. thus you can't apply such an attack.
PS: i think asymmetric crypto is secure from such attacks anyways, though isn't that way slower than symmetric crypto?
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#96Earlier quoted context omitted.
Your argument is a bit disingenuous. You say you'd trust simple closed-source software more than complicated open-source counterparts. That's a false dichotomy. Open source X is always more easily auditable than closed source X. I don't think many people are worried that BT will be evil. I think many more people are worried that they'll be incompetent, and it's very hard to be competent at cryptography. That's why we…
From a "non US person" perspective, I go to BitTorrent's website and read: Company Overview BitTorrent Inc. is an Internet technology company based in San Francisco. And immediately I've got _two_ things to worry about - 1) "will BT be evil/incompetent?", and 2) "will BT be leaned on by the NSA and be coerced into being evil?" If you're a US company (or individual, or a company with US based management, developers, i…
From a US perspective: The NSA doesn't lean on non-US companies because it is fully authorized to just hack them directly. Your data kept in foreign countries don't even have the nominal legal protection that US data does.
Unless you've got unbreakable security the NSA is well funded enough that it's irrelevant where you do business.
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#97Earlier quoted context omitted.
From a "non US person" perspective, I go to BitTorrent's website and read: Company Overview BitTorrent Inc. is an Internet technology company based in San Francisco. And immediately I've got _two_ things to worry about - 1) "will BT be evil/incompetent?", and 2) "will BT be leaned on by the NSA and be coerced into being evil?" If you're a US company (or individual, or a company with US based management, developers, i…
From a US perspective: The NSA doesn't lean on non-US companies because it is fully authorized to just hack them directly. Your data kept in foreign countries don't even have the nominal legal protection that US data does. Unless you've got unbreakable security the NSA is well funded enough that it's irrelevant where you do business.
Except that in the case of non-US companies NSA has to do the actual hacking. In case of US ones they simply need to "ask" a company to, say, handle them their master keys - much easier.
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#98Earlier quoted context omitted.
Even more than that, if one wants to insert backdoors in OOS, one could easily do that getting barely noticed. A program might be open source, still the binaries offered for download might be compromised. Who is able to notice that now? You might compile the software yourself, but the majority of users wont. You might have reverse engineered a closed source software, but I guess you won't do that for the OSS binaries…
Honest question: if the source code is compiled with the same compiler (although different computer), will it give a different binary with a different hash?
Potentially yes if the compiler is not configured (at build time) with the same options and the same optimization levels are not used when building the source.
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#99Earlier quoted context omitted.
can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches? no. the same message does "never" encrypt to the same cypher: $ echo lol | gpg -e -r F8669BB7 --armor -----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.11 (GNU/Linux) hQEMA2gTLr1USDZGAQf/YbbnzHvNfdqbs6hmdmIaaiZOSfW9P6Bc8tdF4MG/JbP+ RTxbLpi4W+vX…
As someone who doesn't know the structure of the output, what's the significance of: hQEMA2gTLr1USDZGAQ At the start of each output? Is that 'lol' encrypted then followed by random bytes, or does it contain header information?
It's a header with a version number and the ID of the receivers key that the message was encrypted with. Base64-decode and hexdump those messages and look for 54483646 (one of the subkeys of F8669BB7). The encrypted message is after that and would look random.
The format is defined in http://tools.ietf.org/html/rfc4880
edit: It's not encrypted with the primary key, but one of the subkeys.
Re: BitTorrent Chat - Private instant messaging via secure, distributed technology
#100Earlier quoted context omitted.
As someone who doesn't know the structure of the output, what's the significance of: hQEMA2gTLr1USDZGAQ At the start of each output? Is that 'lol' encrypted then followed by random bytes, or does it contain header information?
It's a header with a version number and the ID of the receivers key that the message was encrypted with. Base64-decode and hexdump those messages and look for 54483646 (one of the subkeys of F8669BB7). The encrypted message is after that and would look random. The format is defined in http://tools.ietf.org/html/rfc4880 edit: It's not encrypted with the primary key, but one of the subkeys.
Interesting, thanks for the overview. I'll have a poke around the doc :) I've been meaning to look into more about how these things work. I understand the very high level stuff and the very low level (how to use the tools roughly and some of the maths behind it all) but not so much in-between.