<story><title>BitTorrent Chat - Private instant messaging via secure, distributed technology</title><url>http://labs.bittorrent.com/experiments/bittorrent-chat.html</url><text></text></story><parent_chain><item><author>utnick</author><text>There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ).&lt;p&gt;Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won&amp;#x27;t be able to read your messages, so not sure if not having a server is that big of a win here. I&amp;#x27;m also guessing metadata would be exposed to various people on the bittorrent chat p2p net.&lt;p&gt;The one I&amp;#x27;m most excited about right now is bitmessage. It is the only chat protocol that I feel is really revolutionary. It is also a p2p network, but the interesting thing about it is that everyone on the network gets every message ( obviously you have to have the correct keys to decrypt the messages that were meant for you ). So its impossible for an observer to tell even who is talking to who. Also they have the concept of public chans , which I think are a good mechanism to draw users. Bittorrent could do the same thing here.</text></item></parent_chain><comment><author>hershel</author><text>In theory , bitmessage looks cool. But according to a review:&lt;p&gt;&amp;quot;
Although it is very nice that people are working on creating secure and anonymous messaging systems, I am afraid that BitMessage is weak to a variety of attacks. I fear that the people working on it do not have sufficient expertise, in the fields of security and anonymity, to design and implement a proper cryptographic communications system + anonymity network. After reading the two design .pdf documents, I have identified a variety of weaknesses and overall poor design choices in the BitMessage protocol.
&amp;quot;&lt;p&gt;And he continues to show those weaknesses.&lt;p&gt;&lt;a href=&quot;https://bitmessage.org/forum/index.php?topic=1666.0&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bitmessage.org&amp;#x2F;forum&amp;#x2F;index.php?topic=1666.0&lt;/a&gt;</text></comment>
<story><title>BitTorrent Chat - Private instant messaging via secure, distributed technology</title><url>http://labs.bittorrent.com/experiments/bittorrent-chat.html</url><text></text></story><parent_chain><item><author>utnick</author><text>There has been a lot of interesting development on the secure chat front lately ( secure circle, textsecure, heml.is, cryptocat etc ).&lt;p&gt;Not sure if bittorrent chat will be very interesting. Most secure chat clients encrypt on the client side so the server won&amp;#x27;t be able to read your messages, so not sure if not having a server is that big of a win here. I&amp;#x27;m also guessing metadata would be exposed to various people on the bittorrent chat p2p net.&lt;p&gt;The one I&amp;#x27;m most excited about right now is bitmessage. It is the only chat protocol that I feel is really revolutionary. It is also a p2p network, but the interesting thing about it is that everyone on the network gets every message ( obviously you have to have the correct keys to decrypt the messages that were meant for you ). So its impossible for an observer to tell even who is talking to who. Also they have the concept of public chans , which I think are a good mechanism to draw users. Bittorrent could do the same thing here.</text></item></parent_chain><comment><author>AJ007</author><text>Correction its called Silent Circle, not secure circle.&lt;p&gt;I&amp;#x27;m happy to see the surge of interest and new projects, but most of the offerings are between embarrassing and pathetic. Either the concept is being exploited for marketing purposes, the individuals involved just aren&amp;#x27;t appropriately skilled at what they are doing, or there are actual nefarious purposes. (I would agree, Bitmessage, and similar schemes could prove to be the best of the bunch.)&lt;p&gt;One could respond this is just paranoia, secure software doesn&amp;#x27;t really need to be open source. Or, we should trust someone because they did something very good in their past. What the NSA leak showed us is that paranoia is real.&lt;p&gt;Politics aside, and I&amp;#x27;ve said this here before, this isn&amp;#x27;t just an issue of the NSA. For 99%+ of individuals, what the NSA is doing isn&amp;#x27;t going to damage them personally. However, those techniques damn well can. What the NSA is doing, other intelligence services are doing too. In some circumstances private companies are doing it as well. It doesn&amp;#x27;t matter if you aren&amp;#x27;t a terrorist, if you work on anything that could be very interesting or very profitable you are at a real risk of being targeted for electronic spying.&lt;p&gt;Standards need to be established:&lt;p&gt;a) If its closed source, it can not be audited and thus can be considered neither secure or insecure.&lt;p&gt;b) If it forces automated updates, it can not be secure.&lt;p&gt;c) If it runs on a leaky platform (all mobile devices so far) it can not be secure.&lt;p&gt;That should tell us, in my opinion, that the number one goal of secure chat would be a secure mobile platform -- that includes both operating system and hardware. If you take a look at the fine print on Replicant, the fully free version of Android, you&amp;#x27;ll notice nearly every supported phone has major potential holes, save for one really ugly looking thing.</text></comment>