Untraceable Messaging Service Raises a Few Eyebrows

netbuzz writes "A messaging service called VaporStream announced today at DEMOfall will allow any two parties to communicate electronically without leaving any record of their interaction on any computer or server. Messages cannot be forwarded, edited, printed or saved. After they're read, they're gone."

Comments

There's always a way.

[SomeGuyFromCA]

Screenshots, anyone?

Re:There's always a way.

[firewood]

Screenshots, anyone?

Better yet. Run the whole process on virtual machines on a virtual network. Record the virtual state and I/O from outside the virtual machine/network and replay the whole process (including message display and "deletion") at your convenience.

Re:There's always a way.

[Tim C]

Screenshots, RAM dumps, network packet dumps, video RAM dumps, running the client (or server, if I'm a rogue admin) in a VM and dumping its RAM, network data, etc; if data enters the RAM of a machine under my control, there's not a whole lot you can do to prevent me from gaining access to it. That might change with trusted computing, secure paths, etc, but even then if I'm determined and skilled enough I can hack the monitor's hardware to intercept the data at the point of display.

Or hell, I could just take photos of the screen.

This might well be secure from the average end user, but there will always be someone who can circumvent it, and in the case of a software hack, it only takes one.

Screen capture?

[rjamestaylor]

Come on. If it can be displayed or played it can be captured and preserved. Except for the money spent on such schemes, of course.

Re:Screen capture?

[The Great Pretender]

Bottom line is what do the producers of the service define as record. If they define the header and message being together as 'record' then separating the two destroys that 'record'. It doesn't mean that the message can't be recorded in some fashion. It's all about the advertising.

Ctrl + C, Ctrl + V

[Sneaky G]

How do they know it's been read? Like the others, I'm sure where there's a will, there's a way, through screenshots or something. It's a nice thought, but my mama always told me never to write down anything I didn't want to be shown. You can't always prove what someone said but you can show what someone has written. I know I'm saving a few choice words that could conceivably come back and bite the person who sent the email to me.

Bending over for a second . . .

[Orange Crush]

. . . because I'm not sure if it's easy enough to blow this smoke up my butt. Is this massively encrypted? One-time pad? The article says nothing except "no records are kept." Every machine along the path keeps a log of something. At the very least, it can be researched that two machines shouted garbled stuff at each other. How is this any more secure than current encryption methods in place? Do the relevant machines do a secret handshake via gumbyspace?

not recordable

[dretay]

If I don't want there to be a record then I talk to the person... in person. Anything else, from phone calls, to letters, to "super secure one time read only" e-mails I assume will be kept for future reference somehow.

insecure.

[cranesan]

Key to Void's Web-based VaporStream service is the fact that at no time does the body of the message and the header information appear together, thus leaving no record of the interaction on any computer or server. The message cannot be forwarded, edited, printed or saved, and, once it's been read, it disappears; nothing is cached anywhere. No attachments allowed. nothing is cached anywhere It might not be cached by the VaptoStream provider, but the ISP (or anyone with a sniffer at the service provider's ISP) can cache both the headers and message informations of all the messages and correlate them later at their leisure. Only an idiot would believe this service gives them "an electronic communications channel that leaves not a trace of its contents or the identities of the participants."

Still traceable?

[mr_neke]

FTA:

at no time does the body of the message and the header information appear together

So, forgive me for sounding naive, but... how is the system supposed to know where the body of the message is supposed to go without a header attached? There'd have to be some kind of link between the two, and even a tenuous link can be used to track where things are going.

I hereby claim this to still be traceable, even if it is a little more difficult than you would otherwise expect.

Re:ScatterChat

[BoRegardless]

If I want security, I will be in a noisy open Jeep at 50 mph discussing the secrets with the other person I am communicating with.

Did I read the right article?

[Alric]

Most of you seem to be missing the point of this system. This is basically a bulletin board system with a special emphasis on deleting all traces of a message as soon as it is read by the recipient.

This is not a DRM system.

This system assumes that the sender and the recipient both want to keep the message a secret. Of course somebody can take a screenshot. Or they could just photograph the screen. Or use their brain to remember the message and then their mouth to repeat it. If your big criticsm is that this system doesn't prevent the recipient from reproducing the message, well, please just stop typing.

The point of this system is that the message itself leave no trail, unlike email or instant messaging. After the message is read, there's no ability to trace the message from the sender to the recipient, and there's very little ability to intercept the message. Sure it can be done, but the right combination of SSL and other precautionary measures should make this a fairly secure experience.

As I said, this seems to be just a suped-up BBS system. Unless I'm missing something, the technology is really nothing new or exciting. The only new thing here seems to be the marketing package, but they seem to be doing a pretty good job of providing a new service using existing technology.

How "Disappearing Inc" solved this N years ago

[billstewart]

Back during the boom, a startup called Disappearing Inc made a similar system for email.
Their tech guy explained that it was really important to define the problems you're trying to solve and the problems you're *not* trying to solve. If you're trying to help cooperating users communicate privately, you can do it, but if you're trying to prevent uncooperative users from getting around it, that's probably impossible and certainly snake oil at best. They weren't trying to keep the users from breaking the system with some kind of DRM nonsense - they were building something that would let the users make sure that they didn't keep records of their email that they weren't deliberately trying to keep. It's the Ollie North email backups problem, not the Mr. Phelps problem.