BitTorrent Unveils Secure Chat To Counter 'NSA Dragnet Surveillance'

← Back to Stories (view on slashdot.org)

BitTorrent Unveils Secure Chat To Counter 'NSA Dragnet Surveillance'

Posted by samzenpus on Thursday December 19, 2013 @10:26PM from the sheilds-up dept.

Hugh Pickens DOT Com writes "Jacob Kastrenakes reports on The Verge that as part a response to the NSA's wide-reaching surveillance programs, BitTorrent is unveiling a secure messaging service that will use public key encryption, forward secrecy, and a distributed hash table so that chats will be individually encrypted and won't be stored on some company's server. 'It's become increasingly clear that we need to devote hackathons, hours and resources to developing a messaging app that protects user privacy,' says Christian Averill, BitTorrent's director of communications. Because most current chat services rely on central servers to facilitate the exchange of messages, 'they're vulnerable: to hackers, to NSA dragnet surveillance sweeps.' BitTorrent chat aims to avoid those vulnerabilities through its encryption methods and decentralized infrastructure. Rather than checking in with one specific server, users of BitTorrent chat will collectively help each other figure out where to route messages to. In order to get started chatting, you'll just need to give someone else your public key — effectively your identifier. Exchanging public keys doesn't sound like the simplest way to begin a chat, but Averill says that BitTorrent hopes to make it easy enough for anyone interested. 'What we're going to do is to make sure there are options for how this is set up,' says Averill. 'This way it will appeal to the more privacy conscious consumer as well as the less technically inclined.' For now, it remains in a private testing phase that interested users can apply for access to. There's no word on when it'll be open to everyone, but with all of the recent surveillance revelations, it's easy to imagine that some people will be eager to get started."

80 of 111 comments (clear)

Min score:

Reason:

Sort:

OTR by Anonymous Coward · 2013-12-19 22:32 · Score: 2, Insightful

How is this different from OTR?
1. Re:OTR by heypete · 2013-12-19 22:58 · Score: 5, Informative
  
  How is this different from OTR?
  OTR rides on top of underlying IM protocols (e.g. AIM, ICQ, XMPP, Yahoo Messenger, etc.) and encrypts the contents of communications. IM service providers can still shut down individual accounts, monitor who is accessing them, etc., even if they cannot read the contents of messages.
  With BitTorrent Chat, the service takes advantage of the DHT (similar to "trackerless torrents" that don't have any single point of failure) to provide a decentralized, fault-tolerant means of exchanging data. There's no dependence on a single service -- all users would participate in the DHT, making it an extremely robust system.
  If I read the description properly, it's similar to "OTR-over-DHT" but there's likely substantial differences in the details.
2. Re:OTR by Anonymous Coward · 2013-12-19 23:15 · Score: 2
  
  DHT doesn't seem to be robust or fault-tolerant to me.
  I also don't see how it would provide any anonymity as seems to be claimed.
  OTR over TOR might make more sense.
3. Re:OTR by Stalks · 2013-12-19 23:23 · Score: 4, Informative
  
  DHT is very reliable. Once a node has been connected a while and established links with many other nodes, traffic is quick and you have the redundancy of many 100s of connections.
  Encrypting the data prior to transport and using DHT would be no worse off from TOR.
4. Re:OTR by heypete · 2013-12-19 23:32 · Score: 2
  
  DHT doesn't seem to be robust or fault-tolerant to me.
  How so? The mainline DHT used for torrents has been operating without outages for years, with tens of millions of nodes taking part (with a churn of about 10 million a day). The DHT is self-healing in that if there's a small cluster of nodes that are interconnected with each other but disconnected from the main DHT, a single connection to the main DHT will result in that cluster completely rejoining the main DHT.
  
  I also don't see how it would provide any anonymity as seems to be claimed.
  Indeed. The system appears to provide decentralized, encrypted communications. That's a very important aspect to be sure, but it's not anonymous communication. I don't see any mention in the text or links of the summary saying that the system is intended to be anonymous, only encrypted and decentralized.
  
  OTR over TOR might make more sense.
  Perhaps. It'd be interesting to see a Tor-based DHT that would allow for this type of chat protocol to be extended -- that would make it both encrypted, decentralized, and anonymous.
5. Re:OTR by GameboyRMH · 2013-12-20 01:09 · Score: 2
  
  Oh noes port forwarding and uPnP r so hard!!! :-(
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
6. Re:OTR by wertigon · 2013-12-20 02:13 · Score: 1
  
  It's not that it's hard to do - it's that it requires manual intervention. I can do it, my grandma can't.
  Also, in CGNs (Carrier Grade NATs) the ISP controls the NAT, not the home user.
  
  --
  systemd is not an init system. It's a GNU replacement.
7. Re:OTR by blueg3 · 2013-12-20 03:35 · Score: 1
  
  That's what UPnP is for.
8. Re:OTR by MacDork · 2013-12-20 03:47 · Score: 2
  
  Once a node has been connected a while
  Unfortunately, having a radio on for "a while" is going to put quite a lot of strain on a mobile battery. Still, it's good to see them working on this. Perhaps we could set up relays through a home server that has a power source.
9. Re:OTR by Burz · 2013-12-20 03:58 · Score: 2
  
  An I2P messaging system 'I2PBote' was developed several years ago, and is based on DHT. It has the benefit of decentralization, plus the privacy/anonymity of onion routing.
  Everyone is offering an encryption mode for their apps these days. But they don't address two important factors in privacy: Revealing the who/when/where info (the metadata the NSA is so interested in, for instance), and inconsistency of use. Using a network like I2P for all/most of your communications (including email, chat, bittorrent, etc) means there is far more guesswork involved for any spy even if they want to analyze your packet timing... with all your different protocols plus forwarded traffic from other systems in the mix, it offers more privacy and anonymity than even Tor.
closed source by Anonymous Coward · 2013-12-19 22:36 · Score: 2, Insightful

You can't trust a closed source "security" app.
1. Re:closed source by alphatel · 2013-12-19 22:39 · Score: 4, Insightful
  
  "It's become increasingly clear that we need to devote hackathons, hours and resources to developing a messaging app that protects user privacy"
  And should also become quite obvious that you need to start vetting coders who are infiltrating projects on behalf of the government. That good old warped 80's tinfoil hat paranoia is the only thing that will save you anymore because it seems it was never wrong.
  
  --
  When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
2. Re:closed source by mwvdlee · 2013-12-19 22:44 · Score: 3, Interesting
  
  If the protocol is open, you could build your own app implementing it.
  
  --
  Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
3. Re:closed source by Joce640k · 2013-12-19 23:26 · Score: 1
  
  You can't trust a closed source "security" app.
  How many different BitTorrent clients are there? How did that happen...?
  
  --
  No sig today...
4. Re:closed source by fak3r · 2013-12-20 05:21 · Score: 1
  
  I think this could be the phrase of the year, "That good old warped 80's tinfoil hat paranoia is the only thing that will save you anymore because it seems it was never wrong."
  
  --
  fak3r.com
5. Re:closed source by JimSadler · 2013-12-20 08:13 · Score: 1
  
  So I am standing in this honey pot eager to chat. Message me! You know just how safe it is. There can be no greater way to catch criminals than issuing privacy products. Trust me. This is just oh so safe.
Cryptocat? by Anonymous Coward · 2013-12-19 22:40 · Score: 2, Funny

Hey, guys, I got this wheel, and I don't like it. Somebody help make a new one with more corners please!
1. Re:Cryptocat? by DuckDodgers · 2013-12-20 01:57 · Score: 5, Informative
  
  http://www.wired.com/threatlevel/2012/08/wired_opinion_patrick_ball/all/
  This means that in practice, CryptoCat is no more secure than Yahoo chat, ... Any host-based system that delivers the encryption engine to you each time you log in, and in which your keys reside on the server, you are never secure against the host (there’s new research on this called “host-proof hosting,” but it’s a long way from being ready to use in real applications). That means that if the host attacks you, or they fail to protect themselves, your encrypted data will be available to them. Remember that the host might attack you because someone evil has taken control of the host. If you are the hypothetical dissident in the Middle East, your government might contract a hacker to break into the CryptoCat server, Hushmail, or other host-based server, and thereby get access to all your data. Or they could bribe an employee at a host-based service. Again: in host-based security, all your security rests on your personal trust for the people at the host, and their ability to protect the server. There’s no real security in a technical sense.
2. Re:Cryptocat? by Jakeula · 2013-12-20 04:27 · Score: 1
  
  My first thought was RetroShare. This is obviously different than RetroShare, but RS works already and offers a secure method of communication.
It's been attempted before.... by Raxxon · 2013-12-19 22:43 · Score: 2

Started a shit-storm at AOL..... It was called WASTE...
1. Re:It's been attempted before.... by Luckyo · 2013-12-20 00:49 · Score: 2
  
  Problem with WASTE is its hilarious overhead. We had a case where around min 2000s uni network's DC hub was shut down and users moved to WASTE. Suddenly all those intranet 100mbps-1gbps links that you never saw coming close to 10% usage were getting saturated as WASTE bounced every file transfer several times between nodes to obfuscate sender/receiver.
2. Re:It's been attempted before.... by Raxxon · 2013-12-20 01:04 · Score: 1
  
  Never said it was efficient or effective, just that it was a "prior attempt" and indicated the shit storm that ensued. Had WASTE continued proper development they may have worked those issues out the same way ID Software did with the original release of DOOM (seriously, BROADCAST networking? ouch!)
3. Re:It's been attempted before.... by SuricouRaven · 2013-12-20 01:34 · Score: 1
  
  Try Retroshare. Same idea, much better implementation.
4. Re:It's been attempted before.... by CastrTroy · 2013-12-20 02:54 · Score: 1
  
  Yeah, but it would probably be fine is people stuck to chat and sending a few pictures back and forth. People were probably trying to shared all kinds of files including videos over a system that wasn't really designed for that kind of traffic.
  
  --
  
  Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Vulnerable to Social Engineering by mentil · 2013-12-19 22:55 · Score: 4, Interesting

If the public/private key pair is created at account creation, then people accustomed to everything being in the cloud will frequently forget to backup their private key (which isn't stored on any central server). A common occurrence will be "Hey Alice, it's Bob. I lost my private key so this is my new account now." Potentially, Bob is in jail and a fed is masquerading as him.
Also from my experience with DHT, it doesn't work unless you already know an IP running the protocol -- who you usually find through, yes, a centralized server. If that server were TOR-based it might work, but then that raises the question of what functionality is added by this protocol that a messaging program running thru TOR doesn't offer. Having Mixmaster-style message queueing in addition to onion routing would offer improved resistance to topology attacks as well. I'm referring to TOR's hidden services protocol, by the way, rather than the standard web proxy where an unencrypted message would be sent to a messaging server after several encrypted hops.

--
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
1. Re:Vulnerable to Social Engineering by MoonFog · 2013-12-19 23:06 · Score: 5, Interesting
  
  So what you're saying is that the police forces would have to use old-fashioned police work and target individuals they suspect rather than mass collect everything? Yes, clearly that proves this is a wasted effort.
2. Re:Vulnerable to Social Engineering by Joce640k · 2013-12-19 23:36 · Score: 5, Insightful
  
  This is to stop mass spying/trawling.
  If your contacts are all in jail then you have bigger problems.
  
  --
  No sig today...
3. Re:Vulnerable to Social Engineering by Chozabu · 2013-12-19 23:37 · Score: 1
  
  Sure - when it is new, people will make mistakes. give people a few scandals, a few years - perhaps even a few generations and people will remember to backup their private key. Or we will have private keys in secure distrib storage!
4. Re:Vulnerable to Social Engineering by Anonymous Coward · 2013-12-20 00:08 · Score: 1
  
  If the public/private key pair is created at account creation, then people accustomed to everything being in the cloud will frequently forget to backup their private key (which isn't stored on any central server). A common occurrence will be "Hey Alice, it's Bob. I lost my private key so this is my new account now." Potentially, Bob is in jail and a fed is masquerading as him.
  If I'm emailing you on average at least once every day or every other day to recall the passphrase, losing a private key should not be any more "common" for people than their hard drive crashing, which isn't THAT common. As far as data loss, I've got no sympathy for those morons who never back up when autosync cloud storage software is being pimped for free all over the damn place.
  As far as masquerading, I've also have no sympathy for the idiot who loses their wallet and chooses not to inform their bank of lost credit card numbers. Those who know better will know the importance of compromised keys and will ensure revocation happens. Those who don't will have long discussions under a hot lamp trying to explain their eDoppleganger activity, hoping to not be labeled as a "terrorist".
5. Re:Vulnerable to Social Engineering by Anonymous Coward · 2013-12-20 00:12 · Score: 4, Interesting
  
  yes but they could not do it to everyone, only people who they had good grounds to obtain a warrant, even without the need for a warrant they would still have not acquired the full message history from everyone all the time as this would have been too much work. All this does it put this situation back how it was.
6. Re:Vulnerable to Social Engineering by RabidReindeer · 2013-12-20 00:19 · Score: 2
  
  I hate to break the news to you , but "old-fashioned police work" also involved wire tapping and intercepting post. Its whats known as gaining evidence. Now in a perfect world it wouldn't be necessary , but unfortunately we don't live in a perfect world and a lot of people don't play by the rules and oddly enough they usually say "no" if someone asks if they've commited a crime. Therefor the authorities have to get information on their activities, a lot of which comes from correspondence in whatever form it takes.
  Hope that clears things up for you since you're clearly new to this reality.
  Whoosh!
  
  target individuals they suspect rather than mass collect everything
  
  Nothing was said about no longer doing wire tapping etc. Merely that the mere act of existence should no longer make you a suspect on equal footing with the senior counsel of Al-Qaeda.
7. Re:Vulnerable to Social Engineering by Anonymous Coward · 2013-12-20 01:36 · Score: 1
  
  What? No.
  Once DHT is started by 2 separate peers and grows, it can be maintained 100% without a parent server unless the entire internet dies for any length of time and the IP records scrambled. That is the only way to take down a full DHT implementation and not just a half-assed one.
  That is unlikely to happen any time soon. (having to put soon in there saddens me)
  And if you have enough peers that are active enough, or have static IPs, it becomes even more stable.
  The problem with Tor is that anyone can run a server and intercept communications.
  Oh, and that Tor is awful due to so many people using it for torrenting. (mind you, I haven't used it for years, it might not be as bad now)
  The problem with all of these systems it they require users to WANT it, which most don't give a damn about, which breaks the system.
  Without the numbers, the system collapses or becomes weak.
8. Re:Vulnerable to Social Engineering by DuckDodgers · 2013-12-20 02:00 · Score: 1
  
  I don't know what point you're trying to make. I have no objection to law enforcement wiretaps and surveillance when they have law enforcements and public judicial oversight. That's been the way law enforcement operated for most of the previous century, and it's reasonable.
  
  What we have now is mass surveillance, mass wiretaps, and no judicial oversight. That's what we're trying to halt.
9. Re:Vulnerable to Social Engineering by tlhIngan · 2013-12-20 05:34 · Score: 1
  
  So what you're saying is that the police forces would have to use old-fashioned police work and target individuals they suspect rather than mass collect everything? Yes, clearly that proves this is a wasted effort.
  Yeah. They'll go for lower hanging fruit instead, and let the legislative bodies suffer from crimes that they "could have" solved had they enough "for a warrant" and all that stuff.
  Remember, there are three pillars - you have the executive, the legislative, and the judicial (law enforcement). If the judicial branch doesn't have the tools necessary, they'll ask the legislative for a law.
  E.g., if a pedophile decided that was a perfect mechanism for their stuff, all the police have to do is say "sorry, we don't have the tools - we can't wiretap or monitor them nor do we have evidence to do those things" and go about solving easier crimes. That causes "concerned citizens" to put pressure on the senators to enact laws giving them the tools to monitor stuff, and then we're back in the same place.
Re:honey by Anonymous Coward · 2013-12-19 23:11 · Score: 3, Insightful

This attitude needs to go away. Now. I have EVERYTHING to hide.
If exchanging a keypair is too hard by Gothmolly · 2013-12-19 23:25 · Score: 1, Interesting

Then maybe you shouldn't be using the Internet. Just because a child can reach the steering wheel of a car doesn't mean that they should drive.

--
I want to delete my account but Slashdot doesn't allow it.
1. Re:If exchanging a keypair is too hard by Anonymous Coward · 2013-12-20 00:59 · Score: 1
  
  A $1000 plane ticket just to exchange some key pair is a bit expensive.
2. Re:If exchanging a keypair is too hard by Joce640k · 2013-12-20 07:25 · Score: 1
  
  How about a 50 cent postage stamp? (or whatever it costs where you live)
  
  --
  No sig today...
Sounds a lot like WASTE to me. by Anonymous Coward · 2013-12-19 23:31 · Score: 1

WASTE was a decentralized peer2peer chat tool which sounds very similar to what bittorrent wants to build.
You can still download and use WASTE and have this capability now.
Way to go bittorrent - someone needs to do this en masse.
WASTE was traditionally hard to establish large networks with - lets hope bittorrent succeeds in this regard.
1. Re:Sounds a lot like WASTE to me. by SuricouRaven · 2013-12-20 00:25 · Score: 1
  
  WASTE has been largely replaced by Retroshare. Same intent, but it's much less buggy and more capable.
I'm just thinking out loud here.. by Arith · 2013-12-19 23:55 · Score: 2, Interesting

I'm not exactly a crypto-guru.. but if exchanging a key with your friend to ESTABLISH secure chat.. wouldn't you first have to send that key through unencrypted channels? - assuming you are far enough away that face-to-face isn't an option (and in that case, why even use this?)
1. Re:I'm just thinking out loud here.. by Captain+Hook · 2013-12-20 00:03 · Score: 1
  
  Only the public key.
  
  --
  These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
2. Re:I'm just thinking out loud here.. by Joce640k · 2013-12-20 00:09 · Score: 3, Informative
  
  The thing about PUBLIC key cryptography is that the encryption keys are PUBLIC, it doesn't matter who knows them.
  
  --
  No sig today...
3. Re:I'm just thinking out loud here.. by Anonymous Coward · 2013-12-20 00:28 · Score: 5, Informative
  
  This explains it very simply.
  You can exchange a piece of information without exposing the full picture to a 3rd party.
4. Re:I'm just thinking out loud here.. by q.kontinuum · 2013-12-20 01:09 · Score: 1
  
  Accidentally mis-voted on a slow computer... Please mod parent up! Very good explanation!
  
  --
  Trolling is a art!
5. Re:I'm just thinking out loud here.. by fatphil · 2013-12-20 01:32 · Score: 1
  
  You still need an identification handshake, otherwise anyone could send you a message.
  
  --
  Also FatPhil on SoylentNews, id 863
6. Re:I'm just thinking out loud here.. by Anonymous Coward · 2013-12-20 01:34 · Score: 1
  
  As it was already said, an asymmetric cryptography key pair lets you get around the problem of someone knowing your key being able to decrypt the message.
  Establishing that the public key you initially get really belongs to your friend, and not to a NSA datacenter is much harder through.
  There are basically two ways: either trust a central authority whose key you previously know (ie, how web certificates work now) or build a network of computers who would vouch for the trustworthiness of the opposite side (that's how bitcoin works). Both sides have their ups and downs, although the later is much harder to compromise once you already are on the network, since you already know the keys of some, if not all of the peers.
  On the plus side, once you've exchanged keys once, you can keep updating your keys as they expire without fear of anyone eavesdropping outside of compromising either endpoint (as long as the algorithms in your encryption software are good, that is). The biggest strength in distributed networks, is that all those peer keys you are holding onto makes it very hard for someone to misrepresent themselves. A man-in-the-middle attack would be virtually impossible unless a large portion of the network is already compromised.
7. Re:I'm just thinking out loud here.. by root_brewski · 2013-12-20 02:26 · Score: 2
  
  Diffie-Hellman is a commonly taught example of how to do this. The video linked above explains it well, but here's a wiki link if you want to read text instead.
8. Re:I'm just thinking out loud here.. by Arith · 2013-12-20 22:58 · Score: 1
  
  Not only explained with pictures, but with MOVING pictures. Much obliged, makes sense now.
Will it stop collection of metadata? by Anonymous Coward · 2013-12-20 00:11 · Score: 1

How will this hinder collection of meta data? The participants still talks to each others directly (its p2p not peer-thru-peer)? And people have usernames (public key) instead of email addresses?
Re:It could be a honey pot by Joce640k · 2013-12-20 00:12 · Score: 2

when I'm using something that supposed to be secured, I'm still taking extra precautions.
At the very least, every single connection that I'm making I scramble my MAC address.
And btw, the other day there was a news about someone got apprehended despite hiding behind a TOR - you just never know when they will come at you, and when they want to get you, they can.
If you're doing things that make them specifically target you then they'll probably get you anyway (and that's as it should be).
This new is to stop mass spying/recording of every conversation (which is what they're doing now).

--
No sig today...
user acceptance? by Tom · 2013-12-20 00:26 · Score: 2

The primary issue will be the same as for PGP (anyone use that? wait, let me rephrase that: anyone know of any non-geek people who use it?): User acceptance.
Unless it's as easy not only to use but also to add contacts as FB chat, AIM, ICQ, Skype, Google+, etc. etc. it won't get the critical mass it needs.
What good is a secure chat if you don't have anyone you can chat to?

--
Assorted stuff I do sometimes: Lemuria.org
1. Re:user acceptance? by Pichu0102 · 2013-12-20 01:34 · Score: 1
  
  If it behaves anything like Retroshare, it would have the users exchange keys, and not let them connect until each has the other's keys and allows the connection. Nintendo online players have been doing something similar for a while with friend codes, so I don't see why this needs to be so difficult.
Stop reinventing the wheel. by SuricouRaven · 2013-12-20 00:27 · Score: 1

We already have this program.
It's called Retroshare.
bedroom spy camera by zaax · 2013-12-20 00:29 · Score: 1

This of course does not stop the NSA / MI5 etc. breaking into your house and putting a few bugs in.
1. Re:bedroom spy camera by KingOfBLASH · 2013-12-20 00:48 · Score: 3, Insightful
  
  Breaking into houses takes time and resources. Much more so then if the NSA can simply watch all your chat, archive it in a huge data center in utah, and then do a search through your histories.
  So when spy agencies have to work the old fashioned way, even if they disrespect the need for warrants they still can't spy on everybody. If they can just do a search through your data, they are effectively watching everyone
2. Re:bedroom spy camera by DuckDodgers · 2013-12-20 02:04 · Score: 1
  
  Exactly. Individual, resource-intensive, and especially judicially approved (a warrant from a court that is not secret) surveillance and search is fine, that's a routine part of law enforcement.
  
  What we have now, and what we need to stop, is having the government or any other organization know almost everything about everyone on a routine basis. That's the path towards dictatorship.
3. Re:bedroom spy camera by Sloppy · 2013-12-20 06:47 · Score: 1
  
  I agree. Someone once told me I should not go out at night, walk naked (except for a hundred dollar bill pasted to each of my nipples) to the highest-crime district in my city, and start yelling "Some of my best friends are you people!" They said I would be safer if I behaved differently, stayed home instead, and STFU-ed up with my crazy rants.
  I explained that even if I behaved differently, that doesn't stop the Russians from launching a nuclear ICBM strike, killing us all, including me. Safe is safe, unsafe is unsafe, there are no degrees in between, and all of us face one single adversary who has one simple agenda.
  
  --
  As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
These types of things get a bad rep by Daniel+Hoffmann · 2013-12-20 00:38 · Score: 2

Everyone should have their communications privacy by default, not having to hunt downs means to keep their privacy. Services like these end up being used mostly by paranoids and people with malicious intent. So in some respects the government officials have a point in wanting to shut down initiatives like these. On the other hand initiatives like these only exist because the government wants to control everything.
1. Re:These types of things get a bad rep by mwvdlee · 2013-12-20 01:08 · Score: 4, Funny
  
  I use these services because I have nothing to hide and like our caring government.
  Since I have nothing to hide, my caring government would be wasting resources trying to monitor and read my communication.
  By making it impossible for them to do so, I'm saving them effort, time and money.
  
  --
  Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Retroshare by Anonymous Coward · 2013-12-20 00:56 · Score: 1

anybody interested in this sort of thing shoulc check out retroshare. Can also use the DHT to find peers.
Encrypts everything with pgp keys. And only connects with trusted peers.
I would trust an open source project like retroshare more than aa commercial company like bittorrent for this sort of thing.
1. Re:Retroshare by SuricouRaven · 2013-12-20 01:35 · Score: 1
  
  Yes yes yes! Finally someone else who sees how important Retroshare could be, if only more were aware of it.
Bitmessage? by Stentapp · 2013-12-20 01:49 · Score: 1

How does this compare with https://bitmessage.org/ ?
1. Re:Bitmessage? by Anonymous Coward · 2013-12-20 05:33 · Score: 1
  
  I just thought the same thing. Encrypted communication, hides metadata/senders/recipients, PLUS it's open-source.
Re:Wouldn't this get you on a list? by gmuslera · 2013-12-20 02:26 · Score: 1

If you want to protect your information (even from hackers not paid by the government) in any way you will get into their monitoring list. Is not if, is when (and that moment could be in the past already), you will be monitored. And even if you think you have nothing to hide, they could have another opinion.
Don't play boiling frog or by the time you decide that something must be done will be already too late.
PATENTS and veiled threats at Open Source by FriendlyLurker · 2013-12-20 02:42 · Score: 2

How many different BitTorrent clients are there? How did that happen...?
It would appear that Bittorrent the company considers the healthy bittorrent/client ecosystem to be a mistake not to be repeated. Like this chat protocol, they have also announced a P2P Streaming protcol - their implimentation will be closed source encumbered with patents that they have threated to use against anyone wishing to start an alternative open client. So even when they openly publish the protocol, it is still of no use the open source community. Don't believe me, take this quote from the horses mouth:

“We want people to use and adopt BitTorrent Live. But we aren’t planning on encouraging alternative implementation because [Insert pathetic excuse here]. We want to ensure a quality experience for all and this is the best approach for us to [i.e more pathetic excuses to close source the system],” Cohen told TorrentFreak.

So, yeah, You can read the protocol spec but try to impliment it and we will "discourage" you - i.e. use out patent(s) to clobber your OS project to oblivion. Personally I hope the open source community can take these interesting initiatives, design around the patents and make a true P2P Streaming and secure chat system ecosystem - because it appears that Bittorrent the company has fallen far from its early success of kicking off the truly open bittorrent protocol, sadly.
1. Re:PATENTS and veiled threats at Open Source by sqrt(2) · 2013-12-20 05:18 · Score: 1
  
  There's precedent for the FLOSS community not giving a fuck about software patents. They're not enforceable globally and the internet is still mostly borderless, at least in the "free" world. How many open source media players are out there that technically violate the patents on MP3, Windows and Apple codecs, et al? There's no trouble distributing those.
  
  --
  If you build it, nerds will come. Soylentnews.org
The big problem is the initial exchange of keys. by Chas · 2013-12-20 03:22 · Score: 1

Unless you're meeting in person to exchange physical media, there's not really a secure way to do so.
E-Mail? Hah!
File lockers? Hah!
BitTorrent? Hah!
Encrypted file transfer through another IM client? Hah!
Basically, setup becomes this tiny set of flaming hoops that you're somehow expected to jump through simultaneously.

--

Chas - The one, the only.
THANK GOD!!!
Another proprietary mess - a pity. by RanceJustice · 2013-12-20 03:30 · Score: 2

Much like MEGA, the other projects of BitTorrent labs (most notably - Snyc), and a whole host of pseudo-security minded programs and services popping up recently, this is sadly proprietary bullshit. Much like BitTorrent Inc absorbing uTorrent as the main client etc... they've repeatedly demonstrated that they view their greatest success - the Bit Torrent protocol itself, as a mistake to be avoided. Why did BitTorrent itself grow to be so prevalent? Exactly the thing they seem to hate - its openness. BitTorrent protocol and most of its extensions (ie DHT, uTP, PEX and more) are all free and open source, to be implemented in a variety of clients. This is its greatest strength, from the slashdot-reading hacktivist running Deluge/Transmission/rTorrent, to World of Warcraft's client updater/patcher, BitTorrent is not just a great protocol for both tracker-based and trackerless sharing, but its implementations are as wide as can be and interoperable.
I am not sure why BitTorrent Inc has decided to treat this as a weakness, and develop yet another proprietary software-as-a-service, centrally managed debacle. While there seems to be some casual lip service paid to FOSS and promises of openness, I haven't seen any examples that they're actually interested in such things. For instance, the javascript Torque API which is supposed to bring BitTorrent to the web browser, doesn't seem to be compatible with any clients aside from the official BitTorrent/uTorrent clients themselves! Other "labs" projects like Live, Surf, and Sync are similar in this regard, being designed only for approved first-party clients.
So long as this ideal reigns, I won't be using these projects. Especially when it comes to privacy and security it is simply too important than to trust a proprietary, unverifiable item of this sort. There are already a variety of projects that offer better privacy and more secure messaging - RetroShare for instance. If you're interested in some of the best, check out www.prism-break.org for a directory of privacy and security respecting, mostly FOSS, programs for many uses. Until those like BitTorrent Inc wake up and realize that openness is one of their greatest strengths, I don't see any reason to consider what they provide.
1. Re:Another proprietary mess - a pity. by Burz · 2013-12-20 05:01 · Score: 1
  
  I2P has a DHT based messaging system available. The whole stack is fully open, and the underlying protocol is actually like a marriage between bittorrent and Tor-- users are expected to relay traffic thus contributing greater bandwith and anonymity to the network.
  I2P also has anonymized bittorrent built-in, so I'm not sure what this new bt chat brings to the table. It seems like too little too late to me.
2. Re:Another proprietary mess - a pity. by Burz · 2013-12-20 08:32 · Score: 1
  
  I don't know of another one. FWIW, they are developing on Android primarily so they are forced to keep the code as efficient and lean as possible. The effect on resource usage has been very positive.
  As for taking off, I2P nodes and traffic have already been on a big upward climb over the past few years. I wouldn't be surprised if it surpasses Tor soon in the number of relays and amount of traffic.
3. Re:Another proprietary mess - a pity. by virtigex · 2013-12-28 07:40 · Score: 1
  
  Disclaimer, Chat team member here. Chat is based on the Distributed Hash Table DHT and Arvid Nordberg, the head engineer on this project, has just released our DHT bootstrap code as open source on github. At the start of this project, we frequently ask ourselves why anybody should trust us over any other group. The only answer that we could come up with is increased transparency. http://engineering.bittorrent.com/2013/12/19/dht-bootstrap-update/
Can't do anonymous + decentralized + enc-envelope by aztracker1 · 2013-12-20 03:32 · Score: 2

You could allow something like this to be anonymous, by allowing addressing to be a relatively poor hash that a message to you would match many people and from there signature checks could determin that the message was in fact for you. The problem comes in that any such system is open to channel poisoning.. many fake messages to a block so that the decryption time becomes costly, and/or you get so many garbage messages that you can't filter out the "real" stuff. This just shows you can do encrypted + decentralized, but not really anonymous. Any solution I've thought through has to give up one of anonymous, decentralized or full-encryption of the message envelope

--
Michael J. Ryan - tracker1.info
Hope they were smart enough to use PGP keys by Sloppy · 2013-12-20 06:12 · Score: 1

Hopefully they weren't stupid enough to roll their own key format, and instead, they use standard OpenPGP keys. That way, people can have MitM-proof verified-identity conversations if they want that (and can tune the degree of MitM-proofing that is needed) but also have MitM-vulnerable pseudonymous conversations if they don't (for cases where you'd prefer to be anonymous).
When you're talking to your wife, it's ok for her to know who you are, and you to know you're talking to her, so you'd use the keys that you've exchanged out-of-band and that each of you have signed. When you're talking to your pirate buddies, you just to have the keyid that has in the past, been associated with uber-31337ness, but has never been signed by anyone. And when you're talking to another person in the company, you know who each other is and have at least some company CA as your introducer, any maybe signed yourselves too if it's a small enough company where everyone eventually meets each other in person.
Whatever your case, OpenPGP fits perfectly. The only thing it doesn't handle well, is tricking users into thinking they have a secure connection but really letting a third party listen in. For some reason, PGP isn't well-suited for that. Whenever I see someone not use PGP, I assume that's the reason they chose to use weaker tech.

--
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
isn't that the NSA 'secure chat' system? by MichaelSmith · 2013-12-20 08:15 · Score: 1

Seriously, how do you know you can trust this thing?

--
http://michaelsmith.id.au
Ah OH! by Anonymous Coward · 2013-12-20 09:08 · Score: 1

Signing up requires java script to be enabled. Are they tracking you? Email address is also required, but you could give them mixnym.net address to obscure that.
1. Re:Ah OH! by Anonymous Coward · 2013-12-20 09:11 · Score: 1
  
  And then there is this:
  We need to confirm your email address.
  To complete the subscription process, please click the link in the email we just sent you.
  Boy, are they interested in privacy NOT!
bottorrent == realplayer by farble1670 · 2013-12-20 10:15 · Score: 1

in it's level of respect for the user and their computer. i installed the BT client on my mac, and it went into the preferences of firefox, safari, and chrome and changed my default search engine to yahoo, then set it so the yahoo home page loads every time i start the browser.
disgusting. i'll never install another product from these guys.
Re:Way over their capabilities by copsi · 2013-12-21 08:19 · Score: 1

Actually: ©2013 BitTorrent, Inc. uTorrent is a trademark of BitTorrent, Inc.

It is interesting though that develop two different clients and do not advertise uTorrent on their main site.
It gets better.. by snowsnoot · 2013-12-21 16:19 · Score: 1

IETF has a working group called P2PSIP which is basically the same thing as mentioned here except over SIP. Basically it is an extension to SIP called REsource LOcation And Discovery (RELOAD), and it allows people to make and receive telephony/video calls over SIP/RTP over a completely decentralized infrastucture, ie. without the phone company. 911 and other stuff hasnt been worked out yet so I dont see it replacing the incumbent telcos at this time, but at the very least it seems like a nice anonymous and open alternative to Skype. What I find interesting is that the AD for this WG is Gonzalo Camarillo, a research guy for Ericsson. I can't see Ericsson or any of their customers getting too excited about any RFC's coming out of this WG. https://ietf.org/wg/p2psip/charter