On Sunday, Block CEO and Twitter co-founder Jack Dorsey launched an open source chat app called Bitchat, promising to deliver โsecureโ and โprivateโ messaging without a centralized infrastructure.
The app relies on Bluetooth and end-to-end encryption, unlike traditional messaging apps that rely on the internet. By being decentralized, Bitchat has potential for being a secure app in high-risk environments where the internet is monitored or inaccessible. According to Dorseyโs white paper detailing the appโs protocols and privacy mechanisms, Bitchatโs system design โprioritizesโ security.ย
But the claims that the app is secure, however, are already facing scrutiny by security researchers, given that the app and its code have not been reviewed or tested for security issues at all โ by Dorseyโs own admission.
Since launching, Dorsey has added a warning to Bitchatโs GitHub page: โThis software has not received external security review and may contain vulnerabilities and does not necessarily meet its stated security goals. Do not use it for production use, and do not rely on its security whatsoever until it has been reviewed.โย
This warning now also appears on Bitchatโs main GitHub project page, but was not there at the time the app debuted.
As of Wednesday, Dorsey added: โWork in progress,โ next to the warning on GitHub.ย
This latest disclaimer came after security researcher Alex Rodocea found that itโs possible to impersonate someone else and trick a personโs contacts into thinking they are talking to the legitimate contact, as the researcher explained in a blog post.ย
Rodocea wrote that Bitchat has a โbroken identity authentication/verificationโ system that allows an attacker to intercept someoneโs โidentity keyโ and โpeer id pairโ โ essentially a digital handshake that is supposed to establish a trusted connection between two people using the app. Bitchat calls these โFavoriteโ contacts and marks them with a star icon. The goal of this feature is to allow two Bitchat users to interact, knowing that they are talking to the same person they talked to before.ย
Dorsey did not respond to TechCrunchโs request for comment sent to his Block email address.ย
On Monday, Radocea filed a ticket on the GitHub project to ask how to report the security flaw he discovered in the Bitchat Favorites system. Soon after, Dorsey marked it as โcompleted,โ without comment. (Dorsey re-opened the ticket on Wednesday, saying security issues can be reported by posting on GitHub directly.)
Another person reported concerns with Dorseyโs claims that Bitchat has โforward secrecy,โ a cryptographic technique that ensures that even if an attacker steals or compromises an encryption key, that attacker still cannot decrypt previously-sent messages.
Someone also pointed out a potential buffer overflow bug, which is a common type of security vulnerability where a hacker can force a deviceโs memory to spill out to other locations, opening the door for a data compromise.
Radocea warned that Bitchat users should not trust the app yet.ย
โSecurity is a great feature to have for going viral. But a basic sanity check, like, do the identity keys actually do any cryptography, would be a very obvious thing to test when building something like this,โ Radocea told TechCrunch. โThere are people out there that would take the messaging around security literally and could rely on it for their safety, so the project in its current state could endanger them.โ
Referring to his and other peopleโs findings, Radocea criticized Dorseyโs warning that Bitchat has not been tested for security.ย
โIโd argue it has received external security review, and itโs not looking good,โ he said.
