Jack Dorsey says his ‘secure’ new Bitchat app has not been tested for security

Sunday, Block CEO and co-founder of Twitter Jack Dorsy Launched an open source chat app called Bachat, Committed Provided “protected” and “personal” messages without centralized infrastructure.

The app depends on the Bluetooth and end -to -end encryption, contrary to the traditional tailor messaging applications that depend on the Internet. By decentralized, there is a possibility of a protected application in the high-risky environment of the beaches where the Internet is monitored or accessible. According to Darsi White paper With the details of the protocol and privacy processes of the app, the system design protection “priority” of the Bichat system design.

However, claims that the application is protected is already facing verification by security researchers, that the app and its code has not been reviewed or tested at all for security issues – by Dorssi’s own admission.

There has been dorsi since launching Added to a warning On the GitHub page of the Bichet: “This software did not receive external protection review and it may have weaknesses and it does not meet its described security goals. Do not use it for production use, and do not rely on its protection until it is reviewed.”

This warning has now appeared on the main GitHub project page of the Bichat, but the app was not there at the time of its debut.

As Wednesday, Dorsy Associated: “Work on progress” next to Githab’s warning.

This is the latest refusal after the protection researcher Alex Rhodosia made the disguise of someone else and the acquaintances of a person speaking a person’s acquaintance with legitimate communication. Researcher explained in such a blog postThe

Rhodosia writes that Bichat has a “broken identity authentication/verification” system that allows the attacker to prevent someone’s “identity key” and “peer ID pair” – basically a digital handshake that uses the app to establish a trusted connection between the two. Bachat calls these “favorite” contacts and marks them with a Star icon. The goal of this feature is to allow two -walled user to interact, they know that they have talked to the same person that they had talked earlier.

Dorcey did not respond to Techcunch’s request for comment sent to his block email address.

On Monday, Radosia filed a ticket on the Githab project so that he discovered the security error he had discovered on the Bachat Favorite system. Soon, Dorcey identified it as “complete”, without comment. (Dorsy tickets open again On Wednesday, the issues of security can be reported directly by posting Githab.)

Another person Report There is concern with the claim of Dorcey that there is a “forward secrecy” of the Bichat, a cryptographic technique that ensures that if an attacker steals or compromises an encryption key, the attacker still cannot decrypt the previous messages.

None Indicated A potential buffer overflow bug, which is a common type of protection weakness where a hacker can force the memory of a device to spread to the other place, to open the door to compromise data.

Radosia warned that the beaches users should not be trusted in the app yet.

“Protection is a great feature for viral,” Radosia tells TechCrunch. “There are some people that will literally accept the messages of protection and rely on them to protect them, so its current situation can endanger them.”

Referring to the search for him and the other people, Radosia criticized Dorsy’s warning that it was not tested for the protection of the prostitute.

“I argued that it had received outward security reviews, and it didn’t look good,” he said.