Hi all,
there's a lot of development around the secure instant messaging nowadays (also thanks to Mr. Snowden), but most of those which are claimed to be secure, actually revealed not to be. The problem lays behind the handling of the crypto things, which as you know are a real pain in the ass for anyone in the world. The problems of most of the available systems are that often are not peer-reviewed, or too young, or have poor math (e.g. poor random) or, more often than you think, release data for side-channel attacks. In some cases they also revealed to be purposely not secure for commercial reasons (like Snapchat). This so far the status of the latest news which I collected, about the main known programs. However I would love other suggestions and improvement on this list and eventually a shared effort on peer-reviewing these things, we could also consider opening a wiki page on the CRTL web (?)

OTR
• Of course the first mention goes to the grandfather of all these systems which is OTR, actually probably the most secure one: peer-reviewed, stable and used since years. But again not all the implementation of OTR are secure enough. Pidgeon is quite secure, but there are also other systems like IM+ on iOS


Telegram, the state of security, not so good..
• http://security.stackexchange.com/questions/49782/is-telegram-secure
• http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/

Snapchat state of security. Well it is not indeed a crypto chat system, but it has some sort of security/privacy functionalities
• http://www.theguardian.com/media-network/partner-zone-infosecurity/snapchat-photos-not-deleted-hidden

Whatsapp
• whatsapp started encrypting their data. This is from their faq: http://www.whatsapp.com/faq/general/21864047
• But apparently did not get it right: http://www.pcworld.com/article/2053480/doh-basic-flaw-in-whatsapp-could-allow-attackers-to-decrypt-messages.html
• What that means is that if the police/NSA have your encrypted conversation, they can decrypt it.

There are other systems I still have not investigated..
• https://whispersystems.org/
• Zimmermann Blackphone
• Cryptocat, http://www.net-security.org/secworld.php?id=16857
• XMPP latest encryption improvement http://thehackernews.com/2014/05/xmpp-makes-encryption-mandatory-for.html
• TOX, which is system suggested in several underground forums (http://tox.im/)
• ProtonMail, http://thehackernews.com/2014/05/protonmail-nsa-proof-end-to-end.html?m=1



.. And what about the voice channels?

Textsecure deserves a mention. iOS app coming soon too EDIT never mind, saw you mentioned whisper systems.

What about Chadder?

@ZaiRoN, I don't know anything about chadder, could you add some references, expecially about a security review?

Moreover I added to the first post Protonmail, which is an european (Swiss) clone of Lavabit (the anon email service which Snowden used and NSA dropped down afterward). Being Swiss they say that the NSA tentacles will not be long enough.. dunno, but sounds good!

I was asking because it's a new instant messaging program made by Future Tense Central (founded by J. Mcafee...). Too bad I don't have any good references about its privacy right now, it catches my attention because the incipit from their home page is really interesting: "Chadder keeps your information safe by using encryption. When you send a message, only the recipient can see it - everyone else, including us, see only garbled, encrypted text. We do not have the key to unlock your message, so no one - including us - can read or track your messages."

FUTURE TENSE CENT

What are you planning, Shub?

my intent would be to do a shared effort to find a tool which we, as reversers, could use. Among those available, not developing one, because it would be too cumbersome (bullet proof cryptography is a pain in the a** for almost anyone in the world). I mean go beyond the advertisements and see if there's substance under the hood..

Thanks, Shub.

The interesting thing here, is that almost everyone focuses on encryption and decryption breakthroughs. Also, many of the people globally assume (included what's written in popular literature) that the agencies, like NSA, FBI, CBI and god know who else, are all holding some crypto breakthroughs from the public. Therefore, most people tend to focus on trying to see how much crypto breakthrough knowledge these agencies have (a rule of the thumb would be around 10-12 years ahead of the outside world)

What no one tries to understand or think about (which I read in the paper "Encryption Works" from Freedom of Press site) is that these agencies may also be holding out on MATHEMATICAL breakthroughs. The implications are tremendous. Far and above what it would have been, if they were holding out on crypto breakthroughs.

Imagine a mathematical formula discovered (the world does not know about it's existence yet!) that can easily break 2048 bit AES. While people are trying to make the CRYPTO stronger, the agencies are making their discoveries in MATHEMATICS, not CRYPTO.

I don't really know what's the scenario. And I don't want to give a "doom and gloom" approach. But I am not sure any methods today (including PGP or GnuPGP or AES) are undecipherable. Note my connotation - not unbreakable, but decipherable. This means, regardless of the crypto or the ECC or the hard seeds or TRUE randomisation, the agencies CAN break it because there are MATHEMATICAL breakthroughs, that we don't even know yet.

So I sometimes think the best policy is not to talk on the internet, what you don't want others (equally applicable not to the agencies, but even large companies) to hear.

But then again, I digress from the topic...

Wanted to present just a different viewpoint.

Have Phun

Hi,
I totally agree with you, just, to make it simple, look a the Phil Zimmermann story and the prosecutions he was victim of when he published the PGP crypto architecture (there's and interesting book that tells the whole story, but don't remember it's name), and here I don't speak of the crypto algorithm itself, but the trust architecture (peer-to-peer chains of trust of identities) he proposed, on purpose to avoid the need of a CA. It's anyway since the time of RSA being published that we know/suspect that NSA has backdoors on most crypto algorithms. Coming to nowadays indeed my own opinion is that all the solutions I'm listing in the first post, in terms of prevention from NSA, are more or less not so useful, for the reasons you say and some other more: not all are well implemented, all are based on exactly the same crypto algorithms. Probably the most secure algorithms is ECC, due to its peculiar characteristics, but I'm not a crypto expert nor a mathematician and here I report what I read in papers.
Anyway, nowadays the best option is to semantically crypt your messages and to hide them between the masses. Al queda did so, hide normal conversation in the mass of conversations (and having said al queda now the NSA server will poin to woodman board and shut it down). By the informatics point of view it is like so: you move the encryption at the human level, out of the ICT system. You can understand it thinking to steganography, but it's not only this it's something different: steganography is a syntactical way to hide bits of information into a text, while I'm speaking of semantically hide the information.

Then there's another completely different topic that deals with where you are/live/do you cyber stuffs. Don't ever forget that all these companies are American and that's the law order they only have to respect. Requests coming from foreign police forces are worked out only as a "pleasure" or public image of the company (market) or due to an international investigation request, which is also not possible for all the crimes.. And even in these rare situations the procedure is long and complex and not always ends with a full investigation. Then the phrase "hide between the cracks" is still very well true, as mr Snowden clearly demonstrated..

Did ya ever think that it is a consortium of government whiz kids from
around the world that leak the latest greatest encryptions after they
have already developed the algo only to have already installed
the back door before it is released ?

For a while I thought they were threatening the crypto developers into
letting them install the BD but after reading what others have said.....

Since there are more then a handful of us who suspect such things, I would bet it's true.

Its not beyond the USA government to pay a bunch of math PHD's to do this stuff.
That way, they have encryption that is always a step or 12 years above us.

(I'm not worried about the USA government, How the hell do you think they get their ideas ?)

Woodmann

Did I scare everyone away ?

http://bostonherald.com/business/business_markets/2014/06/startup_to_deliver_encrypted_email

Just a follow up to the earlier mention of protonmail.
So, because MIT and CERN developed it and it is hosted in Switzerland,
I am to believe it is secure ? Bullshit.

And I am also skeptical of this little tidbit of news:
http://online.wsj.com/articles/google-invests-in-satellites-to-spread-internet-access-1401666287

Just what we need, a direct all access for anyone in the world clearing house.
Data mining will take on a whole new meaning if this happens.

So anyway, hows the weather ?

Woodmann

Hey Shub,

I recommend you look into whisper systems. Supposedly there are some very great crypto people behind it, and I've only heard good things about it. Plus it's open source.

-rendari.