• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Still using an insecure messaging client?? Want security?

K

KevinMU1

Senior member
Back in March, BitWise Chat was first introduced. We've come a long way.

All messages and file transfers are now encrypted!. Chat and transfer knowing that the kids sniffing your neighborhood cable connection can't see what you're doing! Oh, and your messages are now compressed too, minimizing data transfer and maximizing speed!

BitWise still offers all of its old features too: offline messaging, small & portable single exe file (286k!), blazing fast transfers, a server-less mode, chat logging, time-saving macros, and personal support online at any time.

Try it. I think you'll be pleasantly surprised. Some of our users report uninstalling AIM and ICQ minutes after installing BitWise. Powerful testimonies indeed. Maybe you will be next?
 
Originally posted by: KevinMU1
Try it. I think you'll be pleasantly surprised. Some of our users report uninstalling AIM and ICQ minutes after installing BitWise. Powerful testimonies indeed. Maybe you will be next?
Click to expand...

Sounds like a bald faced lie. The only way anyone would uninstall AIM and ICQ is if all their friends and acquaintances switched to BitWise also. But then again...
 
1. Still looks like its windows only
2. No mention of encryption algorithm (you are using a time tested/peer reviewed algorithm right?)
3. Source is closed 🙁
4. Jabber appears to use OpenPGP for message signing, Fire can also sign messages
5. Encryption does not make something secure 😉
 
I also wanted to mention, as a "voyeur" in many chat sessions most people are boring and have no need for encryption. 😛 But its still a great privacy/content authenticity feature (but this is very much dependant on the encryption schemes, algorithms, etc).

Ive always considered direct connect a pain, it requires extra firewall hijinks.

The licensing terms are too long and are too restrictive, so your software is not only not open source, but not free (speech).

You have to register to download the software?

If someone were to reverse engineer your software to get information on the protocols and whatnot to make a free alternative or a port for a non-Microsoft OS, would you sue?

I know I give you a lot of questions and crap when you post about this bitwise thing, but Its fun. Plus, they are semi-interresting BUMPs 😉
 
also a point to note is : encryption with out authentication is pointless. And i got $100 you are not properly strongly authenticating the client at all.
 
OK, let's see if I can at attempt to address all these issues/comments:

- There are no bald faced lies here. Believe it or not, some people only have a few users on their buddy list, all of whom happen to hate the chat program they're currently using. For them, switching isn't so hard.
- ed21x: common problem. It typically takes getting a few friends on, striking up a conversation with one of the other online users (admittedily difficult in the wee hours of the morning). See the online users page.
- Encryption: the encryption that we use is the maximum allowed by US export laws, since we have users from all over the world. We use both Blowfish and RSA. For the exact encryption scheme, I'll explain that after I finish this list. 🙂 So, see below...
- n0cmonkey: It is still Windows, and it is still closed source. I agree that encryption is not generally useful, but there are places where I may be talking about something sensitive, and it's nice to have a bit of assurance that someone can only few it with a few days worth of crunching keys against my message. How do you figure that its not free? And I welcome your crap, these discussions are typically somewhat interesting. 😉
- Direct Connect: You're rigth, it is somewhat of pain, but it also minimizes the number of nodes that a message has to go through, and it sure as hell reduced the load on a server. Our model does support server-based messaging if direct connects are not possible, it has since May.
- Registration: You have to register to use AIM too. How do you propose getting an account to sign on with without registering???
- Reverse Engineering: I don't know how I feel about that. I don't think I would go through the effort of a lawsuit. Again, though, it already IS free. Tell me how it's not free. The encryption will substantially hamper reverse engineering.

How the encryption works:

Client 1 connects to client 2
Client 1 sends its 128-bit RSA public key to client 2
Client 2 encrypts a randomly generated 64-bit Blowfish session key (new for each connection) using client 1's public key
Client 2 sends the encrypted session key back to client 1
Client 1 decrypts the Blowfish session key using its private key
Session key is established and communication begins

I realize that these bit strengths are low, but they still would take a few days to crack. The goverment regulates encryption software, and, like I said, we have users all over the world, and these bit strengths are the highest that are allowed by US export laws. Anything higher and I could end up in jail.

Hopefully that clarifies a few things. I await round 2. 😛

If you log in, feel free to say hi to me, my name is "Kevin" on BitWise. 🙂
 
I'd trade insecurity over useablity anyways. Not like my convos are that important or need to be secure anyways. So how many people are using this?
 
Originally posted by: KevinMU1
OK, let's see if I can at attempt to address all these issues/comments:

- There are no bald faced lies here. Believe it or not, some people only have a few users on their buddy list, all of whom happen to hate the chat program they're currently using. For them, switching isn't so hard.
- ed21x: common problem. It typically takes getting a few friends on, striking up a conversation with one of the other online users (admittedily difficult in the wee hours of the morning). See the online users page.
- Encryption: the encryption that we use is the maximum allowed by US export laws, since we have users from all over the world. We use both Blowfish and RSA. For the exact encryption scheme, I'll explain that after I finish this list. 🙂 So, see below...
Click to expand...

Open, peer reviewed standards.

- n0cmonkey: It is still Windows, and it is still closed source. I agree that encryption is not generally useful, but there are places where I may be talking about something sensitive, and it's nice to have a bit of assurance that someone can only few it with a few days worth of crunching keys against my message.
Click to expand...

Use a secure phone line 😛

No, I think its a great feature actually, I just dont think most people know how boring they are. Ive read a half dozen chats that people are in and Ive wanted to connect to whatever chatserver they were on and just tell them they are absolutely boring and need to talk about something more interresting before I fell asleep 😛

How do you figure that its not free? And I welcome your crap, these discussions are typically somewhat interesting. 😉
Click to expand...

Free as in speech. There is no code out there I can monkey with. Your license is fairly restrictive. My software choices, when multiple relatively equal choices exist is: Free, Open, Proprietary. Price does not come into the equation, its a morality thing.

- Direct Connect: You're rigth, it is somewhat of pain, but it also minimizes the number of nodes that a message has to go through, and it sure as hell reduced the load on a server. Our model does support server-based messaging if direct connects are not possible, it has since May.
Click to expand...

Good to know.

- Registration: You have to register to use AIM too. How do you propose getting an account to sign on with without registering???
Click to expand...

No, just that you have to register before downloading the client. Just a pet peve, like the license link opening in a new window 😛

- Reverse Engineering: I don't know how I feel about that. I don't think I would go through the effort of a lawsuit. Again, though, it already IS free. Tell me how it's not free. The encryption will substantially hamper reverse engineering.
Click to expand...

Yeah, guess you are right. Im not planning anything, just curious 🙂

How the encryption works:

Client 1 connects to client 2
Client 1 sends its 128-bit RSA public key to client 2
Client 2 encrypts a randomly generated 64-bit Blowfish session key (new for each connection) using client 1's public key
Client 2 sends the encrypted session key back to client 1
Client 1 decrypts the Blowfish session key using its private key
Session key is established and communication begins

I realize that these bit strengths are low, but they still would take a few days to crack. The goverment regulates encryption software, and, like I said, we have users all over the world, and these bit strengths are the highest that are allowed by US export laws. Anything higher and I could end up in jail.

Hopefully that clarifies a few things. I await round 2. 😛

If you log in, feel free to say hi to me, my name is "Kevin" on BitWise. 🙂
Click to expand...

US crypto export laws suck. Clinton helped out a bit, but I know Bush wont do a damn thing. Go Canada! 😉
 
brtspears2--usability is another priority. We try to make it simple but powerful. We currently have almost 1000 regular users, and have had over 30 people logged in at the same time. We average 10-15.

n0cmonkey, would you rather download the client first and register for an account from within it? Also.... you can download it without registering, there is no real check on your username.

I don't have any control over the cryptography laws, I just have to abide by them. 😉
 
Originally posted by: KevinMU1

I don't have any control over the cryptography laws, I just have to abide by them. 😉
Click to expand...

I use software that was developed in more understanding countries 😉
 
Originally posted by: Zenmervolt
Still using an insecure messaging client??
Click to expand...
Nope, I've found that Trillian is quite confident and that it doesn't suffer from insecurity at all. 😛

ZV
Click to expand...

With all of the different protocols it supports, its making up for something...
 
Originally posted by: KevinMU1
All messages and file transfers are now encrypted!. Chat and transfer knowing that the kids sniffing your neighborhood cable connection can't see what you're doing! Oh, and your messages are now encrypted too, minimizing data transfer and maximizing speed!
Click to expand...

encrypted and encrypted too?!?!? No.. you don't say! 😉


just teasing.. you mean "compressed too" right? hehe..

Though is the overhead (cpu time and compression headers) worth it for the short messages that typify IMs?
 
OK I'm a moron, that was supposed to be compressed. 😛 I changed it. That's what happens when I post late. 😉
 
n0cmonkey--what are you implying that is lacking in Trillian?

I use Trilian, religiously. However, I would kindly remind everyone of why we started BitWise in the first place. Remember when AOL kept blocking Trillian? yeah... that got pretty annoying. That's exactly the reason that we don't tie in with other services, because then we become reliant on them. Plus, with BitWise, even if the server goes down, you don't lose your ability to chat in your existing connections, and with static IPs, you can even still initiate new conversations. Without the dependency on other networks' servers, or even our own, your messaging is less prone to interruptions.
 
manly, not in all cases. We use Blowfish encryption, which is non-compressing. If you encrypt 1000 bytes with Blowfish, you get 1000 bytes back. So the encryption is not redundant in this case.
 
You must log in or register to reply here.
Back
Top