John McAfee releases secure anti-surveillance messaging app ‘Chadder’

21 点作者 mroling大约 11 年前

26 条评论

nodata大约 11 年前

Or use TextSecure and RedPhone: <a href="https://whispersystems.org/" rel="nofollow">https://whispersystems.org/</a> (<a href="https://github.com/WhisperSystems/TextSecure/" rel="nofollow">https://github.com/WhisperSystems/TextSecure/</a>)

评论 #7698360 未加载

评论 #7698034 未加载

ctz大约 11 年前

Some observations:- This uses an external service 'scrambls' (<a href="https://scrambls.com/" rel="nofollow">https://scrambls.com/</a>) which seems to do per-message symmetric key management. Therefore, the owners of this service can read all your messages.- The thing which seems to be sent along with the ciphertext is an 'XID' which is sent to scrambls and exchanged for the raw AES message encryption key. There doesn't seem to be any binding to the recipient in this step(?)- The encryption of messages is AES-CBC with PKCS#5 padding. There is no message integrity, so therefore this provides no confidentiality under CCA2.In conclusion, this is the sort of thing you should expect from a secure messaging app. (TextSecure excepted.)

评论 #7698273 未加载

casca大约 11 年前

Having access to source is no guarantee of security or correctness (see Heartbleed) but relying on any of these secure messaging apps seems optimistic. Writing correct crypto code is hard and John McAfee's involvement offers no assurances.

评论 #7697961 未加载

评论 #7698168 未加载

评论 #7698023 未加载

davexunit大约 11 年前

Free software is a prerequisite for software to be "anti-surveillance" and I see no indication that Chadder is free software.

评论 #7697988 未加载

memorion大约 11 年前

So that's an iPhone screenshot on what appears to be a Nexus 4 without the navigation buttons with the android contact icons but there isn't even an iOS version yet. The first screenshot in the playstore shows the windows phone version and the second is the actual android version, what?

EC1大约 11 年前

Why do people keep releasing messaging applications? These things rarely, if ever catch on.Awaiting the inevitable HN thread about how Chadder is flawed.

评论 #7698074 未加载

评论 #7698056 未加载

评论 #7698057 未加载

jacquesm大约 11 年前

McAfee ceased to be a brand that you'd want to be associated with a while ago, I wonder what they intend to achieve by attaching their reputation to his.Toxic doesn't even begin to describe it, he's the IT world equivalent of a rogue.

评论 #7697984 未加载

评论 #7697989 未加载

motters大约 11 年前

If the source code isn't available then any claims to being secure should be treated cautiously. For instance, how do we know that there aren't heartbleed-style errors in this anti-surveillance app?

评论 #7698035 未加载

sschueller大约 11 年前

Isn't McAfee back in the US? You can't trust crypto tools that are closed source form the US. The current state of laws make that impossible. [1] [2][1] <a href="http://en.wikipedia.org/wiki/National_security_letter" rel="nofollow">http://en.wikipedia.org/wiki/National_security_letter</a> [2] <a href="http://en.wikipedia.org/wiki/Patriot_act" rel="nofollow">http://en.wikipedia.org/wiki/Patriot_act</a>

a1a大约 11 年前

I think the biggest problem here is that the application claims to be "anti-surveillance" yet it doesn't really solve the surveillance problem, namely meta-data.If anything this application helps surveillance by filtering out the communication from "regular" communication.We have had encrypted messaging for ages now. I cannot tell what's new here.

评论 #7698115 未加载

chrisdevereux大约 11 年前

Anyone care to explain how this is supposed to work? If Chadder don't store or transmit the key, how does the person I'm sending a message to have it?The ambiguity in the way the video explained it makes me a bit suspicious.

评论 #7698028 未加载

评论 #7698041 未加载

andor大约 11 年前

Oh wow. It uses a very innovative REST key exchange protocol.Encryption:<pre><code> * Messages are encrypted with AES 128 CBC * Random key for each message * The AES key is sent to the server, and exchanged for some key-id * They key id is prepended to the message </code></pre> Decryption:<pre><code> * Split message into key id and encrypted part * Download key from server * Decrypt message </code></pre> Edit: Decompile it to see for yourself

评论 #7698144 未加载

评论 #7698240 未加载

SchizoDuckie大约 11 年前

Anything that claims to do 'APP X' with 'encryption' these days should not put itself out there without posting a full (and RECENT) security audit by an un-biased third party.Otherwise, I'm going to assume you are still leaky as hell, make mistakes and have not cleaned up your code, etc.And no, claiming you are 'open source' doesn't cover it (And I Don't even have to refer to Heartbleed here)

atanasb大约 11 年前

When is the iOS client going to be released? It's kind of interesting that this comes up on HN and at the same time a security leak [0] in the iOS email client is found.[0] <a href="http://www.macrumors.com/2014/05/05/ios-7-email-attachment-encryption/" rel="nofollow">http://www.macrumors.com/2014/05/05/ios-7-email-attachment-e...</a>

dm2大约 11 年前

Do the phones have to be online at the same time in order to send the first key or does a Chadder server distribute the keys to each pair of users but simply not store the key after it's distribution?Sorry if this question sounds ignorant, the details and best practices of encryption are way over my head.

评论 #7698158 未加载

dewey大约 11 年前

Even if it's not directly relevant to the product in question but I always think it's a bit weird to promote a "secure" product and don't even have SSL enabled on your own website. It's not like it's expensive to get a simple certificate these days.

评论 #7698025 未加载

sajithdilshan大约 11 年前

I'm confused. Does this app uses public key encryption? if so, how do I obtain the actual public keys of all my contacts? Do we have to personally meet and exchange the public keys?

schrodinger大约 11 年前

They didn't even capitalize his last name properly:<pre><code> We are also very excited to announce our partnership with John Mcafee and Future Tense Central!</code></pre>

akumen大约 11 年前

So the client is open source but the server and backend isn't, same as Telegram? What is the point? That and McAfee doesn't exactly inspire confidence.

评论 #7697981 未加载

phpnode大约 11 年前

wow, that's a distracting background. Also the video doesn't explain how the key exchange works, and isn't that the important/hard bit?

评论 #7698020 未加载

zokier大约 11 年前

Only explanation they give is that it "uses encryption" and that should make the app trustworthy? Is this a joke?

n1ghtmare_大约 11 年前

Is the name McAfee supposed to be a plus ? Isn't he kinda crazy these days ? That's a red flag in my book.

hemaljshah大约 11 年前

If that's how they designed the website, I'm a little scared to download the app.Also, no iOS?

JohnDoe365大约 11 年前

I thought he is in prison? Or at least under investigation?

higherpurpose大约 11 年前

So how does it do that encryption? Through magic?

mantrax5大约 11 年前

Nothing against John McAfee, I have no idea what happened in Belize, and he can probably have a wonderful career as a reality TV star or a similar effort.But I wouldn't touch a security product he offers with a 20 foot pole. Literally I wouldn't even visit the site, let alone hover my mouse over the download link.And no, not because of McAfee Antivirus, but despite it.