[ANNOUNCE] Bitmessage - P2P Messaging system based partially on Bitcoin

[minimalB]

Is Hemlis project in any way related to Bitmessage project?

https://heml.is

[nimda]

Is Hemlis project in any way related to Bitmessage project?

https://heml.is

No. I'm skeptical about hemlis.

[favdesu]

I mean bm is almost pgp, million times better than email, but why not also add pgp. It's just an extra second vs in jail for years.

+1 for pgp, shouldn't be too hard to implement, right?

[bitpop]

No implementation. Do it yourself. Keep it segregated. Gpg4win is great.

[bitpop]

That could make a killing. Who wants to join me in making the next Gmail?

[Rassah]

If Bitmessage's encryption is broke, how will an extra PGP encryption help? Don't they both use the same encryption algorithm?

[marcus_of_augustus]

If Bitmessage's encryption is broke, how will an extra PGP encryption help? Don't they both use the same encryption algorithm?

Not necessarily and unlikely. Most PGP use RSA and bitmessage is using ECC.

[mmeijeri]

The other day I read about OTR, Off-the-Record Messaging, which seems superior to Bitmessage in some ways, but can probably be usefully combined with it. There's a comparison chart on the Bitmessage wiki, but it leaves out the strengths of OTR (perfect forward secrecy and deniability), unjustly making it look inferior.

Off-the-Record Communication, or, Why Not To Use PGP

Wikipedia describes OTR as follows:

Off-the-Record Messaging, commonly referred to as OTR, is a cryptographic protocol that provides strong encryption for instant messaging conversations. OTR uses a combination of the AES symmetric-key algorithm, the Diffie–Hellman key exchange, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides perfect forward secrecy and malleable encryption.

The primary motivation behind the protocol was providing deniability for the conversation participants while keeping conversations confidential, like a private conversation in real life, or off the record in journalism sourcing. This is in contrast with other cryptography tools that produce output which can be later used as a verifiable record of the communication event and the identities of the participants. In most cases, people using such cryptography software are not aware of this and might be better served by OTR tools instead. The initial introductory paper was named "Off-the-Record Communication, or, Why Not To Use PGP".

[bitpop]

I don't see how it's better and there's no client.

[domob]

I don't see how it's better and there's no client.

The point with OTR is (as also written in the article linked from the previous poster) is that, as far as I understand it, it creates a "temporary secret" used only for one session and discarded afterwards.  This makes it impossible for an attacker in the middle to store the communication and decrypt it later if the private key of one of the users involved is disclosed after the communication.  It also gives deniability unlike PGP where, if a key is compromised, your messages give for instance perfect proof (in court or for whatever reason else) that you actually wrote them (because of your signature).

I'm not sure about an "official client", but there's a library released by the project and it is actively used for instance in Pidgin or Jitsi (also mobile clients are available).  I use Pidgin with OTR for encrypted XMPP chats regularly and it works very, very well.

Note however that I think OTR is much better suited to "instant message like" communication than emails (because it requires a handshake to establish a secure connection, AFAIK), thus I'm not sure how well it would fit to Bitmessage, where sending a message is also quite expensive and takes time because of PoW.

[bitpop]

Hmm whatever keeps me out of jail ;-)

[docius]

I managed to create a .app/dmg of Bitmessage after I got it to successfully install on my Mac. So far I've had a couple of people report that it works, but feel free to test it out.

Credit: medoix for technical assistance

Ok, here's the link: https://mega.co.nz/#!PJFB3bjQ!N_4SGGxo5gcr65ubabowd1dZPTpIOdf_Pb2j7hBO9js

[prophetx]

I would still use pgp.. for certain messages. Bm hasn't been fully audited yet, a vulernability could exist.
Plus your keys could be stolen like a wallet.

Its motivating that Im not the only paranoid person here I believe that paranoia is an evolutionary benefit in the society we got today.

How much would an audit cost?  Which entities could perform a trusted audit?

[bytemaster]

The encryption behind BitMessage is solid and adding PGP is entirely redundant.   

The problem with OTR is exchanging the initial public key.  DH does not prevent man in the middle attacks.   The problem with Certificate Authorities is they are only as secure as the weakest link.  Other forms of key exchange are not 'easy to use' and ultimately result in BM style 'address exchange' over an out-of-band channel. 

BitMessage has some weaknesses and the whole address structure, signing key vs encrypting key is ultimately based upon a poor understanding of the possibilities with ECC DH.   I am working on a C++ / Qt based enhanced version of BitMessage that solves many of the problems of BM including the addresses and use of ECC that is lower bandwidth and yet more secure.

This will be released as part of beta-testing the P2P network / broadcast code behind BitShares.

[bitpop]

Redundant vs life in prison...

[Anon136]

Redundant vs life in prison...

what are you some sort of russian spy or something?  

what are you going to get life in prison over should your security become compromised?

[bitpop]

Let's just say I have a special pen pal

[ffcitatos]

what are you some sort of russian spy or something?  

what are you going to get life in prison over should your security become compromised?

C'mon, this is the interwebs, do not take everything that is being said that seriously

Mr. bitpop is probably just having some fun here.

[bitpop]

Just realize, if you use encryption, you must think in terms of life in prison or why use encryption in the first place

[bytemaster]

Just realize, if you use encryption, you must think in terms of life in prison or why use encryption in the first place

Or you could spend life in prison for failing to turn over your keys.

Or perhaps you just don't want your identity stolen.