News for hackers. Stuff that matters.

A comment on BitTorrent Chat - Private instant messaging via secure, distributed technology. Parent comment

Re:BitTorrent Chat - Private instant messaging via secure, d... by taway2012 on Monday September 30, 2013 @06:19PM (#6472763)
They can split the program into two parts. The "UI" part and the "transport" part.

The UI part will be in charge of converting plaintext into ciphertext and vice versa. ciphertext will be handed off to the transport module.

The transport module can remain closed source. Only the API to the transport needs to be published. People can write their own UIs.

[ Parent | on HN ]
Re:BitTorrent Chat - Private instant messaging via secure, d... by tokenizerrr on Monday September 30, 2013 @06:50PM (#6472888)
But that would defeat the point of opening the source, the part we're interested in is the security of the transport not how that pretty UI is made.
[ Parent | on HN ]
Re:BitTorrent Chat - Private instant messaging via secure, d... by x0054 on Monday September 30, 2013 @08:29PM (#6473265)
If the UI module does encryption and decryption, and if the said encryption is good enough, why would you care if the transport layer steals your encrypted data?
[ Parent | on HN ]
Re:BitTorrent Chat - Private instant messaging via secure, d... by makomk on Tuesday October 01, 2013 @10:15AM (#6476267)
The transport layer is running on the same computer at the same trust level as the encryption layer, which means it can intercept the unencrypted data. Even if the developer's 100% honest it's easy for them to accidentally create a remote code execution vulnerability that allows an attacker to do this.
[ Parent | on HN ]