SCATTERCHAT - Secure, encrypted IM Chat client released..

[Rosco T.]

http://www.scatterchat.com/index.html

ScatterChat is a HACKTIVIST WEAPON designed to allow non-technical human rights activists and political dissidents to communicate securely and anonymously while operating in hostile territory. It is also useful in corporate settings, or in other situations where privacy is desired.

It is a secure instant messaging client (based upon the Gaim software) that provides end-to-end encryption, integrated onion-routing with Tor, secure file transfers, and easy-to-read documentation.

Its security features include resiliency against partial compromise through perfect forward secrecy, immunity from replay attacks, and limited resistance to traffic analysis... all reinforced through a pro-actively secure design.

[bemildred]

1. Sounds like TOR.

http://tor.eff.org/

[salvorhardin]

5. It is based on TOR and GAIM

Tor is an implementation of second-generation onion routing — a system enabling its users to communicate anonymously on the Internet. Originally sponsored by the US Naval Research Laboratory, Tor became an Electronic Frontier Foundation (EFF) project in late 2004. The EFF supported Tor financially until November 2005 <1>, and continues to provide web hosting for the project.
http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29

It is a secure instant messaging client (based upon the Gaim software) that provides end-to-end encryption, integrated onion-routing with Tor, secure file transfers, and easy-to-read documentation.
http://www.scatterchat.com/index.html

It's free as in beer and open source, though I don't see right away what license it's being released under.

[bemildred]

10. Thank you. I don't expect the spooks will like this at all. nt

[salvorhardin]

11. Hee hee -- I don't suppose.

:evilgrin:

[MADem]

2. Pedophiles will be on this shit in a heartbeat,,,,which will

provide the government an opening and motivation to break the code....

[wakeme2008]

4. Maybe the NSA is the parent to this company...

:)

[salvorhardin]

8. This is not a company

It is an open source effort. You can help out.
http://www.scatterchat.com/contribute.html

Here's a bunch of non-technical assistance they require:
* Volunteer as a language translator (Chinese, Farsi, and Arabic are especially needed).
* Test the internationalization support (especially the Chinese and Arabic languages).
* Get your friends to use ScatterChat.
* Find human rights activists in your area and tell them about Scatter Chat. Train them, if you can.
* Volunteer as a beta-tester.
* Proofread the user's guide.
* Make your mom read the user's guide, find out what confuses her, and fix it.
* Design a new splash image.
* Find someone who can do any of the above.

[MADem]

12. It wouldn't surprise me if a few of their guys are helping with the

development of this open source software....what better way to know how to crack it?

[wakeme2008]

14. Bingo we have a winner......

and why break anything.... open a port to the NSA/FBI and transmit your chat to them.... In this world of cable/DSL speeds who knows what data is really sent/received by your puter.

[salvorhardin]

17. You don't seem to grasp the concept of open source

The source code is freely available. Anyone can peruse it to see what the software claims to be doing. And if you're uberparanoid, then you can compile it yourself. And just because you might not consider yourself so technically inclined, there are very many people in the world who are and who do. And the really, truly skeptical will then run the software with a packet sniffer running in the background to make sure the software really is doing what it claims. Furthermore, the software is signed with a digital key and distributed via many mirrors. This way when you download the software you can verify the digital signature of the software and make sure it matches the key, thus ensuring you actually got the software you thought you were getting.

Is it perfect? No. But security is not about being perfectly protected from harm, it is about putting up barriors that make it hard enough to harm you that most people will give up trying. How high those barriors are depends on what your definition of most is, and for the most part here it means just about everybody.

This is about as secure as you can be in the real world. If this isn't secure enough for you, than you shouldn't be using a computer in the first place.

ABOUT HACKTIVISMO

Hacktivismo, a subdivision of CULT OF THE DEAD COW (cDc), has been combating information rights abuses for more than a decade. Its Goolag campaign brought great visibility to the issue of Internet censorship in China. Hacktivismo assumes as an ethical point of departure the principles enshrined in the Universal Declaration on Human Rights and the International Convention on Civil and Political Rights.

ABOUT CULT OF THE DEAD COW

Founded in Lubbock, TX, CULT OF THE DEAD COW (cDc) is the most influential hacking group in the world. The cDc alumni reads like a Who’s Who of hacking and includes a former Presidential advisor on Internet security, among others. The group is further distinguished by publishing the longest running e-zine on the Internet , stretching the limits of the First Amendment, and fighting anyone or any government that aspires to limit free speech.
http://www.hacktivismo.com/

[LeftCoast]

28. Excellent explanation!

:thumbsup: :thumbsup:

[beam me up scottie]

29. " If this isn't secure enough for you,

then you shouldn't be using a computer in the first place."

Eggzackly!

Yay techies! These guys love a challenge and big brother doesn't stand a chance.

[wakeme2008]

3. I worry about buying encryption software from

a no name company... Their parent may be the NSA.... Just IMHO...

[Rosco T.]

9. You're not buying anything.. it's free... and the people behind it..

.. are trustworthy.

[DireStrike]

6. Ever read that Dan Brown novel, Digital Fortress?

I dunno if he took into account exactly how powerful PGP encryption is, but in it they've got a huge computer (like carnivore but much nastier) at the NSA that can brute-force crack any encryption.

[salvorhardin]

7. You do realize Dan Brown writes fiction? n/t

[DireStrike]

16. I was just pointing out an idea

The government has access to a lot of assets and technology that the public does not.

There has never been an unbreakable code in the past...

Not like it matters to (m)any of us, really. We just use it to feel secure, and discuss things that would likely be of no interest to the NSA.

[wakeme2008]

15. I stopped reading that book because his computer knowledge is ZERO

:)

[DireStrike]

18. Ouch

I'll have to read it again, I don't remember it being that bad, especially concerning encryption stuff.

[salvorhardin]

13. If you all are looking for something that will allow you to do secure VOIP

Phil Zimmerman of PGP fame is developing ZPhone.

What is Zfone?

Zfone is my new secure VoIP phone software, which lets you make secure phone calls over the Internet. It encrypts your call so that only the other person can hear you speak. Zfone lets you whisper in someone's ear, even if their ear is a thousand miles away.

In the future, the ZRTP protocol used by Zfone will be integrated into standalone secure VoIP clients, but today we have a software product that lets you turn your existing VoIP client into a secure phone. The current Zfone software runs in the Internet Protocol stack on any Windows XP, Mac OS X, or Linux PC, and intercepts and filters all the VoIP packets as they go in and out of the machine, and secures the call on the fly. You can use a variety of different software VoIP clients to make a VoIP call. The Zfone software detects when the call starts, and initiates a cryptographic key agreement between the two parties, and then proceeds to encrypt and decrypt the voice packets on the fly. It has its own little separate GUI, telling the user if the call is secure. It's as if Zfone were a "bump on the cord", sitting between the VoIP client and the Internet. Think of it as a software bump-on-the-cord. Maybe a bump in the protocol stack.
http://www.philzimmermann.com/EN/zfone/index-start.html

There really are an arsenal of tools at your disposal now that allow you to be as reasonably secure as possible, as long as you're interacting with someone over the internet.

[ourbluenation]

19. Lemme ask you techies something....

I post on a public board while I'm at work sometimes. Is there any way possible another poster could "find me"?

On edit - it's a rightie that I argue with all the time. I pissed him off big time the other day by laying the smackdown on his "facts" and I just wonder if he could trace my isp or something, if he was mad enough...and rat me out to my workplace.

[ourbluenation]

20. bumping for an answer for ourbluenation????

please...appreciate any answers

[Xeric]

23. I wouldn't worry about him

Righties are mostly idiots and there isn't an easy way for him to find your ISP.
What you should worry about is your boss seeing what you are doing if you're posting at work. Lots of companies spy on their employees computer usage. The sysadmin can see pretty much everything you are doing if he/she wants to. Don't assume anything you are doing at work is private.

[ourbluenation]

25. I'm the system admin! Very small non profit. If I can't fix the computer

problems we hire out. Most eveyone is less tech saavy than me! :(

This feller on the public board appears to be pretty techie though so I thought I'd ask. It's the ABC political board so no volunteers. My sense from you all is that I'm probably ok. Thx.

[populistdriven]

24. If he convinces an admin to violate the boards privacy rules he can get IP

most board admins will never do that, but many boards use volunteers as admins

[populistdriven]

22. check ur PM

[ourbluenation]

26. Got my answers - thx you guys.

:)

[Xeric]

21. I set this up on a linux box this afternoon

Encryption looks fairly secure and it seems to work pretty well. The pdf that comes with the source code is very well written and explains crypto for non-techies.

Still, I suspect if the NSA really wants to know what you're doing it can crack this.

[Rosco T.]

27. If you're really paranoid, set up the encryption using

Lamport signature scheme and rest easy...