Building secure messaging is hard: A nuanced take on the Bitchat security debate
Summary: Jack Dorsey released Bitchat, a Bluetooth-based end-to-end encrypted messaging app, and researcher Alex Radocea demonstrated a man-in-the-middle attack that exploits its broken identity authentication to impersonate trusted contacts. The app also lacks per-message forward secrecy, using static keys for each session rather than a Double Ratchet approach, and Trail of Bits states users should not rely on Bitchat for sensitive communications in its current state.
What you should know: Dorsey discussed using Bitchat in high-risk scenarios like protests in Kenya despite his own README security warnings, and the app's serverless design has no centralized entity able to operate the key transparency log that Google, Signal, and Meta use to prevent impersonation attacks.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026