Thoughts on ChatSecure (formerly Gibberbot)

anvilfour

Hi guys,

I have been playing around with this app for a few days with my better half and a few friends in the UK and thought I'd share my thoughts with you and would be interested to hear yours.

To quote the excellent summary on the EFF website:

ChatSecure is a free mobile phone application for iPhone and Android devices that allows users to communicate with off the record instant messaging. ChatSecure allows users to send instant messages and chats using a cell phone, instead of with a traditional desktop or laptop computer. It's compatible with iPhone and Android phones.

Source : https://ssd.eff.org/en/module/how-install-and-use-chatsecure

Used properly, ChatSecure will allow you to use OTR Encryption for messages over XMPP. Naturally this has the advantage that messages are encrypted before ever leaving the device and that XMPP is an open standard , as such it is decentralised which makes snooping/censoring servers harder.

N.B ChatSecure is actually also compatible with Google Messenger but since the idea of using an app like this to avoid relying on big corporate and since no doubt they'll log your encrypted messages we steered clear of it.

My darling girl used the version for her Android phone, freely available from Google Play Store or F-Droid and I installed the iOS version on my fifth gen iPod.

Passwords

Naturally OTR messaging is only really as good as your ability to keep your private keys safe, which is why I was somewhat reassured that the website boasts that when you open the app you set a password to locally encrypt your data.

The Android version did this but my iOS version didn't, I had to go into the settings and put a password in there to "change the passphrase" even though as far as I remember I never set one to begin with. Also the password is not requested if you close down and re-open the App as it's stored in your local keychain - this means if someone can overcome the screen lock on your device they can impersonate you/read past messages but of course there is no reason to pick on ChatSecure in particular about this.

The other good thing is that the password is naturally not automatically put back on when restoring your device from a backup!

XMPP

To be honest I hadn't used XMPP or Jabber as it's known for years and was a bit nervous about setting up an account. ChatSecure makes it fairly easy as it offers a few well known XMPP servers such as DukGo and you can simply click "Create" to set up a new account and password.

We chose not to use one of the built in options and to create an account instead with otr.im which makes OTR communication mandatory. I should explain that the app itself has a little padlock icon (please see pic of Android version) which has to be tapped and locked to exchange keys and be sure your communication is private).



In an ideal world, you would be able to require the App to forbid any clear text communication but mandatory OTR seems only to be an option in the Android version again.

Tor

A number of public XMPP servers do offer chat over the Tor hidden service. This isn't necessary to protect the content of your messages but naturally connecting via tor conceals metadata such as your IP address which would reveal your location.

The Android version of ChatSecure in combination with Orbot worked like a charm with these services, which are offered within the app itself e.g for Dukgo.com but I couldn't get the iOS version to connect. T

Of course you can torify your communications and connect to a regular XMPP server over the web via an exit node, it just won't be as secure.


Fun

The chat client seems to offer all the basic features you'd get in Google Hangouts or Facebook Messenger. In addition to text messages you can also send voice clips and pictures.

Flaws

With the exception of the password issue I mentioned above and the fact that the iOS version of app had difficulty connecting to the tor hidden addresses for certain XMPP servers, there doesn't seem to be much to fault the app itself.

It would be good to require OTR at all times when using it, as well as making entering a password mandatory (although you can simply choose not to save your login details so you only log onto chat when needed).

Similarly it would be good to have mandatory encryption for the iOS version of the app so you don't send anything in the clear by accident.

Otr.im which my partner and I used for messaging does store copies of messages on the server when offline though naturally these are encrypted.

You can reduce the possibility of messages being intercepted in the ether by using the same chat server as your buddies (with SSL naturally!) or theoretically setting up your own.

All in all I am going to keep using this but would love to hear all your thoughts. Even if you're planning on sticking with Google Hangouts, it would be interesting to hear why!

anvilfour

Update : My darling girl says she hates Chatsecure as it disconnects at random and she can't be sure I have received messages unless I reply. I have sometimes had difficulty initiating an encrypted chat. I am not sure if this is a problem with the app itself or the otr.im XMPP server we're using, watch this space...!

anvilfour

bedlam wrote: »

She could try increasing the heartbeat interval but it's a general problem with synchronous chat clients that were designed to have both parties online at the same time. XEP-0160 helps a little but still not perfect and depending on whether the client and/or server config force OTR only, you run the risk of plaintext resting on the server.




It's most likely the app, it has had a long history of OTR problems. I'd suggest submitting a bug report.

Thanks bedlam, I'll give that a bash!

I was considering testing with Google Messenger with OTR to see if that makes a difference. I am still a little uncomfortable as then they'd have the metadata if not the content of our messages but might help us work out where issue is.