Jack Dorsey’s Bitchat App Under Fire: Security Flaws Found in New “Secure” Chat App

Jack Dorsey, the co-founder of Twitter and CEO of Block, has launched a new messaging app called Bitchat, claiming it provides secure and private communication. However, experts are already raising concerns over its security framework due to untested code and critical vulnerabilities.

Bitchat: The New Decentralized Messaging App Promising Security

Bitchat is designed to operate without centralized infrastructure, using Bluetooth and end-to-end encryption to facilitate communication. Jack Dorsey touted the app as a groundbreaking tool for users in high-risk environments where internet access is compromised or monitored. The open-source app was published on GitHub, complete with a white paper outlining its privacy protocols.

Dorsey emphasized that Bitchat prioritizes security, appealing to users needing decentralized and private communications. But the platform’s promise of security quickly came under fire once it became public that the app had not undergone any external security review before launch.

Security Researchers Highlight Critical Flaws

Shortly after its release, security researcher Alex Radocea discovered a flaw that allows an attacker to impersonate users through the app’s “Favorites” system. This system is intended to authenticate identity by using an “identity key” and “peer ID pair,” marked by a star icon, to verify trusted connections. However, Radocea found that these identifiers could be spoofed, misleading users into believing they are communicating with trusted contacts when they are not.

As a result, Dorsey added a warning to Bitchat’s GitHub repository: “This software has not received external security review and may contain vulnerabilities. Do not use it for production.” The issue has cast doubt on the app’s readiness for use, especially in contexts where security is paramount.

Broken Identity Verification and Forward Secrecy Questions

Radocea wasn’t the only expert to raise red flags. Others questioned the app’s implementation of forward secrecy—a cryptographic method meant to protect past communications even if a current key is compromised. Without solid forward secrecy, Bitchat’s encryption may fall short of its advertised security claims.

Another researcher reported a possible buffer overflow vulnerability—an issue that could allow attackers to access or corrupt sensitive memory areas. These fundamental flaws make Bitchat unsuitable for secure use in its current state.

Dorsey’s Response and Ongoing Development

Initially, Dorsey closed the GitHub ticket regarding the identity verification issue without comment. He later reopened it and invited users to report bugs directly on the repository. While he acknowledged the app is a “work in progress,” the initial lack of transparency and response raises concerns about the project’s maturity and the responsible handling of its rollout.

The Risk of Misleading Security Messaging

The release of Bitchat with unverified security features has sparked ethical concerns. Security researchers emphasize that branding an app as “secure” without external validation could endanger users who rely on its advertised privacy features. As Radocea put it, “People may take the messaging around security literally and could rely on it for their safety.”

This situation serves as a cautionary tale about the responsibilities of developers launching tools marketed for security-sensitive environments. Releasing a product with known vulnerabilities or untested cryptography can do more harm than good, especially when users may face real-world risks.

Sun Day: Another App by Jack Dorsey

Amid the controversy around Bitchat, Dorsey also launched another app called “Sun Day,” which tracks UV exposure and vitamin D intake. Available on iOS via TestFlight, it shows UV levels and sun-related metrics as widgets. Unlike Bitchat, Sun Day has not been promoted as a security tool, and its risks are relatively minimal.

The code for Sun Day is also open-source and available on GitHub, showing Dorsey’s continued interest in building community-auditable software tools. However, the Bitchat incident underlines the importance of thorough security testing before making claims of privacy or encryption.

What Comes Next for Bitchat?

While Bitchat remains in active development, it will need substantial revisions, expert reviews, and possibly a complete overhaul of its security framework before it can be considered reliable. The transparency in acknowledging its current flaws is a positive step, but more proactive engagement with the security community is essential.

For users considering Bitchat, the advice from experts is clear: do not use the app for sensitive communication until it has passed thorough external security assessments.

You Must Know:

• Is Bitchat safe to use?
  Bitchat is not currently safe for secure communication. Security researchers have found critical flaws, and the app has not been externally reviewed.
• What is the main vulnerability in Bitchat?
  The main issue is a broken identity verification system, which allows impersonation of users within the app’s trusted contact feature.
• Does Bitchat have forward secrecy?
  There are doubts about Bitchat’s implementation of forward secrecy. Security experts have raised concerns about its effectiveness.
• Has Jack Dorsey responded to the vulnerabilities?
  Dorsey added a disclaimer to the GitHub page and reopened a ticket for bug reporting, indicating the app is a “work in progress.”
• Can I download Bitchat now?
  Yes, but it is advised not to use it for anything sensitive until it has undergone a full security audit.

Bitchat’s launch has raised important questions about security, trust, and transparency in tech. Users should remain cautious and prioritize proven solutions for secure communication while the app continues its development.