3 ms·

I highly recommend not using this, it has a variety of weaknesses and vulnerabilities. https://bitmessage.org/forum/index.php?topic=1666.0 https://bitmessage.or

I highly recommend not using this, it has a variety of weaknesses and vulnerabilities. https://bitmessage.org/forum/index.php?topic=1666.0 https://bitmessage.org/forum/index.php?topic=1666.0 is a pretty thorough analysis. The biggest problem IMO is that there is no encryption when passing messages between peers, so a passive adversary can easily determine who's sending what message. There's over 30 years of papers and academic research on anonymous mailing systems and Bitmessage incorporates not one of those concepts

rnhmjoj 10y ago
If you run PyBitmessage over tor you should be fine.
- openasocket 10y ago
  Actually, not against certain attacks. If a passive adversary knows you use BitMessage and want to determine your Bitmessage identity they can simply watch your traffic, and can determine any message you send out that you did not receive must have come from you. This can be used to determine which messages you sent, and if you respond to a request for your public key your identity will be revealed. Because the inter-peer connections are not encrypted, this is all trivial, and using Tor changes nothing. So no, you are not necessarily fine.
  - rnhmjoj 10y ago
    But isn't the traffic between me and the entry node completely encrypted? How can a passive observer even detect I'm sending/receiving a specific message.
    - wcummings 10y ago
      Timing, maybe?
jiiam 10y ago
The author of the audit claims to be working on competing software, so I wonder if there is any alternative to bitmessage that achieves some anonymity. Regardless of implementation details, the purpose of bitmessage is interesting and any secure alternative would make a great communication software.