Jack Dorsey’s Bluetooth messaging app Bitchat now on App Store

Jack Dorsey's new Bluetooth-mesh messaging app, Bitchat, has launched on iOS, enabling off-grid communication, but immediately faces critical security and brand integrity challenges. Despite Dorsey's initial promotion of the app as secure and private, a security researcher identified a fundamental vulnerability allowing user impersonation, a flaw Dorsey later conceded was due to a lack of external review. Compounding these issues, numerous fake Bitchat applications are proliferating on Google Play, posing significant user and brand risk.

Analysis

The launch of Bitchat, a personal project by Block founder Jack Dorsey, highlights significant execution risks in deploying security-focused applications. While the app's use of a Bluetooth mesh network for off-grid communication is innovative, its market debut is severely undermined by a critical, publicly disclosed security flaw allowing for user impersonation. Dorsey's admission that the app lacked an external security review validates these concerns and questions the viability of launching privacy-centric software without rigorous third-party auditing. Compounding this issue, the proliferation of fraudulent Bitchat clones on Alphabet's Google Play store, which have garnered thousands of downloads, exposes a material weakness in Google's platform integrity and app vetting process. The direct financial impact on Block (SQ) is neutral as this is not a corporate initiative, but the negative sentiment for Alphabet (GOOG/GOOGL) reflects the reputational and user-safety risk from its marketplace governance failures.

Key Decisions for Investors

• Investors in Block (SQ) should view this as a non-material event for the company, though it may warrant monitoring for potential reputational spillover or distraction for its CEO.
• For investors in Alphabet (GOOG/GOOGL), the incident serves as another data point on the persistent challenges in policing the Google Play store, a recurring issue that carries potential long-term regulatory and brand risk.
• This case underscores the importance of scrutinizing cybersecurity claims for new product launches; investors should be cautious of technology products, particularly those handling sensitive data, that have not undergone and published independent security audits.