Jack Dorsey says his ‘secure’ new Bitchat app has not been tested for security

Jack Dorsey's new decentralized chat app, Bitchat, promising secure, private messaging via Bluetooth connectivity, has rapidly drawn significant security scrutiny post-launch. Security researchers have identified critical vulnerabilities, notably a broken identity authentication system enabling impersonation, leading Dorsey to issue warnings that the app lacks external security review and is unsuitable for production use. This immediate discovery of severe flaws undermines the app's fundamental security claims and raises concerns about its viability for its intended high-risk environments, despite its decentralized architecture.

Analysis

The launch of Bitchat, a decentralized chat application by Block (SQ) CEO Jack Dorsey, has been immediately undermined by the discovery of severe security vulnerabilities. The application, which promises secure, private messaging via Bluetooth, was released without any external security review, a fact Dorsey later acknowledged by adding a warning to its GitHub page. Security researchers have since identified critical flaws, including a 'broken identity authentication/verification' system that allows for user impersonation, casting doubt on the app's fundamental security claims. Further concerns have been raised regarding its implementation of 'forward secrecy' and a potential buffer overflow bug. The project's current 'work in progress' status and Dorsey's initial dismissal of a security report highlight a significant gap between its stated privacy-centric goals and its actual execution. While the low market impact score of 0.1 indicates this is not a core issue for Block, the negative sentiment surrounding the event (-0.5 for SQ) reflects a reputational risk for its CEO, potentially raising concerns about leadership judgment and focus.

Key Decisions for Investors

• For investors in Block (SQ), the Bitchat launch should be viewed primarily as a minor reputational risk for the CEO rather than a direct threat to the company's fundamentals, though it warrants monitoring for any signs of distraction from core business initiatives.
• The immediate and critical security failures of Bitchat invalidate its stated value proposition, suggesting investors should disregard any near-term disruptive potential until the project undergoes a comprehensive and independent security audit.
• This event serves as a strong reminder to apply rigorous due diligence on the technical viability of nascent, decentralized projects, even those backed by prominent figures, prioritizing audited security architecture over marketing claims.