Jump to content

User:Zipelkopf/sandbox

From Wikipedia, the free encyclopedia


TopSecret Chat
Developer(s)TopSecret Chat Limited
Initial releaseApril 2022 (2022-04)
Stable release
Core 1.1.1 / July 2022 (2022-07)
PlatformAndroid, iOS, Web
Available inEnglish, Italian
Typetop-secret instant messaging
Licenseproprietary
Websitetopsecret.chat
TopSecret Chat Limited
FoundedApril 2022; 2 years ago (2022-04)
HeadquartersIreland, Cork (city)
Area servedGlobal
Founder(s)
  • Lorenzo Bruni
CEOLorenzo Bruni
IndustryResearch and Development
URLtopsecret.chat

TopSecret Chat is a communication platform for top-secret instant messaging that works on Android:.[1] and iOS[2] devices, as well as with modern Web browsers[3].

This service is opposite to the "free communication apps"[4], where "their product is your personal data"[5], by offering instead a premium and niche service of "real privacy, anonimity, top-secret level security and untraceable content"[6]. This is done through an all-inclusive monthly Subscription plan[7].

TopSecret Chat has the motto "Your data is nobody else's business"[8] and it has brought to the market a emerging technology technology in information security based on the "Confidential Computing" paradigm[9]: the user's messages are no longer stored on any device or server, but they are handled in a fully encrypted and volatile memory enclave with a set life-span, like the messages never existed. This makes data recovery impossibile[10], hence communicating with untraceable content.

All communications, covering both data and meta-data, are also protected with additional encryption mechanisms and security measures at each different layer of the service[11]. This includes E2E (End-To-End) encryption with cross-authentication of users to protect the raw content, a proprietary VTI (Virtual Tunnel Interface) for securing and cross-verifying the peer-devices and the TLS (Transport Layer Security) for wrapping everything into the encrypted transport layer.

Also the security around the RTC (Real Time Communication) for audio and video calls is enhanced, addressing the security gaps around the users's data and identity, during the entire lifecycle of the call[12]. The notification channels do not contain any users meta-data or identifiable information, and they are used as an anonymous signalling system only[13].

While the usage of confidential computing technology and multi-layer encryption in an instant messaging application for the mass market is a "breakthrough technology"[14][15], it comes with some limitations when applied to real-time and real-world communications for example, there is a high level of computational power and network capacity required for the consumer mobile devices. TopSecret Chat currently sets the life-span of a top-secret message to 24h with a limit to the maximum amount of top-secret messages that each user can send of 100MB in a 24h rolling period (audio and video calls are excluded): this is called Capacity and users can monitor their level in real-time, with the option to auto-purge older messages. As noted by the company itself[13], the Capacity will increase thanks to the commercialisation of more powerful mobile devices and a wider coverage of faster mobile network such as 5G.

Architecture & Encryption

[edit]

The technology that powers TopSecret Chat is developed by the research and technology company TopSecret Chat Limited[16] with headquarters in Ireland, Cork (city).

The data center is located in Amsterdam[17] and it's ISO 9001 and ISO 27001 certified[18]. TopSecret Chat is also committed to a carbon neutral service by operating on only green infrastructures[19], having the data center engaged in the Climate Neutral Data Centre Pact[20].

All messages handled via TopSecret Chat are protected with a multi-layer and cross-signed encryption architecture[21]. The message gets encrypted and cross-signed at each communication level, making even the end-to-end encrypted message transparent to the different network components and operators, following the principle of the Zero Trust security model that they adopt[22].

The core engine[23] of TopSecret Chat is not open source but proprietary and therefore it is not possibile to peer review the entire source code but only the exposed client-side code[24] that can be inspected and evaluated using Source Code Analysis Tools (eg. see OWASP) to cross-check the TopSecret Chat multi-layer encryption:[25]

  1. A message gets first end-to-end encrypted using an asymmetric ECC chipher of 256-bit which is cross-signed by the sender and the recipient. The cross-signature guarantees the true identity of the users, the message integrity and it avoids the man-in-the-middle attack[26]. It is possibile to notice that the user's encrypting key and signature changes when the user changes their Password or PIN/Pattern code: this is confirmed by the fact that is not possibile to send and receive messages during these operations. As an additional feature, the user can also changes their signature on demand, which can be publically verified using a QR code.
  2. The client-side code inspection reports as well that Group Chats do not use multicast encryption but rather 1:1 encryption toward each group member for extra confidentiality. This means that when the user chats in a group of 5 people, each message gets individually multi-layer encrypted and cross-signed 5 times toward each group member. Group chats are limited to 10 members only, as there is a noticeable high computation power and network capacity required to handle multiple 1:1 encryptions and transmissions at the same time rather than handling a signle multicast, and becasue the top-secret context considers that "the probability of unauthorized disclosure of classified information increases with an increase in the number of persons who know that information"[27].
  3. Once the message is fully end-to-end encrypted (aka E2E-Message), this is not yet ready to be sent to the TopSecret Chat (dispatching) server. The TopSecret Chat server initiates first a proprietary VTI (Virtual Tunnel Interface) with the client's device to further encrypt the E2E-Message together with any meta-data related to the communication using an asymmetric ECC encryption of 256-bit, this time cross-signed by the peer-devices. The device's key get's automatically generated on a time-basis or when the network conditions change. The VTI is implemented as part of the Zero Trust security model adopted by TopSecret Chat[28], where the underneath Transport layer is not trusted even if fully encrypted, because it is controlled by global network operators and mass-monitored by intelligence agencies[29].
  4. The E2E and VTI encrypted message (aka E2E-VTI-Message) is now ready to be transmitted over the encrypted Transport layer using a TLS 1.2 or TLS 1.3 (verifiable using any public network inspection tool)[30] with an ECC Certificate of 384-bit cross-signed by the client's user-agent and the server, so to wrap and mask everything to public eye.
  5. The resulting public payload in transit over the public network could be described as a message that has been E2E + VTI + TLS encrypted and 3 times distinctly cross-signed.
  6. Nota bene: It is to notice that all service-data necessary to the normal functioning of the application gets VTI + TLS encrypted as well, because of the very same Zero Trust security model.
  7. The audio and video calls are protected using an enhanced RTP protocol, where the data (audio/video stream) is end-to-end encrypted with an asymmetric ECC chipher of 256-bit and all service-data required for initiating, maintaing and closing the call with the TopSecret Chat server are also VTI + TLS encrypted, so nothing is exposed to prying eyes.

Privacy

[edit]

The TopSecret Chat headquarters is in the EU, Republic of Ireland[16] and the data center is located in the EU, Amsterdam[17], therefore the service is subject to the EU - GDPR (General Data Protection Regulation).

The service is also free from the CLOUD Act, the PRISM program or any other mass-surveilance programmes [31]

TopSecret Chat offers by default a fully anonymous service, where no PPI (Personally Identifiable Information) is shared[32]. The process is built by using the privacy by design principles where users can register without a mobile-phone number, but using any name (or nickname) and an email or DEA (Disposable Email Address) for complete anonymity. A unique and anonymous identifier with an hashtag format (eg. #A23Y7O) is created when the user registers: this hashtag can be shared with others to connect directly.

Additional security and privacy features are mandatory and independent by the user's device settings, such as a strong authentication when setting up the App on the user's device(s) for the first time (Password + Two-Factor-Authentication) and the usage of an authentication PIN/Pattern code that is requested when unlocking the App on a routine basis.[32]

Subscriptions

[edit]

TopSecret Chat offers a service that is not for free, as it requires a subscription. The subscription model is available to the general public, while Government Agencies and Multinationals can also engage differently[33]. There are 3 Subscription Plans that users can choose from[34]

  • Personal - Suitable for individuals, with no strings attached.
  • Family - A flat price covering up to 5 Members. Once subscribed, the user has the ability to add and remove the other 4 users under its "Family" at any time and with no additional cost. This plan is particularly convenient also for small or family businesses to save on cost.
  • Business - For business entities up to 1000 Members. This plan offers the ability for companies to publically register their Business Name to protect their brand and to be verified and trusted by other users. Once subscribed, the user gains the Administrator role with the privilege of adding and removing Members as needed. The billing is usage-based (metered), caclulated on the actual number of Members during the past month. In this way the business pays for exactly what they use.

TopSecret Chat partners with Stripe strictly for handling the subscription payments and the billing legal requirements[35]. When subscribing, a user can also preserve their anonymous status in the billing process if a nickname and a DEA (Disposable Email Address) is chosen at signup. All plans are on a monthly basis and users can cancel or switch plan.

[edit]

References

[edit]
  1. ^ "TopSecret Chat - Apps on Google Play". play.google.com. Retrieved 2022-08-01.
  2. ^ "‎TopSecret Chat - Apps on Apple Store". App Store. Retrieved 2022-08-01.
  3. ^ "TopSecret Chat - Platforms". topsecret.chat. Retrieved 2022-08-01.
  4. ^ "Tell Me About It: How Do Messaging Apps Respond to Privacy?". Common Sense Education. 2021-04-15. Retrieved 2022-08-04.
  5. ^ Polykalas, Spyros E.; Prezerakos, George N. (2019-01-01). "When the mobile app is free, the product is your personal data". Digital Policy, Regulation and Governance. 21 (2): 89–101. doi:10.1108/DPRG-11-2018-0068. ISSN 2398-5038. S2CID 86720189.
  6. ^ "TopSecret Chat - Goals". topsecret.chat. Retrieved 2022-08-12.
  7. ^ "TopSecret Chat - Subscriptions". topsecret.chat. Retrieved 2022-08-01.
  8. ^ "TopSecret Chat". topsecret.chat. Retrieved 2022-08-01.
  9. ^ Darmody, Jenny (2021-08-19). "What exactly is confidential computing?". Silicon Republic. Retrieved 2022-08-01.
  10. ^ "Leveraging 'Confidential Computing' to Protect Data in Use at DHS Agencies - HS Today". 2022-03-19. Retrieved 2022-08-01.
  11. ^ "TopSecret Chat - Features". topsecret.chat. Retrieved 2022-08-01.
  12. ^ "A Study of WebRTC Security · A Study of WebRTC Security". webrtc-security.github.io. Retrieved 2022-08-01.
  13. ^ a b "TopSecret Chat - FAQs". topsecret.chat. Retrieved 2022-08-01.
  14. ^ "Confidential Computing in the Cloud and on the Edge". Persistent Systems. 2021-05-25. Retrieved 2022-08-01.
  15. ^ "Introducing Google Cloud Confidential Computing with Confidential VMs". Google Cloud Blog. Retrieved 2022-08-12.
  16. ^ a b "TopSecret Chat Limited". CRO - Companies Registration Office.
  17. ^ a b "IP tracker". Opentracker. Retrieved 2022-08-02.
  18. ^ "TopSecret Chat - Data center certifications". topsecret.chat. Retrieved 2022-08-03.
  19. ^ "TopSecret Chat - Carbon Neutral". topsecret.chat. Retrieved 2022-08-02.
  20. ^ "Climate Neutral Data Centre Pact – The Green Deal need Green Infrastructure". Retrieved 2022-08-02.
  21. ^ "TopSecret Chat - Encryption". topsecret.chat. Retrieved 2022-08-02.
  22. ^ "TopSecret Chat - Compare Apps". topsecret.chat. Retrieved 2022-08-03.
  23. ^ TopSecret Chat ™ - Core, TopSecret Chat, 2022-04-23, retrieved 2022-08-02
  24. ^ "Best Kept Secrets of Code Review | SmartBear". smartbear.com. Retrieved 2022-08-03.
  25. ^ "TopSecret Chat - Multi-layer and RTC encryption". topsecret.chat. Retrieved 2022-08-03.
  26. ^ Man in the Middle Attack on Diffie-Hellman Key Exchange and Solution using Public-Key Certificates, retrieved 2022-08-03
  27. ^ "Security Classification of Information, volume 2 (Quist), Chapter Seven". sgp.fas.org. Retrieved 2022-08-03.
  28. ^ "TopSecret Chat - Zero Trust". topsecret.chat. Retrieved 2022-08-02.
  29. ^ "Intelligence Surveillance". EPIC - Electronic Privacy Information Center. Retrieved 2022-08-02.
  30. ^ "TLS Checker". www.site24x7.com. Retrieved 2022-08-04.
  31. ^ "TopSecret Chat - Compare Apps". TopSecret Chat.
  32. ^ a b "TopSecret Chat - Privacy". topsecret.chat. Retrieved 2022-08-01.
  33. ^ "TopSecret Chat - Contact us". topsecret.chat. Retrieved 2022-08-04.
  34. ^ "TopSecret Chat - Subscriptions". topsecret.chat. Retrieved 2022-08-02.
  35. ^ "TopSecret Chat - Privacy". topsecret.chat. Retrieved 2022-08-02.
Retrieved from "http://en.wiki.x.io/w/index.php?title=User:Zipelkopf/sandbox&oldid=1150681228"