Protesters adore FireChat but it's still not secure

Shutterstock

Christophe Daligault hasn't slept in three days. On the line from San Francisco at 3.48am his time, Open Garden's Vice President of Sales and Marketing describes how the company's FireChat app has achieved unprecedented popularity with Hong Kong's student-led protesters. "The biggest problem we have is that so many people are using the app that the speed of text coming through to us is too fast to monitor it all," he tells WIRED.co.uk as he explains that the app was downloaded over 110,000 times during the 24 hours between Sunday lunchtime and Monday afternoon in Hong Kong.

FireChat allows people to communicate without requiring internet access. Phones are connected via their own Bluetooth and Wi-Fi signals alone in a peer-to-peer mesh network. This is particularly useful when large crowds congregate in small areas, overloading local mobile towers which can't keep up with demand.

That's exactly what's been happening in Hong Kong. Unlike a traditional mobile network, the more people who connect to a mesh network, the stronger and wider it is -- which is why the app has been praised for allowing demonstrators to continue communicating despite the size of the protest.

However, there's a problem. FireChat isn't private and for activists attempting to dodge police attempts at dispersal, that could be problematic. Daligault admits he's worried by the prospect of protesters' chatroom discussions on FireChat being monitored by police or government agents.

Enthusiastic reports in the press have labelled FireChat as "more clandestine and less traceable" than internet-based communications, but Daligault is emphatic on this point. "Messages are still public," he says. "You write something up on FireChat and it's almost as if you put it on Twitter. Anybody can read it."

The last big surge for FireChat took place earlier this year, when Iraqis flocked to the messaging app in order to stay in contact with one another following government restrictions on internet use. Daligault expressed similar concerns at the time but now adds that the stakes today are even higher. "Iraq now seems very small in comparison to the scale of what's happening in Hong Kong," he comments.

According to Daligault, the Hong Kong protesters have been savvy in associating chat rooms with specific locations such as street corners where they plan to meet or organise some part of their demonstration. The FireChat team has picked up on discussions about these meetings as well as conversations over where to acquire gas masks, tents and water bottles. Advice on how to avoid the police or waterproof electronics in case they get drenched by water cannon has also been shared.

Naturally, however, these discussions are publicly viewable and there could be some risk to protesters if they aren't careful with what they type. There's no clear indication of when encryption might be coming to FireChat. Though it is planned, Daligault says a release date has not been decided. "It may be six months away," he comments.

Nadim Kobeissi, creator of secure messaging app Cryptocat says that it wouldn't make sense to encrypt FireChat chatrooms if anyone could join, since sharing the encryption key indiscriminately would again fail to keep conversations private. "FireChat can [however] benefit from encryption by using it to safeguard message integrity and the identity of individual chat members, in order to prevent an attacker from forging or modifying messages, or impersonating another user on the mesh network," explains Kobeissi via email.

For now, though, if FireChat users in Hong Kong or elsewhere have something to say which they want to keep secure, Daligault has a simple piece of advice: "Don't type it."

This article was originally published by WIRED UK