bitchat-android

mirror of https://github.com/permissionlesstech/bitchat-android.git synced 2026-08-08 06:46:11 +00:00

History

security: stop logging Noise key material, reduce noisy logging app-wide (#775 )

C1 from security review: SymmetricState/HandshakeState logged raw X25519
shared secrets, chaining keys, and handshake hashes in hex to logcat on
every handshake, in release builds. A logcat transcript of a handshake
allowed full session decryption. Both classes no longer log at all.

Also reduces excessive logging across the app (~50% fewer log calls in
the noisiest files):

- NoiseSession emits one line per completed handshake; per-message
  encrypt/decrypt and per-handshake-step debug logs removed
- Removes all content/key logging: decrypted DM content, file names,
  payload hex dumps, pubkeys, event IDs, lat/lon, peer IPs, arti log
  forwarding
- Collapses multi-line banner/emoji log sequences into single factual
  lifecycle lines (connect/disconnect, relay/Tor state transitions)
- Keeps security-relevant warnings (signature failures, replay
  detection, key mismatches, panic wipe) in compact form

No logic changes. Includes the full security review report in
docs/security-review-jul-27.md.

2026-07-27 10:33:29 +02:00

ANNOUNCEMENT_GOSSIP.md

Bind Noise sessions to claimed peer identities (#730 )

2026-07-26 23:29:57 +02:00

device_manager.md

Implement iOS-compatible Direct Peer Detection (TTL Logic) (#574 )

2026-01-15 15:24:24 +07:00

file_transfer.md

Bind Noise sessions to claimed peer identities (#730 )

2026-07-26 23:29:57 +02:00

GeohashPresenceSpec.md

Implement Geohash Presence (Heartbeats) (#576 )