ScatterChat was discontinued long ago. Nobody maintains it and you should not rely on it for anything sensitive. Between 2006 and 2007 it tried to give human rights activists encrypted, Tor-routed instant messaging that non-technical people could use. If you want to help with that same goal today, put your time into maintained, independently audited projects such as Signal, Briar and the Tor Project. This page keeps the project’s old call for volunteers as history and shows where each kind of help is useful now.
What ScatterChat was
ScatterChat was an encrypted instant messaging client from the Hacktivismo group, which had links to the Cult of the Dead Cow. It was released in July 2006 at the HOPE hacker conference in New York. It was a friendly fork of Gaim, the chat client renamed Pidgin in 2007, and J. Salvatore Testa II is credited as its author.
The project offered four main things:
- End-to-end encryption of messages
- Encrypted file transfers
- Optional routing through Tor for some resistance to traffic analysis
- A design aimed at non-technical activists and dissidents working in hostile places
Reception was mixed. Reviewers on LWN liked the goals. Commenters pointed out that Off-the-Record Messaging (OTR) already offered similar protection for Gaim and had been audited far more carefully than this new protocol.
The security flaws found in 2006
A month after launch, the protocol had already been shown to have weaknesses. On 11 August 2006 a post on Light Blue Touchpaper, the blog of the University of Cambridge security group, described three flaws:
- ECB-based message encryption. Messages used a non-standard mode built on ECB, which leaks patterns in the plaintext. The padding meant to hide this did not work well for longer messages. File transfers used CTR mode and were not affected.
- Weaker forward secrecy than claimed. The scheme survived the compromise of one party’s key, but not both.
- Capability probing. A feature meant to ignore unknown users could sometimes be bypassed, because identities were not bound to keys and keys were not confirmed.
The researcher judged these flaws non-critical, but real under some threat models. The most serious one became CVE-2006-4021. It affected ScatterChat 1.0.1 and was published in the National Vulnerability Database on 17 August 2006, with a CVSS v2 base score of 2.6. The record says the fix was planned for ScatterChat 2.0.
The lesson still holds: custom cryptographic protocols tend to fail in ways their authors don’t see, which is why independent audits matter.
How the project asked for help (2006 to 2007)
The original page invited volunteers to “help this project” with a list of technical and non-technical tasks. The list is kept below as a record. None of these tasks are open today.
Technical tasks
- Create an OpenBSD port.
- Create a FreeBSD port. Marked as done at the time.
- Create Ubuntu packages.
- Help write ScatterChat 3.0. The page said version 2.0 was then at release-candidate stage.
- Fix encryption support for Jabber, the open chat protocol now known as XMPP.
- Add dmalloc support to libgcrypt. dmalloc is a debugging memory allocator, and libgcrypt is the GnuPG project’s cryptographic library.
- Build a Windows version that runs from a USB drive, so ScatterChat would work without being installed.
Non-technical tasks
- Translate the software. Chinese, Farsi and Arabic were especially needed.
- Test the internationalisation support, especially for Chinese and Arabic.
- Get friends to use ScatterChat.
- Tell human rights activists in your area about ScatterChat, and train them if possible.
- Beta-test new releases.
- Proofread the user’s guide.
- Ask a non-technical relative to read the user’s guide, find what confused them, and fix it.
- Design a new splash image.
- Find someone else who could do any of the above.
Volunteers were asked to contact the project maintainer to coordinate. There is nothing left to coordinate: development stopped years ago and the software has not been updated since. The old installers should not be used.
Where the same help goes today
Most of what ScatterChat asked for still matters, and maintained projects need it. The table matches each old request to a current project that accepts that kind of help.
| What ScatterChat asked for | Where it is useful today | What that involves |
|---|---|---|
| Translators, especially Chinese, Farsi, Arabic | Tor Project localisation | Translating Tor Browser and its documentation on Weblate, which covers more than 100 languages |
| Testing internationalisation | Tor Project user research | Running guided tests of Tor tools with your own community, using the Tor Project’s scripts and guidelines |
| Beta-testing | Signal, Briar | Filing clear bug reports on the projects’ public issue trackers |
| Code contributions | Signal (GitHub), Briar (its own GitLab) | Diagnosing and fixing open issues in public repositories |
| Training activists | EFF Surveillance Self-Defense, Tor Project training | Teaching from maintained guides, not from your own improvised setup |
| Traffic-analysis resistance via Tor | Tor relay operators | Running a relay to add capacity to the Tor network |
Translation and testing
Translation is the closest match to what ScatterChat needed most. The Tor Project manages translations on Weblate. You register an account there, and coverage still varies a lot between languages, so less common languages need the most help. Its community portal also runs user research, where volunteers test Tor tools with people they know, following published guidelines and scripts.
Code, packaging and bug reports
Signal’s apps are open source on GitHub, and the project encourages people to help diagnose and fix open issues. Briar develops its code on its own GitLab server. Good bug reports are useful to both projects: what you did, what you expected, what happened instead, and your app and OS versions.
Training the people who need it
The old page told volunteers to train activists themselves. Today the better approach is to teach from material that experts keep up to date. The EFF’s Surveillance Self-Defense guides cover choosing tools, why metadata matters, and communicating with others, and include playlists for specific groups such as human rights defenders. The Tor Project’s community team also runs training.
Maintained tools for the same need
ScatterChat wanted encrypted, anonymous messaging for people at risk. Several maintained tools now cover parts of that need. None of them makes you fully anonymous.
| Tool | Encryption | Phone number needed | Independent review | What it does not hide |
|---|---|---|---|---|
| Signal | End-to-end (Signal Protocol) | Yes, to register | Formal analysis of its X3DH and Double Ratchet core, IEEE EuroS&P 2017 | Your phone number from Signal itself, and the fact that you use the app |
| Briar | End-to-end, peer-to-peer over Tor, Bluetooth or Wi-Fi | No | Cure53 penetration test and code audit, 2017 | What is on your device if someone gets it, and contacts must be added carefully |
| Tor Browser | Encrypts traffic inside the Tor network | No | Long public research record | Anything you reveal yourself, such as logging in to your own accounts |
Signal is the right default for most people: it is easy to use and its protocol has been studied in depth. The 2017 formal analysis by Katriel Cohn-Gordon, Cas Cremers, Benjamin Dowling, Luke Garratt and Douglas Stebila found no major design flaws. Briar is closer to what ScatterChat imagined. It has no central server and no phone number, and it can keep working over Bluetooth or Wi-Fi when the internet is down. The Cure53 audit concluded that it “is able to offer a good level of privacy and security”, and Briar fixed the issues it found.
FAQ
Is ScatterChat still safe to use?
No. ScatterChat has not been maintained for many years. Its protocol had published flaws, including CVE-2006-4021, and it relies on long-outdated Gaim and library code that gets no security fixes. Use a maintained, audited messenger instead.
Can you still contribute to ScatterChat?
No. Development has ended and no maintainer is coordinating volunteers. The same skills, such as translation, testing, code and training, are useful to the Tor Project, Signal and Briar.
What replaced ScatterChat?
Nothing replaced it directly. For everyday encrypted messaging most people use Signal. People who need messaging without a phone number or central server often look at Briar, and Tor Browser covers anonymous web access.
Was ScatterChat related to Tor?
Yes, but only as a user of Tor. ScatterChat could route its traffic through Tor to resist traffic analysis. The Tor Project did not develop it.
Which languages are most needed for privacy tool translation?
It changes over time, so check the current figures on the Tor Project’s Weblate pages. In general, languages with fewer speakers online have the lowest coverage. These are often the languages of people in countries with heavy censorship, which is where your help counts most.
Sources
- Hacktivismo (Wikipedia)
- LWN.net coverage of ScatterChat
- Protocol design is hard: Flaws in ScatterChat (Light Blue Touchpaper)
- CVE-2006-4021 (NIST National Vulnerability Database)
- A Formal Security Analysis of the Signal Messaging Protocol (IACR ePrint 2016/1013)
- Briar beta release and Cure53 security audit (Briar Project)
- Get involved in Tor Project translations (Weblate)
- Unveiling the new Tor Community portal (Tor Project)
- Surveillance Self-Defense (EFF)