ScatterChat drew press and security-community attention mainly during 2006 and 2007, when the scatterchat.com address was its home. The coverage below is a historical record of that period. ScatterChat is not active software, and this independent site has no connection to the original project or its developers.
What ScatterChat was
ScatterChat was a secure instant messaging client released by the hacker and human rights group Hacktivismo. J. Salvatore Testa II wrote it, and it was unveiled at the H.O.P.E. Number Six conference in New York City on 22 July 2006. Slashdot covered the launch the same day.
The client was a modified version of Gaim, the open-source messenger later renamed Pidgin. Its promoted features were:
- end-to-end encryption of messages
- built-in onion routing through Tor
- encrypted file transfers
- perfect forward secrecy, so one stolen key would not expose older messages
- protection against replay attacks
- limited resistance to traffic analysis
Its main audience was activists working behind national firewalls. That is the reason most of the coverage focused on censorship and human rights as much as on the cryptography.
Coverage from 2006 and 2007
The table and note below list the press and commentary from that period. These were the reports at the time, and none of them describes how the software holds up today.
|
Press Release Presentation Speech In the news
|
What security researchers found
Within weeks of launch, outside researchers found weaknesses in ScatterChat’s design. None of them broke the encryption outright, but they showed why a home-made protocol is risky.
| Issue | Reference | What it involved | Project’s response at the time |
|---|---|---|---|
| Weakness in the cryptographic module | CVE-2006-4021 | Steven Murdoch of the University of Cambridge reported that the custom protocol and mode of operation (built on ECB-style encryption) could leak patterns across large numbers of messages | The project said the flaw did not let an eavesdropper decrypt messages or identify users, and rated it very low impact |
| Tor client routing and crash flaws on Windows | CVE-2006-4508 | A malicious Tor entry node could route traffic through the user’s client or crash the bundled Tor process | Advisory 2006-02 (September 2006) rated it low impact and told Windows users of the anonymity feature to upgrade to version 1.0.2 |
Murdoch’s write-up on the Cambridge security blog Light Blue Touchpaper was titled “Protocol design is hard”. He called the flaws real but not critical. The broader point was that a protocol built from scratch had not received the years of public analysis that established designs get.
Why ScatterChat should not be used today
ScatterChat stopped receiving updates many years ago. Its Gaim base, its bundled Tor client and its cryptography all date from 2006. Since then, Tor itself has changed its protocol and dropped old versions, and both Pidgin and Tor have patched many security flaws that an old build would still have.
Software that nobody maintains does not get fixes for newly found bugs. For a tool meant to protect people at risk, that is disqualifying. It was also never independently audited the way today’s leading tools have been.
What people use today for the same need
The same goal, private messaging that is hard to trace, is now met by several maintained projects. Each one protects against different things, so match the tool to the threat.
| Tool | What is end-to-end encrypted | What it does not hide | Phone number needed | Public review |
|---|---|---|---|---|
| Signal | Messages, calls, attachments | That you use Signal; your phone number from contacts unless you set a username | Yes, to register | PQXDH formally verified (USENIX Security 2024); long record of academic analysis |
| Briar | Messages between contacts, sent peer to peer over Tor, Wi-Fi or Bluetooth | That a device is running Briar; contacts must both be online to sync | No | Cure53 audit of the Android app, completed March 2017 |
| Tor Browser | Not a messenger; routes web traffic through three relays | Anything you reveal by logging in or typing it; malware on your device | No | Open source, maintained by the Tor Project; version 16.0 released 2 November 2026 |
No tool on this list makes anyone fully anonymous. If a device is compromised, a contact takes screenshots, or an account name is reused elsewhere, the strongest encryption won’t help. The Electronic Frontier Foundation’s Surveillance Self-Defense guides suggest starting with a security plan: work out who you need protection from, then choose tools to fit.
FAQ
Is ScatterChat still available or safe to use?
No. ScatterChat has had no updates since the 2006 to 2007 period, and its bundled Tor and Gaim components are badly out of date. Running an old build today would expose you to security flaws that were fixed long ago in maintained software.
Who made ScatterChat?
Hacktivismo released it, a group of hackers, human rights workers, lawyers and security experts linked to the Cult of the Dead Cow. J. Salvatore Testa II wrote the software, and it was presented at H.O.P.E. Number Six in July 2006.
Was ScatterChat’s encryption ever broken?
No published attack decrypted its messages. In August 2006, Cambridge researcher Steven Murdoch documented a weakness in its custom cryptographic design (CVE-2006-4021). A separate flaw in the Tor client bundled with the Windows installer (CVE-2006-4508) was fixed in ScatterChat version 1.0.2. Both showed the risks of a protocol that had not been widely reviewed.
What is the closest modern replacement for ScatterChat?
Briar is closest in spirit. It sends messages over Tor, needs no phone number and was built with activists in mind. Signal is the more practical choice for most people because it is easier to use and has been studied more, though it needs a phone number to register.
Does using Tor make chat anonymous?
Tor hides your IP address from the people you talk to and from the network operators in between. It does not hide what you reveal yourself, it does not protect a device that is already compromised, and a well-resourced adversary can sometimes match traffic timing at both ends of a connection.
Is this site connected to the original ScatterChat project?
No. The scatterchat.com address is now run under new, unrelated ownership as an independent guide to privacy, anonymity and secure messaging. Pages about ScatterChat cover it as history.
Sources
- Protocol design is hard: Flaws in ScatterChat, Light Blue Touchpaper (University of Cambridge)
- ScatterChat advisory on CVE-2006-4021, Bugtraq archive
- ScatterChat advisory 2006-02, Full Disclosure archive
- CVE-2006-4021 entry, VulDB
- Hacktivismo launches ScatterChat, Slashdot
- New Release: Tor Browser 16.0, Tor Project blog
- Formal verification of the PQXDH post-quantum key agreement protocol, USENIX Security 2024
- Briar penetration test report, Cure53
- Surveillance Self-Defense, Electronic Frontier Foundation
Featured image: PierreSelim / Wikimedia Commons, CC BY-SA 3.0