Bridgefy_

Market position

Bridgefy is compared with FireChat, another Bluetooth-based offline messaging app; while FireChat has been described as more popular and better known, Bridgefy has been credited with better stability. Briar is another communication app that can use Bluetooth.

Its mesh approach relays messages device-to-device over Bluetooth without Internet connectivity, requiring interceptors to be physically nearby, and it offers the underlying technology as a licensable SDK in addition to a consumer app.

Technology

Bridgefy's technology creates a smartphone ad hoc (mesh) network over Bluetooth, apparently using Bluetooth Mesh, so that devices can relay messages to one another and extend reach beyond a single Bluetooth link. Because interception requires physical proximity given Bluetooth's limited range, and messages can be daisy-chained across devices, the system functions without Internet access, although an Internet connection is required to activate the technology. The Signal protocol was integrated into the app and SDK by late October 2020, with the developers citing improvements such as preventing impersonation of other users, man-in-the-middle attacks via modified stored keys, and historical proximity tracking.

Go-to-market

Consumers needing communication where Internet access is unavailable or shut down, including protest participants and users in disaster situations, plus developers and app publishers licensing the mesh-networking SDK.

Geography

Headquartered in Mexico with offices in Mexico and California, United States; the company states it serves users worldwide, with notable adoption reported in Hong Kong and India.

History

Founded around 2014, Bridgefy positioned its offline messaging app initially as a way to reduce server costs, with listed use cases spanning advertising distribution and emergency scenarios such as natural disasters. The app drew wider attention during the 2019–2020 Hong Kong protests and during the Citizenship Amendment Act protests in India in December 2019, when Internet shutdowns pushed users toward Bluetooth-based communication. In August 2020, researchers published attacks against the app, and the company acknowledged that no part of the app was then encrypted; it announced integration of the Signal protocol into both the app and the SDK by late October 2020. In 2022, researchers published a follow-up paper arguing the Signal protocol had been implemented incorrectly. A white-box penetration test and security review conducted with the company's developers between November 2022 and May 2023 was published by security firm 7asecurity on July 31, 2023, and Bridgefy published its own blog post on the audit results on August 8, 2023.

Risks & controversies

Security has been a recurring issue. In August 2020, researchers published a paper describing attacks that allowed de-anonymizing users, building social graphs of user interactions, decrypting and reading direct messages, impersonating users, shutting down the network, and conducting active man-in-the-middle attacks to read or modify messages; the developers acknowledged at the time that no part of the app was encrypted. In 2022, researchers including Kenny Paterson published "Breaking Bridgefy, again," showing that the app's use of the Signal protocol was incorrect and had not remedied earlier issues, and demonstrating message interception without the sender noticing; the researchers said they disclosed the vulnerabilities in August 2021 and that they remained unresolved as of June 2022. A white-box penetration test by 7asecurity, conducted from November 2022 to May 2023 and published July 31, 2023, identified multiple critical vulnerabilities, many of which, including user impersonation and biometric bypass, were fixed or partially fixed before the audit concluded. The Wikipedia article also carries a notice that a major contributor appears to have a close connection with the subject.