How I accidentally breached a nonexistent database and found every private key in a ‘state-of-the-art’ encrypted messenger called Converso

@privacy

But wait – it gets much, much worse

As I was finishing up the above post, I noticed something a little strange in the code – something I’d glossed over earlier. There are a ton of references to what looks to be functions related to Google’s #Firestore database.

#Converso

Using the Seald credentials from the app's code, plus a random user's phone number and user ID from Converso's public database

Oh, I didn’t intend to skip the Tox comments. I haven’t used that in a whole, and was unaware of the CVEs. Those, and the fact there’s no iOS app, are good reasons to not use it. I found its use of DHT limited its performance and often had device battery life impacts; it still had a better protocol than Signal. The CVEs and other issues are technical implementation problems that can be fixed, unlike Signal’s design flaws.

Confide was just an example of a new class of fully anonymous, ephemeral chat clients, and maybe not the best choice. There are a half-dozen of these, all using similar mechanisms, some of which are OSS. I need to do a deeper survey of these, because they’re an interesting new approach to full-security chat.

Anyway, just saying I hit "sendx prematurely.

Create a post

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

  • Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
  • Don’t promote proprietary software
  • Try to keep things on topic
  • If you have a question, please try searching for previous discussions, maybe it has already been answered
  • Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
  • Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

  • 0 users online
  • 124 users / day
  • 1.05K users / week
  • 1.3K users / month
  • 4.58K users / 6 months
  • 1 subscriber
  • 3.67K Posts
  • 93.2K Comments
  • Modlog