Don’t Use Session (Signal Fork)
Don’t Use Session (Signal Fork)
Last year, I outlined the specific requirements that an app needs to have in order for me to consider it a Signal competitor. Afterwards, I had several people ask me what I think of a Signal fork c…
Last year, I outlined the specific requirements that an app needs to have in order for me to consider it a Signal competitor.
Afterwards, I had several people ask me what I think of a Signal fork called Session. My answer then is the same thing I’ll say today:
Don’t use Session.
Nice writeup as always. I always wondered about Session but it seems like they have the same "I rolled my own" crypto nonsense as Telegram has; and we all know how bad that one actually is as it's not correctly implemented at all; even if the underlying protocol is otherwise good.
I weren't even aware it was a Signal fork! What kept me away was their heavy integration of the Oxen crypto token (now apparently replaced with their own "Session token" instead). Anything that deep into web3 is a red flag to me, but the security flaws discussed in the above blog post look white hot.
the Oxen crypto token
Oxen is the company behind Session, for anybody unfamiliar. They were a crypto company that made (well, cloned) a messaging app to promote this token.
And Oxen itself was a clone of Monero.
Cliff notes: end to end encryption is borked.
So borked in fact that the author's fursona face-palmed in response.
Strong agree. Session is not security focused it's marketing focused. Last I checked they still use central servers for file uploads.