2y ago

Testing a new encrypted messaging app's extraordinary claims: this unofficial audit on the #Converso app looks like a book of horrors…!

How I accidentally breached a nonexistent database and found every private key in a 'state-of-the-art' encrypted messenger called Converso

@privacy

But wait – it gets much, much worse

As I was finishing up the above post, I noticed something a little strange in the code – something I'd glossed over earlier. There are a ton of references to what looks to be functions related to Google's #Firestore database.

Converso

5 comments

Thanks for the breakdown, I'll be sure to stay away from Converso! You should 100% check out DataBag. It's my current favorite as its pretty much selfhosted signal. Except without the need for phone numbers and while decentralized, it can be federated too. Definitely my current favorite up and comer in the messaging world

TFA claims Signal is the gold standard, which raises my eyebrows, especially as th] author - in the same breath - admits Signal leaks metadata.
There are chat clients, less popular, less well funded, that don't leak metadata. Signal may be a good choice for the average non-techie, but it's hardly the gold standard for private chat.
- I've read from SME's that Signal is the gold standard for encrypted private messaging. I haven't seen that claim of any other messenger. What are the alternatives?
  I've tried Briar and that seems like it may be good in 5+ years, but not something I'd ask non-techy people to use in its current form. Sessions dropped Perfect Forward Secrecy because it was too hard to make it work. I don't want security features dropped just because they're "hard" so that's an immediate no from me. What are viable alternatives that don't leak metadata?
  
  "Popular," and even "ease of use," are not relevant for the label of Gold Standard when we're talking about security. Functionality for purpose is relevant, but if we're allowing for weaker security in trade for ease of use then I'd say just use SMS; sure, it's not as secure as Signal, but it's a lot easier.
  Reductio ad absurdum aside, there are by my count about a half-dozen systems which are more secure than Signal. Systems which don't require you to give up your phone number, or publish it, or leak other personal metadata. You mentioned one, Briar, and there's SimpleX Chat, Tox, and Jami (the latter two have been around for a few years, and IIRC Jami's been audited). There are any number of apps (web and mobile) that claim encryption and anonymity such as Confide, Onion Chat, ChatS, Speek!, Peekno, and Threema. Ocelot and retroshare.io are peer-to-peer with no central servers, and are probably (metadata) secure.
  I wouldn't call any of these individually the gold standard, but several are obviously more secure than Signal.
  I can't get over how any system that required such a tracable and abusable piece of PII as a cell phone number could be considered the gold standard for privacy.