3 ms·
This is a good move on their part. From a quick scan of the PDF, it looks like their higher-level Matrix library mitigates attacks that Olm itself does not. I
by CiPHPerCoder 10y ago
This is a good move on their part.
From a quick scan of the PDF, it looks like their higher-level Matrix library mitigates attacks that Olm itself does not.
I'm not sure how I feel about that.
- Arathorn 10y agoyeah, this was a tricky one. Many of the problems NCC found are concerned with using the library correctly. For instance, if an app wants to turn off PFS for instance, it can. Technically this means that the library has a PFS vulnerability. However, sometimes this is a feature - e.g. if I want to be able to deliberately decrypt history to sync it to a new device. We're looking at ways to try to better split the higher level crypto stuff into another library (which we'll then get NCC to audit) - but until then matrix-{js,ios,react}-sdk have implemented it separately.