3 ms·
The most obvious way this could have been done is by MITMing the key exchange. The giveaway is in the last paragraph: "The IronChat app, Schellevis reported, al
by teilo 8y ago
The most obvious way this could have been done is by MITMing the key exchange. The giveaway is in the last paragraph: "The IronChat app, Schellevis reported, also failed to automatically check if the server it used to exchange messages with other users was the correct one."
- village-idiot 8y agoUnless if they were forced to do this by the authority, that’s an amateur hour mistake.
- qwerty456127 8y agoWhy would they even need to to trust a server for key exchange? Wouldn't it be more reasonable to just exchange public keys at the time of adding the contact to their contact list and then only update the keys using previously used keys?
- londons_explore 8y agoWorks until someone looses their phone. At that point the server steps in and hands the new key to all the old users contacts. That's most likely where the flaw was in this system.
- qwerty456127 8y agoEvery reasonable person that cares about privacy seriously has a second device with access to the same account and as soon as they loose a phone they tell everybody the account is compromised and make a new account. It's amazing how ridiculous some criminals happen to be, I know many don't even care to delete messages after reading.