I've looking into this issue for the last 2 days: The APK we all looked into is IronChat-3.40-release.apk [1], after decompiling I think it is a copy/fork of Co

I've looking into this issue for the last 2 days: The APK we all looked into is IronChat-3.40-release.apk [1], after decompiling I think it is a copy/fork of Conversations version 1.14.6 with a few more commits until October 13th 2016 [2] with Secret Space Encryptor version 1.7.2c [3]. About unencrypted support: "supportUnencrypted() { return false; }" is in the config, so probably not [4]. There is a theory (I kind of started [5]) that it might be MitM because of bad UX. This is because they used OTR without TOFU which was only added in Conversations 1.15, after the fork [6]. [1] https://ironphonestore.com/IronChat-3.40-release.apk https://ironphonestore.com/IronChat-3.40-release.apk [2] https://github.com/siacs/Conversations/tree/6371d2b7a9a2b5d7c14c998f63d7e2de6a1467d9 https://github.com/siacs/Conversations/tree/6371d2b7a9a2b5d7... [3] https://paranoiaworks.mobi/sse/ https://paranoiaworks.mobi/sse/ [4] https://twitter.com/BWBroersma/status/1060136620383453195 https://twitter.com/BWBroersma/status/1060136620383453195 [5] https://twitter.com/BWBroersma/status/1059851925234036739 https://twitter.com/BWBroersma/status/1059851925234036739 / https://twitter.com/Schellevis/status/1059852605801852929 https://twitter.com/Schellevis/status/1059852605801852929 (= the author of the article quoted by ars: https://nos.nl/l/2258309 https://nos.nl/l/2258309 ) [6] https://twitter.com/BWBroersma/status/1060278116315262976 https://twitter.com/BWBroersma/status/1060278116315262976