4 ms·
The app utilises AES encryption method using this library: https://github.com/RNCryptor/RNCryptor https://github.com/RNCryptor/RNCryptor.
by m1cky 8y ago
The app utilises AES encryption method using this library: https://github.com/RNCryptor/RNCryptor https://github.com/RNCryptor/RNCryptor.
- chupa-chups 8y agoThanks for the answer! The app looks really nice. Will try it :)
- m1cky 8y agoThanks! Let me know if you have any questions. P.S. Get a friend to download it as well as it requires both parties to have each other contacts saved and the app installed in order to send / receive messages.
- a-priori 8y agoIn other words you have to harvest the parties' contact lists in order to do this matching?
- m1cky 8y agoWe require access to your contacts. We do not harvest.
- a-priori 8y agoCould you explain the difference, in your own words? The most obvious way I see to support this feature is to build up a big table of contact connections, so that when I join and put in my phone number it can send up my list of contacts and find all the bidirectional connections to what's already in the database. This means you're building up a big graph of how all your users are connected to each other, and to people who don't use Wave (yet). Is that not 'harvesting' the contacts? Do you do it a different way?
- m1cky 8y agoThe app requires an active number in order to use the service. This number is submitted to the database during the verification process. To my knowledge, mthere is no way around this. To send and receive messages, the app needs access to your contacts. When you tap 'send' for the first time, the app will ask you for permission to access your address book.
- indutny 8y agoAny additional details on how encryption and key generation scheme looks like?
- kelnage 8y agoOr, more importantly, how does key exchange work? You can’t really claim to be totally anonymous without explaining these details.
- i_am_proteus 8y agoHow does key exchange work, and does the server have copies of the keys?
- m1cky 8y agoYou can find more info on key exchange here - https://github.com/RNCryptor/RNCryptor https://github.com/RNCryptor/RNCryptor. The server does not have copies.
- kelnage 8y agoNo, you really can’t. That’s a library for symmetric cryptography. The key distribution/exchange problem cannot be solved with symmetric cryptography alone - unless you are acting as a trusted party and conveying the symmetric key - in which case you are not implementing end-to-end cryptography.
- danpalmer 8y agoIs the encryption end to end, or is the key known to the server?
- aboutruby 8y agoSeems like there is a "password" required to encrypt/decrypt but the app's descriptions says: > - No Sign Up / Log In / Usernames / Passwords. So I'm guessing this password is stored server-side and the passwords are associated to device ids. Seems like it would read your contacts and then send them to their servers too, not a fan of doing that personally. I'm not sure why the app mentions encryption/security as it seems far from being the main point of the app.
- m1cky 8y agoMessages sent on the app are end-to-end encrypted and the key is not known to the server. The only way anybody can read your messages is if you allow them physical access to your phone.