I took a quick look at the source code. It's providing end-to-end encryption with libsodium, using crypto_box [1], crypto_secretbox[2], and crypto_pwhash for pa

I took a quick look at the source code. It's providing end-to-end encryption with libsodium, using crypto_box [1], crypto_secretbox[2], and crypto_pwhash for password-based key derivation [3]. The public key model appears to be TOFU [4]. It's doing a distinct crypto_box per notification [5]. It doesn't use an authenticated key exchange or offer key rotation or forward secrecy, but that's probably fine for this use case. Not too long ago, I wrote a guide to end-to-end encryption [6], and I would classify the "end-to-end encryption" here as meeting the minimum definition (data is encrypted between devices, rather than in a client-server architecture where the server has access to plaintext), even if it's not suitable for more sensitive threat models. One thing I didn't see was message padding of location data prior to encryption, to prevent side-channel attacks via ciphertext length. [7] I don't know if I missed this, or if it was omitted. [1] https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d1a8fca51fb8b5459/app/src/main/cpp/sodium.c#L214-L219 https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d... [2] https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d1a8fca51fb8b5459/app/src/main/cpp/sodium.c#L143-L147 https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d... [3] https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d1a8fca51fb8b5459/app/src/main/cpp/sodium.c#L41-L48 https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d... [4] https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d1a8fca51fb8b5459/app/src/main/java/io/pijun/george/MessageProcessor.java#L133-L134 https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d... [5] https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d1a8fca51fb8b5459/app/src/main/java/io/pijun/george/LocationUtils.java#L92-L93 https://github.com/zood/george/blob/52ddae2b5f65d324e1785c2d... [6] https://soatok.blog/2020/11/14/going-bark-a-furrys-guide-to-end-to-end-encryption/ https://soatok.blog/2020/11/14/going-bark-a-furrys-guide-to-... [7] https://ioactive.com/ssl-traffic-analysis-on-google-maps/ https://ioactive.com/ssl-traffic-analysis-on-google-maps/