I guess assessing the answers is subjective, I've read several of her long replies and either are weak or they do no contain an answer to the question, E.g. "I

I guess assessing the answers is subjective, I've read several of her long replies and either are weak or they do no contain an answer to the question, E.g. "In Response to "How was an unobfuscated version of the Measurement Systems SDK incorporated into MsgSafe?": Our company never published a production or supported version of the MsgSafe mobile app containing the Measurement Systems SD [...]" This does not answer the question. It's irrelvant if the software was published or not, the question is, how does MsgSafe get an unobfuscated version of a software where everyone else got an obfuscated version? Why does MsgSafe include the only known unobfuscated version - if they are not the primary authors? Answers are interwined with marketing, E.g. "We have innovated and lead the market in the adoption of TLS server certificate issuance for one of the longest-running and most respected dynamic DNS services worldwide and the positive impact this move has made cannot be overstated." - which has nothing to do with the issues at hand. About security, the most concerning answer: (Their website right now states: "Private, end-to-end encrypted") In Response to: "[...] Nevertheless, I think it is reasonable expectation that a root certificate authority can get the crypto right, and so I'm concern regardless of the reason why.”: [...] As far as you not believing the product is offering adequate encryption capabilities, let me first say that I do not want to drag the names of any other encryption products or services through the mud. To address your concerns, based on our teams exhausted research into many other providers offering similar services, one basic rule applies; whether the encryption or decryption functions are occurring on the client (often in javascript) or on the server, the server is still storing and handling the key material in the process. [...] If encryption occurs on the client then the key material is passed from the server to the browser over TLS. [...] As the MsgSafe website explains, our team has found that implementing the key material and encryption/decryption processing on the server provides security without the additional processing requirement on the client." Either this is snakeoil ("Private, end-to-end encrypted") or they don't know about what they are doing. There are many more of those answers in the thread, but dinners ready and I can't https://xkcd.com/386/ https://xkcd.com/386/