4 ms·
Don't Use Session (Signal Fork)
- jetbalsa 2y ago> Cryptography nerds should NOT be finding the software that activists trust with their privacy hilarious. This is very much true. Why in the world would session do the things they listed unless it really was just a state actor trying to get something in place to snoop on people.
- keejef 2y agoVarious reasons, using 128 Bits of entropy in Session Account IDs allows Session to use 13 word mnemonic seeds, instead of 25 word seeds, which makes the UX of writing down and saving mnemonic seeds easier, the claimed reduction in security by the researcher is incorrect. The other 2 security issues are misinterpretations of the code. Full response is provided here https://getsession.org/blog/a-response-to-recent-claims-about-sessions-security-architecture https://getsession.org/blog/a-response-to-recent-claims-abou...
- ranger_danger 2y ago[flagged]
- Kye 2y agoSkill issue
- summermusic 2y agoWhy can't you take this web page seriously?
- dang 2y ago"Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 2y ago[deleted]
- Llamamoe 2y agoI'm not familiar with cryptography enough to know whether these arguments make sense, but if they do, this is really damning. That's a series of intentional, unnecessary changes that each massively weaken the protocol's security...
- keejef 2y agoWe've put together a response here which responds to the claims re: cryptography https://getsession.org/blog/a-response-to-recent-claims-about-sessions-security-architecture https://getsession.org/blog/a-response-to-recent-claims-abou...
- nexus_six 2y agoThe site is returning just a JSON response of the blog post for me. Can't view the content directly.
- some_furry 2y agoShould be fixed now. https://furry.engineer/@soatok/113833767490388329 https://furry.engineer/@soatok/113833767490388329
- extraduder_ire 2y agoGlad to see someone looking into the actual security of this application finally. I couldn't find any information like this when I first heard of it. The primary (maybe only) appeal of this app seems to be the lack of a phone number requirement. Consequently, you can run a desktop version without also having a phone.
- keejef 2y agoAgree, its good when people review Session's code for vulnerabilities, its just in this case many of the claims the researcher makes are incorrect or misleading. https://getsession.org/blog/a-response-to-recent-claims-about-sessions-security-architecture https://getsession.org/blog/a-response-to-recent-claims-abou...
- keejef 2y agoHave written up a full response here, every claim by the researcher is covered https://getsession.org/blog/a-response-to-recent-claims-about-sessions-security-architecture https://getsession.org/blog/a-response-to-recent-claims-abou...