10 ms·
“Super secure” messaging app leaks everyone's phone number
- shevy-java 10mo ago[flagged]
- ambicapter 10mo agoProbably because a non-insignificant portion of them are literally trolls, Africans and Indians masquerading as True Americans for the grift.
- raverbashing 10mo agoelon is literally paying indians to cosplay as "patriotic americans" on Xitter
- theultdev 10mo agoThat doesn't make any sense. Why release a feature to show account locations then?
- anonym29 10mo agoI think the comment you're responding to just means monetizing high-visibility creators in general as a systemic practice, not deliberately facilitating deception.
- theultdev 10mo agoPossibly when it comes to the "paying" part. But my response was directed towards "indians cosplaying as patriotic americans". I'm on the fence when it comes to paying people for posts, but that wasn't really the heart of the statement.
- anonym29 10mo agoThere were a ton of "I'm a red blooded god fearing patriot"-type accounts being operated out of Russia, India, Pakistan, etc - the BBC link in another chain of this thread covers it. I think this is more about the global economy and the economics of western political engagement on digital platforms rather than some grand conspiracy, personally, but in a very literal sense, the post could be described as not technically inaccurate, even if missing the point and assigning personalized blame where it probably isn't warranted.
- frio 10mo agoIt's intent of action vs. actual action. Elon may not be _intending_ to pay foreigners to cosplay as patriotic Americans. However, X pays people based on engagement. A number of people outside the USA have figured out that if they post outrageous shit to Americans, they get engagement -- and therefore earn money. So in fact, Elon _is_ paying foreigners to cosplay as Americans, but it might not have been what he meant to do.
- raverbashing 10mo agoYes that feature was long overdue
- theultdev 10mo agoYeah should have been done by Dorsey a long time ago. Afaik X is the only social media service that does this so far. Such a simple feature that has a major quality of life improvement.
- ceejayoz 10mo ago> Afaik X is the only social media service that does this so far. Facebook has had it for years. https://www.facebook.com/help/320055788882014 https://www.facebook.com/help/320055788882014
- theultdev 10mo agoPer your link, this isn't for every account. Just for pages that reach a large number of people. Good step though. There really is no privacy concern to list the country of a user. I don't know why FB has to qualify it just for large pages only.
- thesuitonym 10mo agoIt's not really a useful feature because it's super easy to spoof once you know you have to.
- kgwxd 10mo agoBecause people that don't think will believe the shown location is accurate, instead of whatever the corrupt jack-ass running the site wants it to show. Any account that praises him will be a "verified human US citizen"
- oersted 10mo agoI hate to get into this, but I'm impressed by the ideological juggling. A conspiracy theory about minorities being anti-minority to weaken the majority by provoking them to anger against minorities? I suppose I'm falling for the trolling right now. EDIT: I assumed, perhaps wrongly, that OP was referring to individual "Africans and Indians" from the US. I suppose it does make some sense if we are talking about organised action from foreign powers.
- random9749832 10mo agoWhat part of wanting destabilisation for the most powerful country in the world is hard to understand for those that aren't from there?
- TylerE 10mo agoIt’s not trolling. When twitter turned on locations a few weeks ago many of the top maga accounts were revealed to be operating out of Russia or India. https://www.bbc.com/news/articles/cj38m11218xo.amp https://www.bbc.com/news/articles/cj38m11218xo.amp
- sigwinch 10mo agoYou’ll have to decide under “About this account” whether this True American might have intelligently chosen a VPN endpoint in those regions.
- chasebank 10mo agoAfricans and Indians are not minorities. Sure, if they live in the US, but I'm pretty sure OP referring to people in other countries.
- ceejayoz 10mo ago> I suppose it does make some sense if we are talking about organised action from foreign powers. It doesn't even have to be organized. Ragebait gets clicks. X pays out for engagement. (https://help.x.com/en/using-x/creator-revenue-sharing https://help.x.com/en/using-x/creator-revenue-sharing) The amounts are low by US standards, but nice pay by developing world standards. Thus, a cottage industry of fake accounts arises, without needing nation-scale organization behind it.
- bflesch 10mo agoThese might be the low-level trolls but there are also thousands of career beaurocrats in our non-democratic eastern neighbor countries who do exactly this as their full time job.
- oersted 10mo agoI feel like you are overthinking it. There's a segment of the population that share a set of values, they are collectively more active than average in imposing their worldview on the rest, and they've had a strong momentum towards their goals for a while. They are labeled MAGA, and they are as real as any widespread social movement could be. If your point is that social movements don't really exist as a "material" entity, then we are just arguing semantics.
- vel0city 10mo ago> WHO exactly is MAGA really? I am no longer convinced that MAGA is "real". Or really significant. Many are easy to spot. All the people with giant "Make America Great Again" flags in their front yard or attached to their lifted pickup trucks. The people in my neighborhood who have their Christmas light decor as a giant sign of "TRUMP WAS RIGHT ABOUT EVERYTHING". Funny how they complain about the leftists killing Christmas by removing Christ but they went from having a nativity scene to having TRUMP take up their holiday decorations. This org? Over the top patriotic branding (FREEDOM chat, logo is an eagle, etc). They make a point to be on Truth Social. On their Truth Social profile they have interviews on Breitbart and similar right-leaning people, including Laura Trump. Their brand Truth Social page constantly complaining about SOCIALISM. If you're not seeing the MAGA alignment of this chat platform you're just not looking very hard.
- LordGrey 10mo ago> Screenshots aren’t really crucial to anything being discussed here, but I like to provide only the best blog posts to my tens of readers .... A sentence clipped from a point a little past the introduction, but catchy nevertheless. I suspect there will be more than "tens of readers" shortly.
- billy99k 10mo ago[flagged]
- nerdsniper 10mo ago> Now let's look at left-leaning apps and how insecure they are and how quickly they patch vulnerabilities. Your point stood fine without this. It might make sense for a different audience but this audience understands all of that.
- billy99k 10mo ago[flagged]
- nerdsniper 10mo agoTake a look at this comment section. None of the other comments are making this political. The rest of us understand it’s not a “MAGA thing”.
- nutjob2 10mo ago> Your point stood fine without this. Did it? Mentioning MAGA is smear? The app's intended audience is pretty clear. But where I really disagree is promoting whataboutism. Anyone is free to submit stories about the foibles of the left or right, but what we don't need dualing whatabouts for every issue raised.
- jfindper 10mo ago>[...] it was patched within a month. I'm in the security industry, and this is amazingly fast. Lying is bad.
- billy99k 10mo ago"2025-12-09: Freedom Chat notifies us issues have been patched" It's on the site. and If you don't think I'm in the security industry, LOL
- sigwinch 10mo agoSince Anom, we need a new word than “honeypot”. The next secure messenger will not be created by these types. But many will be incrementally marketed, and each campaign will succeed in reaching a new batch of near-hit recruits.
- burnt-resistor 10mo ago"Petepot"
- agentifysh 10mo agowe have so many failure-as-a-feature ops these days im surprised we aren't discussing it more. something that consistently happens with enough frequency without any repercussions ultimately just becomes a feature of its own. we consistently have data breaches in institutions we trust is converging to a point where its literally just a data harvesting ops and everybody stops caring. They won't even bother to join class action lawsuits anymore because the rewards enrich the lawyers while everybody gets their twenty bucks in the mail after providing more personal data to the law firm its like a loophole. we now have legalized insider trading in the form of "prediction markets", legalized money laundering and pump and dump through crypto, all of these always lead to failures for the participant disguised as wins.
- Arch485 10mo agoIf I had a nickel for every "secure" app that handled sensitive user data and then subsequently leaked that data this year... I'd only have 20 cents, which I guess is good. But I'm sure there's more I'm forgetting. Related: [1] https://news.ycombinator.com/item?id=44684373 https://news.ycombinator.com/item?id=44684373 [2] https://news.ycombinator.com/item?id=43964937 https://news.ycombinator.com/item?id=43964937 [3] https://news.ycombinator.com/item?id=45985036 https://news.ycombinator.com/item?id=45985036
- sigwinch 10mo agoFor this specific movement, venturing outside Facebook Messenger is an important cue.
- lawlessone 10mo agoand these are just the ones we know about
- deleted 10mo ago[deleted]
- josh2600 10mo agoThis is why signal’s encrypted phone number lookup system is so cool. The server uses a bitwise xor when querying for numbers using hardware encrypted ram. The result is that even if you’re examining the machine at the most basic levels you can’t tell the difference between a negative or positive hit for the phone number unless you’re the phone requesting the api. Obviously ratelimiting is a separate and important issue in api management. The thing about building secure systems is that there are a lot of edges to cover.
- ronsor 10mo ago> The server uses a bitwise xor when querying for numbers using hardware encrypted ram. The result is that even if you’re examining the machine at the most basic levels you can’t tell the difference between a negative or positive hit for the phone number unless you’re the phone requesting the api. Do you have further reading on this?
- tapoxi 10mo agohttps://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- LunaSea 10mo agoI believe that the search term you can look for is constant time equality.
- dathinab 10mo agoThis article https://signal.org/blog/building-faster-oram/ https://signal.org/blog/building-faster-oram/ has some details but is more focused on improving their solution other blogs from the are "we want to build this soon" kind of blogs. It seems that most articles about this topic either have too little content to be of interest or are technology previews/"we maybe will do that" articles about things Signal wants to implement, where it's unclear if they did do that or something similar. To cut it short they use Intel SGX to create a "trusted environment" (trusted by the app/user) in which the run the contact discovery. In that trusted environment you then run algorithms similar to other messengers (i.e. you still need to rate limit them as it's possible to iterate _all_ phone numbers which exist). If working as intended, this is better then what alternatives provide as it doesn't just protect phone numbers from 3rd parties but also from the data center operator and to some degree even signal itself. But it's not perfect. You can use side channel attacks against Intel SGX and Signal most likely can sneak in ways for them to access things by changing the code, sure people might find this but it's still viable. In the end what matters is driving up the cost of attacks to a point where they aren't worth in all cases (as in either not worth in general or in there being easier attack vectors e.g. against your phone which also gives them what they want, either way it should be suited for systematic mass surveillance of everyone or even just sub groups like politicians, journalists and similar).
- ActorNightly 10mo ago[flagged]
- snapcaster 10mo ago[flagged]
- ryandrake 10mo agoI love the quote the article starts with: > Neither of us had prior experience developing mobile apps, but we thought, “Hey, we’re both smart. This shouldn’t be too difficult.” I think, 40 years from now when we're writing about this last decade or so of software development, this quote is going to sum it all up.
- V__ 10mo agoI think this also sums up most of the administration: "Nobody knew health care would be that hard"
- nickff 10mo agoYour quote would seemingly apply to a number of recent administrations, given the state of federal healthcare programs and legislation.
- RankingMember 10mo agoThe difference is that they didn't brag about how easy it would be before failing
- unglaublich 10mo agoAlways the asymmetric standards... R may fuck everything up if D made a mistake.
- DonHopkins 10mo agoBut Rs fuck things up on purpose, even things that hurt themselves, just own own the libs, and then complain about how things are so fucked up.
- RankingMember 10mo agoI'm not sure I understand what you're saying.
- pavel_lishin 10mo ago> 2025-12-09: Freedom Chat notifies us issues have been patched Have they?
- lettergram 10mo agoFeels a little like clickbait "MAGA-themed", never heard of Converso. That said, the analysis itself is interesting and worth a look, if nothing else it's a general pattern you can follow for many chat applications to see how secure it is.
- SV_BubbleTime 10mo agoThis, I have extremely varied media sources and Converso isn’t a real thing.
- mikestew 10mo agoAre you and OP being sarcastic? Or are your media sources just not as "varied" as you might think? https://www.theregister.com/2023/05/17/converso_e2ee_app/ https://www.theregister.com/2023/05/17/converso_e2ee_app/
- lettergram 10mo agoAll 1000 downloads... https://play.google.com/store/apps/details?id=com.freedomchat.freedomchat&hl=en_SG https://play.google.com/store/apps/details?id=com.freedomcha...
- mikestew 10mo agoThat's different than "I've never heard of it". So it's a real thing, and now you've heard of it. <Insert appropriate xkcd comic here>
- SV_BubbleTime 10mo agoNo one has heard of it. Just admit you got here because you were fooled into thinking your team was better at something, you were played. You never questioned it wasn’t a real service. When confronted you pretend it doesn’t matter that it’s a security lapse in a tiny no name project.
- 10mo ago
- Havoc 10mo agoWhen something is "super secure" you know it's full of holes. It's right up there with "impossible to hack" and "military grade" aka lowest cost bidder.
- hbarka 10mo ago“We’re clear on OpSec.”
- jakeydus 10mo agoObligatory Colin Jost Pete Hegseth warrior ethos post: https://www.youtube.com/watch?v=vZb1WO1_lGI https://www.youtube.com/watch?v=vZb1WO1_lGI
- hamdingers 10mo agoUnsinkable
- shreddit 10mo agoAt least the Hindenburg was iceberg proof https://xkcd.com/2350/ https://xkcd.com/2350/
- lesuorac 10mo agoAnd "complies with all applicable laws"; as-in we're operating at the lowest possible standard we can.
- maqp 10mo agoYup. As the guy who put together the most secure FOSS messaging system*, it's not "impossible to hack". It's a caveat ridden, inconvenient to use, tedious to setup, hardware-isolated, multinode application, with long must-read documentation, and that requires experience with electronics and soldering. * github.com/maqp/tfc
- ben_w 10mo ago> but I like to provide only the best blog posts to my tens of readers It may not be pertinent to the subject, but clearly I have found a kindred spirit in this author.
- aanet 10mo agoThe emoji :facepalm: was invented for exactly this...
- kgwxd 10mo agoNot really, the grift is going exactly as planned. I indirectly, and accidentally, made some money off a similar grift about a year ago. I'm starting to think I should just lower my standards for a few years, then retire. It's so easy to extract millions from idiots, with very little investment.
- deleted 10mo ago[deleted]
- theultdev 10mo agoFreedom Chat just looks (and sounds) like a grift tbh. The website doesn't really spark any confidence. Never heard of it and I'd be surprised if they have more than 100 users.
- burnt-resistor 10mo agoAnd it will invariably become a SIGINT and HUMINT pipeline leading straight to Moscow.
- hypeatei 10mo agoDoes Freedom Chat® have a feature to prevent journalists from joining your group chat? Asking for a friend that works at the DoD (sorry, DoW)
- CodingJeebus 10mo agoI stumbled upon a GOP jobs board a year ago that stored submitted job applications in the same search index as the job listings themselves, so all you had to do was search "bob" and find a bunch of resumes and application answers for people who had applied, I couldn't believe it.
- tonymet 10mo agoWhich one ?
- CodingJeebus 10mo agogopjobs.com, looks like it’s been fixed though
- tonymet 10mo agoi tried to see if it has any ties to the actual GOP national or any state parties and it's unclear. I'm guessing it's not affiliated and GOP is not trademarked. I asked because both political parties have chapters at national, regional, state & local levels so "GOP job board" on the face wasn't clear which organization was running it. Some parties cover rural counties of just a few thousand people.
- cdrnsf 10mo ago[flagged]
- throwawaysleep 10mo agoOr simply… lying. There is no need to be honest to a Trump voter. Honesty is work and they will believe nonsense anyway.
- ericmcer 10mo agoIt's crazy how many security vulnerabilities are just people pinging http endpoints in ways they didn't expect. You would think in order to "hack" a system in 2025 you would need to be doing some crazy computer science wizardry but it really is just lazy engineers. Like how do you ship an API and have no rate-limiting. It literally takes a line to implement in Nginx.
- thesuitonym 10mo ago> It literally takes a line to implement in Nginx. "Yeah but it wasn't in the docker tutorial I skimmed so I have no idea what it means."
- verdverm 10mo agoSoon to be... "Yeah, it was the Ai, I have no idea how any of this works"
- serial_dev 10mo agoThough once s hits the fan, you can just tell AI “I have no idea how any of this works andI don’t really even care but I need rate limiting, so do what you must, I trust you”.
- thesuitonym 10mo agoExcept the vibe coders aren't going to know to even ask about rate limiting.
- SchemaLoad 10mo agoAt least on the flipside. Code scanning tools are getting increasingly good. We finally moved to github at work and it's scanned the whole repo and pointed out tons of concerning security issues in the code. Not sure if it's powered by AI in any way (I assume not since they would scream from the rooftops if it was) but it's pretty useful.
- netfortius 10mo agoWhy in the world would any sane person utilize such an app, knowing what kind of people will be "at the other end" of communication, and what topics would be discussed, even if the most secure piece of software ever developed?
- the_gipsy 10mo agoThe president of the USA is on the equivalent alternative to Twitter.
- _yb2s 10mo agoIt appears that one of the most central aspects of MAGA is a postmodernist rejection of the very existence of expertise- except, ironically, in the art of grifting itself because they see “recognized experts” in any field as just very successful grifters. Hence replacing competent government employees at every level with incompetent employees. It would track that technology developed for and by the MAGA community is developed with the same philosophy. Anyone planning to buy the Trump phone?
- LetsGetTechnicl 10mo agoAccusing someone else of a crime/problem/whatever that you're also currently doing? Well that's just the MAGA way.
- UberFly 10mo agoThe comments here are a disaster. Who could have predicted this???
- sneak 10mo agoThis is the same thing that sent weev to jail when he and JB did it against AT&T to determine the email addresses (instead of PINs) of every iPad 3G user.
- agentifysh 10mo agoI'm curious why a Canadian is so hell bent on causing more division in America by embedding his political views in an otherwise decent vulnerability analysis. He makes it sound he's on some sort of a mission...like the users of the messaging app ( which I have never heard of before until today ) should face some sort of backlash for their own political views opposite of him....which is amusing to say the least as Canadians seem to have permanently marked conservatives, not just in their own country but all over the world as "MAGA". also I'd appreciate if we can keep politics out which just detracts focus on technical end of things
- verdverm 10mo ago> I'd appreciate if we can keep politics out This is an app specifically built for a specific political group, a group that is wreaking havoc on our science and technology. "MAGA" has become the go-to term for a global movement, because there is a global alt-right movement to undo progress and dominate others into their world view. It's going to be a part of HN like it was the first go around. Being apolitical is how political groups like this come to power.
- agentifysh 10mo agosame argument can be made for bluesky or reddit pretty much any platform you slap political labels on and this only increases division and radicalizes people on the fringes and desperate for a sense of belonging to as surrogacy for loneliness
- verdverm 10mo agoDo you want the alt-right to take over? If your answer is no, then understand we need to talk about it all the time to fight back. They want us to _not talk_ about what they are doing so we _remain ignorant of each other_ think about what they are doing, so they can get away with more
- agentifysh 10mo ago
- tonymet 10mo agoCan those of you writing off half of America as “ignorant “ or “anti -science “ please move those comments back to Reddit. And what conclusions did you draw when obvious left leaning apps were breached ? FB, LI , Washington Post , twitter (pre Elon) all had breaches . Does that mean left and right leaning Americans are all ignorant ? I don’t take any offense , but I do have high standards for this forum and cringe comments make me less likely to hang out here
- acdha 10mo agoNone of the sites you mentioned are (or were) left-leaning unless you are saying anyone less politically correct than Fox News is leftie, but that’s missing the bigger reason why the MAGA connection matters: MAGA is at its heart conspiratorial, obsessed with the idea that the “elites” are against the common man. That war on expertise has been there from the beginning and it makes followers unusually vulnerable to scams because it normalizes this way of thinking that everyone’s opinion deserves equal weight. Sure, security experts say to use Signal but why should you trust them any more than the scientists who say the earth is warming or the economists who say that gold has drawbacks as the basis for an economic system?
- tonymet 10mo agoThey are left leaning and run predominantly by left leaning staff and boards . FB and X have pivoted opportunistically to Trump , and still only slightly
- tonymet 10mo agoIt would waste my breath to try to convince you that MAGA Americans actually are intelligent. My point is that all apps have breaches , and a great many of them are run by liberals (who love climate change and inflation, as you do ) , so what does any of this have to do with a tech forum
- acdha 10mo ago> It would waste my breath to try to convince you that MAGA Americans actually are intelligent Definitely, because I never said they weren’t and certainly don’t believe that — I know too many smart conservatives for that. That’s a big part of the problem: smart people can put a lot of effort into constructing rationalizations so when they’re immersed in a culture where political correctness trumps objectivity they’ll construct elaborate narratives to support the ideologically useful outcome. The relevance to security is that these people are more vulnerable because they can’t tell charlatans who appear to be on their side apart from people who actually know what they’re talking about. There are tons of right-leaning people in tech but as we saw with election fraud claims, the competent ones know it’s risky to contradict the narrative and stay quiet rather than being accused of being RINOs. It’s similar to how things like MLM scams spread in religious communities if you have experience with that, where things usually have to get pretty bad before someone is willing to criticize a friendly member of their congregation.
- higginsniggins 10mo agoWhen you go the website the first line is literally “Say hello to Freedom Chat—a next-generation messaging app that keeps your conversations actually private
- Bengalilol 10mo ago... and then you encounter things like "Privacy’s been lost. We’re here to take it back." or "World-class security". It looks like "Freedom" is a sure thing.
- kevin061 10mo agoWhy would you use a messaging platform that requires you to sign up with a very difficult to change piece of information that in many countries is tied to your ID and pretend it is secure? looks at Signal Oh.
- TZubiri 10mo agoYou can register on telegram without using your phone number as an account identifier.
- maqp 10mo agoYeah if you buy a number with Durov's TON shitcoin. The original sales are over and number auctions start from opening bid of 37 dollars, and run all the way to 14,000 USD https://fragment.com/numbers https://fragment.com/numbers, and they take very long, even up to one year to close. Also, Telegram is not private. 1. It's not E2EE by default 2. It's not E2EE for groups on any platfrom 3. It's not E2EE 1:1 on desktop clients forcing you to downgrade from secret chats to insecure chats 4. It's collecting 100% of your metadata, including * who you talk to, when, how much, what type of data you exchange, * your IP-address which sort of defeats the purpose of having no phone number, and * when you enable secret chats Telegram is also not transparent about its funding, about who develops it, and who has access to the plaintexts stored on their server (meaning, anyone with a zero day or two). Journalists who went to look for Telegram's office in Dubay found out no-one in the neighboring office had ever seen Telegram staff enter the space https://www.youtube.com/watch?v=Pg8mWJUM7x4 https://www.youtube.com/watch?v=Pg8mWJUM7x4 Telegram was built with blood-money from VKontakte, and Durov has been marketed as living in exile, when in reality he has visited Russia on average once every 2.4 months since the exile began, and strangely Durov has not had his underwear poisoned and windows have been kind to him despite supposedly betraying Putin's interests. tl;dr Telegram reeks of FSB/SVR honeypot.
- kevin061 10mo agoAnyone using Telegram and expecting it to be a secure messenger is delusional.
- TZubiri 10mo agoFor every conscientious hacker that tries to do everything right and have a secure and reliable app. There's ten naïve hackers that just publish whatever.
- whoknowsidont 10mo agoWhy does the title not match the article? It's under the character limit. Original title is: “Super secure” MAGA-themed messaging app leaks everyone’s phone number I think that's incredibly important context. Instead of conferring with actual experts in the field, the populist, fascist segment of our society just decided to wing it with technology. They BELIEVED they were more secure, with no evidence to back it up.
- maqp 10mo agoYup, it's almost like they're feelings/emotions over evidence/science. It's not that hard to understand considering how that weird lot consists of all sorts of cranks, pooled by the alt right radicalization pipelines of wellness/conspirituality/flat earth/alt-med/anti-vaccine/UFOs...
- NekkoDroid 10mo ago> Why does the title not match the article? It's under the character limit. Well obviously we can't be seen as non-neutral (I wish I would be joking, but I have a feeling that is the thought process on a good day)
- codedokode 10mo ago> What’s going on in that user object? The pin field seems suspiciously related to the PIN we were asked to input after creating our account This might be the fault of opt-out serialization library (by default it serializes the whole object and you need to manually opt-out fields from it). So a programmer adds a field, forgets to add opt-out annotation and voilà. Or they are just using plain JS dicts on the server and forgot to remove the key before using it in a response. > The vulnerability they’re talking about was presented in a paper by researchers at the University of Vienna. This vulnerability (mapping phone numbers to user id via rendevouz API) is old and was exploited in 2016 in Telegram [1] and allowed Iranian govt to build a phone book of 15M Telegram users. The paper also mentions that the vulnerability was known in 2012, still not fixed. [1] https://telegram.org/blog/15million-reuters https://telegram.org/blog/15million-reuters
- SchemaLoad 10mo agoThis is such a common issue I've seen in so many API backends, where sensitive fields on a record are getting sent to the client and no one notices because it's invisible in the UI.
- Sardtok 10mo agoThe fact that the PIN is leaked is bad enough, but it also happens to be plaintext. This is a password. It should not be stored unhashed, and it should be hashed with strong algorithms.
- deleted 10mo ago[deleted]
- cbsks 10mo agoIt’s a 6 digit pin. Doesn’t seem worthwhile to hash. What are the best practices here? I’m not sure
- dietr1ch 10mo agoYeah, you can only delay attacks by a tiny little bit, but the search space of 10^6 is just too small. Salting it doesn't give you much more security.
- nunez 10mo agoWow; that's a 101-level exploit.
- nielsbot 10mo ago> Neither of us had prior experience developing mobile apps, but we thought, “Hey, we’re both smart. This shouldn’t be too difficult.” Is this an actual quote? Because it sounds like a standup joke.
- deleted 10mo ago[deleted]
- fn-mote 10mo agoI’m glad “super secure” is in scare quotes. I’m glad I have never heard of this app. Security and trust go hand in hand.
- password-app 10mo agoThis is why I'm skeptical of any app claiming "super secure" without open-source verification. The real lesson: assume every service will eventually leak something. Use unique passwords everywhere, enable 2FA, and rotate credentials after breaches. The tedious part is the rotation. I've seen people skip it because manually changing 50+ passwords is brutal. Automation helps but needs to be done securely (local-only, zero-knowledge).
- Shocka1 10mo agoThe word "super" is enough to make my red flags fly. As a millennial the word super is something that I remember only being used around the house, or between young friends. Fast forward to the last few years and the casual use of the word super, along with uptalk, is being used what seems like every other sentence in the professional setting. It's strange to me and immediately makes me think of the person using it as childish or otherwise not know what they are talking about. I'm not surprised about the "Super secure" app not being secure.
- maidh91 10mo agoAnyone here is using Keet? P2P, no server, no phone number