4 ms·
An "encrypted communications app" that is not using secure encryption is worse than an unencrypted one - the users get a fake feeling of security, and might rev
by ge0rg 13y ago
An "encrypted communications app" that is not using secure encryption is worse than an unencrypted one - the users get a fake feeling of security, and might reveal sensitive information to whoever is listening.
Regarding real security, have a look at ChatSecure, which is available for iOS and Android, uses standard encryption protocols (XMPP with TLS, OTR), is open source, and was developed by the Guardian Project (who have a track record of developing security software):
https://itunes.apple.com/de/app/id464200063 https://itunes.apple.com/de/app/id464200063
https://play.google.com/store/apps/details?id=info.guardianproject.otr.app.im https://play.google.com/store/apps/details?id=info.guardianp...
- Ihmahr 13y agoYes, I have been using chatsecure and I know it is much more secure but it is almost unusable on ios because it can not run in background. As for the false sense of security, you're probably right.
- ge0rg 13y agobut it is almost unusable on ios because it can not run in background Unfortunately, the only way around that is to integrate with Apple's Push Service, which means you need to run a server-side component which notifies Apple (and which in turn notifies your app). This is not specified for XMPP, so most "XMPP clients" for iOS instead store your credential on the app developer's infrastructure. However, this problem is being worked on: http://legastero.github.io/customxeps/extensions/push.html http://legastero.github.io/customxeps/extensions/push.html
- chrisballinger 13y agoI am working on a protocol-agnostic, federated push messaging layer for ChatSecure-iOS but it will be interesting to see if anything else pops up in the meantime.