4 ms·

It's really not even enough to open source their server software because you would still have to trust that they ran that open source software unmodified on the

• sirsar 13y ago
  If you host your own server with their server software, you can verify it's running unmodified.
  • nwh 13y ago
    They don't provide the server-side code, nor a way to ensure that your client is talking to a specific server. The only authentication is via a 5 digit code sent via SMS, so it's presumably very easy to spoof and control messages. You need on average 5000 attempts to log into another users account (they are send a "new device added" notification message though), which could be done reasonably easily if you knew a person would have their phone off for a period of time when you wanted to attack their account.
• meowface 13y ago
  Yep, that's also absolutely true. You'd have no idea if their servers were actually running the code they published. Moxie's TextSecure on the other hand does full end-to-end encryption, with no work done by any server. Same with OTR and similar message encryption plugins. It baffles me why people are sticking to the "everything on the server" route for applications that focus on user privacy and security in this day and age, especially when there are a lot of good alternatives that don't.
  • goatslacker 13y ago
    They're going the 'everything on the server' route because this application is meant to compete with messaging services rather than appease the 'small crowd of crypto enthusiasts' as they have already stated.