3 ms·
If you host your own server with their server software, you can verify it's running unmodified.
by sirsar 13y ago
If you host your own server with their server software, you can verify it's running unmodified.
- nwh 13y agoThey don't provide the server-side code, nor a way to ensure that your client is talking to a specific server. The only authentication is via a 5 digit code sent via SMS, so it's presumably very easy to spoof and control messages. You need on average 5000 attempts to log into another users account (they are send a "new device added" notification message though), which could be done reasonably easily if you knew a person would have their phone off for a period of time when you wanted to attack their account.