4 ms·

Zendo Is My New Favorite Secure Messaging App

17 points by coloneltcb 12y ago

mark_l_watson 12y ago
Nice article. I like the idea of getting people to at least start using private communication, where appropriate. The end of the article lists some great use cases for private communication (sharing passwords, etc.)
classicsnoot 12y ago
can anyone way in on how Zendo stacks up to TextSecure?
- AlyssaRowan 12y ago
  Well, Zendo is not open source, and it uses "one time pads" - classic signs of snake-oil cryptography (Vernam ciphers are information-theoretic secure if done properly - but impractical for almost every use case, because they really just amount to secret-splitting - and the most fragile crypto primitive, because if you do even one thing slightly wrong, they're awful). It also doesn't look to be forward-secure, unless I'm misunderstanding something from 2 minutes of research. And it needs manual setup. So very poorly, I'm thinking. TextSecure/Signal can present/scan a QR code in-person to do a public key fingerprint verification that way. I'm sticking with TextSecure/Signal, thanks.
  - classicsnoot 12y ago
    As for me, i am tired of being ignore by TS after months of prompt responses. i believe they cover your concern(s) in the article but i am merely a youngling. I like TS, but the lack of support for correcting group mms issuers with wifi enabled as well as ditching encrypted SMS means i am jumping ship.
classicsnoot 12y ago
so, my understanding of crypto comes solely from HN comments, articles and Cryptonomicon. I assume i will be wrong on most points: 1)if someone is somehow monitoring the mobileP2P connection between you and your friend they could conceivably crack the 256 RSA jumble to obtain the 1time pad 2)if someone gains access to your device they could obtain the QR image and (1) i bet there are other possibilities via hardware and ???? from my lay POV, this does seem like a promising idea.
- Lx1oG-AWb6h_ZG0 12y ago
  I think the article addresses the first concern: the radio connection is encrypted with the AES key in the QR code that is scanned optically. As for the second, if they are in the device, you're already screwed: they might as well intercept the keyboard/camera/mic instead of hacking the app. Same for hardware access.

17 points by coloneltcb 12y ago

Nice article. I like the idea of getting people to at least start using private communication, where appropriate. The end of the article lists some great use cases for private communication (sharing passwords, etc.)

classicsnoot 12y ago

can anyone way in on how Zendo stacks up to TextSecure?

AlyssaRowan 12y ago
Well, Zendo is not open source, and it uses "one time pads" - classic signs of snake-oil cryptography (Vernam ciphers are information-theoretic secure if done properly - but impractical for almost every use case, because they really just amount to secret-splitting - and the most fragile crypto primitive, because if you do even one thing slightly wrong, they're awful). It also doesn't look to be forward-secure, unless I'm misunderstanding something from 2 minutes of research. And it needs manual setup. So very poorly, I'm thinking. TextSecure/Signal can present/scan a QR code in-person to do a public key fingerprint verification that way. I'm sticking with TextSecure/Signal, thanks.
- classicsnoot 12y ago
  As for me, i am tired of being ignore by TS after months of prompt responses. i believe they cover your concern(s) in the article but i am merely a youngling. I like TS, but the lack of support for correcting group mms issuers with wifi enabled as well as ditching encrypted SMS means i am jumping ship.

classicsnoot 12y ago

so, my understanding of crypto comes solely from HN comments, articles and Cryptonomicon. I assume i will be wrong on most points: 1)if someone is somehow monitoring the mobileP2P connection between you and your friend they could conceivably crack the 256 RSA jumble to obtain the 1time pad 2)if someone gains access to your device they could obtain the QR image and (1) i bet there are other possibilities via hardware and ???? from my lay POV, this does seem like a promising idea.

Lx1oG-AWb6h_ZG0 12y ago
I think the article addresses the first concern: the radio connection is encrypted with the AES key in the QR code that is scanned optically. As for the second, if they are in the device, you're already screwed: they might as well intercept the keyboard/camera/mic instead of hacking the app. Same for hardware access.