4 ms·

It'd be nice to see the fake tech journalists/reviewers issue a retraction, or even Google Play get involved as this is rather much like fraud. And also, what

It'd be nice to see the fake tech journalists/reviewers issue a retraction, or even Google Play get involved as this is rather much like fraud. And also, what does the developer even gain from using XOR? In most common frameworks, using, perhaps incorrectly, AES is about the same effort.

feybay 12y ago
I don't know if this falls under fraud. It is a form of encryption, albeit minimal to a ridiculous degree.
Stefan-H 12y ago
I could understand this being a tough position from google's perspective. When talking about how secure something is, one has to consider the threat model - there is not absolute. If the goal is to keep naughty pictures confidential from one's mother - this may indeed be "secure" enough for that situation. Keeping blackmail photos safe from a nation state on the other hand, likely not. I do not think that we currently have a good way as product creators to specify what secure actually means - and what is more - our customers won't understand the nuance either. This is in no way trying to excuse passing this "encryption" scheme off as secure.
quotedmycode 12y ago
I believe they might have done it this way so they can claim 'encrypts a 100gb file in under 100ms!' or something equally dumb.
UnoriginalGuy 12y ago
It is a Chinese company, so it isn't beyond belief that the Chinese government asked them to make the encryption "reversible" and doing it correctly was behind their technical know-how.
TillE 12y ago
XOR is the appropriate operation if you're using a stream cipher to generate an arbitrarily long keystream. Or a one-time pad. It also makes random access a lot simpler. Of course, you do actually need to generate that keystream and not just repeat a short key.
- nullc 12y ago
  There are very few cases where you should be doing encryption without authentication... and as soon as you're doing authentication you'll be doing more than just xoring with a stream cipher output. :)

feybay 12y ago

I don't know if this falls under fraud. It is a form of encryption, albeit minimal to a ridiculous degree.

Stefan-H 12y ago

I could understand this being a tough position from google's perspective. When talking about how secure something is, one has to consider the threat model - there is not absolute. If the goal is to keep naughty pictures confidential from one's mother - this may indeed be "secure" enough for that situation. Keeping blackmail photos safe from a nation state on the other hand, likely not. I do not think that we currently have a good way as product creators to specify what secure actually means - and what is more - our customers won't understand the nuance either. This is in no way trying to excuse passing this "encryption" scheme off as secure.

quotedmycode 12y ago

I believe they might have done it this way so they can claim 'encrypts a 100gb file in under 100ms!' or something equally dumb.

UnoriginalGuy 12y ago

It is a Chinese company, so it isn't beyond belief that the Chinese government asked them to make the encryption "reversible" and doing it correctly was behind their technical know-how.

TillE 12y ago

XOR is the appropriate operation if you're using a stream cipher to generate an arbitrarily long keystream. Or a one-time pad. It also makes random access a lot simpler. Of course, you do actually need to generate that keystream and not just repeat a short key.

nullc 12y ago
There are very few cases where you should be doing encryption without authentication... and as soon as you're doing authentication you'll be doing more than just xoring with a stream cipher output. :)