Post

Hey chat is it good when your security audit recommends this?

This is from *only auditing the implementation*! They didn't even have time to audit the actual custom protocol!

The first vulnerability alone is awful! Clients don't require signatures on keys from the server and don't validate signatures if present, so the server can just lie about keys used to encrypt conversations. If the server can substitute participants, you don't have a secure messaging system.

The SHA-1 one is just embarrassing.

'// TODO add security' now that's what I call enterprise grade software