Testing a new encrypted messaging app's extraordinary claims

by crnkovic • 3 years ago

199 36 3 years ago

There is software that lives up to these claims, it's Tinfoil Chat. The article is correct about the necessary trade-offs: due to peer to peer transport (onion hidden service 2 onion hidden service) both ends of the conversation have to be online -- it at least spools the message waiting for the recipient to appear.

For hole punching and signaling that has to be done by third party, well, the third party is TOR

TFC then goes on to break out the encryption and decryption machines from the network and passes messaging over opto-couplers to prevent your keys from getting exfiltrated. Qubes qrexec could similarly isolate the components.

https://github.com/maqp/tfc

crnkovic6• 3 years ago

The problem with these tools is that they're extremely complicated to set up and use. Grandma wants a phone number, not a v3 Tor Onion Service address.

I'm interested in usable E2EE messaging apps -- that's what I compared Converso to. Whatever this is (I will read the docs some day) is in another realm.

jazzyjackson2• 3 years ago

Definitely - adding contacts in TFC is an unreasonable burden, cannot copy paste addresses into the source machine, 56-character tor addresses have to be typed in manually, followed by the recipients' public key.

cyclotron3k• 3 years ago

This is my absolute favourite kind of post on HN. It's got everything; intrigue, mystery, scandal and of course heavy on the technical side too. All packaged up in a compelling narrative.

crnkovic6• 3 years ago

Thanks! I'm glad you found it as interesting and thrilling as I did while discovering each (exponentially worse) mistake.

joemazerino• 3 years ago

Agreed! Additional bonus points for calling snake oil out.

tailspin20192• 3 years ago

This is so incredibly bad. I’m stunned.

Great investigative blog post!

Tldr; Do not under any circumstances use or recommend “Converso”.

crnkovic6• 3 years ago

Thank you! Glad you enjoyed it.

anaganisk2• 3 years ago

My goodness what are they even planning to patent? Seald SDK? Ract native? Firestone? RSA? The app does nothing, LOL.

lucakiebel• 3 years ago

They’re probably just stalling for time, and they can blame the patent office

crnkovic6• 3 years ago

Who knows!

urbandw311er2• 3 years ago

If memory serves, I was once told by an IP lawyer that during the time period when you have a patent pending (regardless of merit) some unscrupulous types then leverage that face to juice their valuation to potential investors.

anaganisk2• 3 years ago

Ooooh makes sense.

aboringusername• 3 years ago

It's actually kind of sad to see people actually using this and believing in the claims being made. And this is all supported by Google who, frankly, should be denying service to what should be considered spyware. I mean, I swear this type of app used to be considered spyware...

It seems these days if your data ends up on a server that's A-ok! With all the talk on HN about the "GDPR" it sure seems like an absolute failure - where's the QC from Google looking at the code and proactively doing something about the real, potential harm that can come from this? It really seems if you want to harvest user data you can whip together an app that looks and feels okay, but behind the scenes is designed to do nothing but collect your data for whatever nefarious purpose the developer has in mind - and this is all 100% legal and the chances are whoever was involved will not even get so much as a fine!

Now there's an app that openly collects user data and is publishing it as a matter of public record, consequences be damned.

Android and Google need to take responsibility here and use Play Protect to treat the app as harmful and to better shield users.

This is an excellent write-up and investigation which is something Google should be doing to expose the dangers of their own platforms - hacking together a few API's/SDK's to mass harvest user data is absolutely not okay. Frankly, they should be legally mandated to review these apps in depth, and be provided full, unobfuscated source code, along with a detailed network-map of all URL's the app accesses, API keys etc and should approve (similar to Apple) before Android allows it to be used. If you install it outside of the app-store a very strong warning should be in place to let users know of potential spy/malware

I also discovered this app is actually on the play store [1]! And the app data safety says "No data shared with third parties Learn more about how developers declare sharing". It's an absolute JOKE this is not being enforced by Google at all. Shame on them.

I believe Mozilla did an investigation and found most apps are outright LYING about their "data safety" so that feature is beyond useless when Google doesn't actively moderate it.

[1] https://play.google.com/store/apps/details?id=com.conversoap...

urbandw311er2• 3 years ago

I wonder if there might be grounds for any users to sue based on the publishing of their personal data online and misrepresentation of the product and its security features.

apollo_mojave• 3 years ago

Amazing.

Have you by chance looked at the new update? Not that anyone should ever use this app in the first place, but I'm curious whether the massive vulnerability you discovered was fixed.

crnkovic6• 3 years ago

whether the massive vulnerability you discovered was fixed.

Which massive vulnerability in particular? You'll have to be more specific, haha.

I confirmed the Firestore collections had some kind of server-side security rules added before publishing the post.

randyrand4• 3 years ago

Yes that’s the biggest issue.

The other one is seald MITM, which they probably won’t know how to fix, IMO.

ssss11• 3 years ago

Wow what a read. Best read I’ve had in months.

crnkovic6• 3 years ago

Glad you enjoyed it.

kotaKat• 3 years ago

2023-05-05: Converso asks: "May we know what you do and where you are located? Thank you."

What are you, a cop?

jasonladuke03112• 3 years ago

"Can we sue you, or are you subject to prosecution under the CFAA? Thanks."

Michelangelo11• 3 years ago

You are doing God's work, sir.

tortoise_in• 3 years ago

You should use conversations. I guess it's best and open-source also. Now getting some major overhaul

ementally• 3 years ago

This was an article about the app [0].

"Man Creates Messaging App FBI Can't Crack and Anyone Can Download, Stopped at Airport Days Later"

I would just use SimpleX tbh [1]

[0]https://www.westernjournal.com/man-creates-messaging-app-fbi...

[1] https://simplex.chat

gerikson• 3 years ago

First link:

This article was sponsored by Converso.

randyrand4• 3 years ago

This is so embarrassing. How can they even attempt to exist after this?

This big question — who is paying to develop this terrible app and why? Do they know it’s terrible?

randyrand4• 3 years ago

IMO you should consider putting Converso in the title of your blog post so that it shows up when people Google, as a warning.

I just checked and your blog post does not come up in the results for Converso.

tailspin20192• 3 years ago

I had this same thought. The problems with this app are serious enough to be a danger for certain people who might rely on it (journalists for example)

purecatprsn• 3 years ago

ironically this showed up when i googled Converso

randyrand4• 3 years ago

great!

haser92• 3 years ago

A quick search after the CEO turns out, the man is a genius: "Tanner Haas, who is an M.I.T. drop out" was a human health specialist in 2020: https://londondailypost.com/this-denver-based-startup-aims-t... ...now he is a crypto expert.

jasonladuke03112• 3 years ago

There is more: https://revealaitests.com/pages/about-us

deepserket• 3 years ago

How incompetent you have to be to ask "How were you able to decompile the source code of the app" after reading this post?

r0xz• 3 years ago

2023-05-05: Converso asks: "How were you able to decompile the source code of the app...?"

Seriously? What the fish?!

egberts1• 3 years ago

Love these articles such as this OP where the concept is ripped apart and identified as snake-oil.

Good job, keep it up.

Testing a new encrypted messaging app's extraordinary claims

Related Stories