keejef

We've put together a response here which responds to the claims re: cryptography https://getsession.org/blog/a-response-to-recent-claims-abou...

Agree, its good when people review Session's code for vulnerabilities, its just in this case many of the claims the researcher makes are incorrect or misleading. https://getsession.org/blog/a-response-to-recent-claims-abou...

Various reasons, using 128 Bits of entropy in Session Account IDs allows Session to use 13 word mnemonic seeds, instead of 25 word seeds, which makes the UX of writing down and saving mnemonic seeds easier, the claimed reduction in security by the researcher is incorrect. The other 2 security issues are misinterpretations of the code.

Full response is provided here https://getsession.org/blog/a-response-to-recent-claims-abou...

Have written up a full response here, every claim by the researcher is covered https://getsession.org/blog/a-response-to-recent-claims-abou...