News for hackers. Stuff that matters.

A comment on Surespot app - free and open source encryption for everyone. Parent comment

Re:Surespot app - free and open source encryption for everyone by StavrosK on Monday September 02, 2013 @05:11AM (#6314226)
> "Only the person you send the message to can read it. Period." > To use this kind of sentences on new software not reviewed by the comunity is dangerous. There is people that risk their lifes using this kind of app.

It is also false, since it seems that their threat model also includes the server being able to transparently MITM you and read all your messages. A pretty egregious overstatement, I think.

[ Parent | on HN ]
Re:Surespot app - free and open source encryption for everyone by surespot on Monday September 02, 2013 @11:44AM (#6315648)
The threat model also suggests that you verify key fingerprints manually if you are concerned about MITM.
[ Parent | on HN ]
Re:Surespot app - free and open source encryption for everyone by StavrosK on Monday September 02, 2013 @11:47AM (#6315662)
Yeah, I guess verifying the full length of the fingerprint would mitigate that, and not doing that exposes you to a MITM attack anyway. Not much less secure than exchanging the keys directly, then, you are right.
[ Parent | on HN ]