Glacier Kitsune

@GlacierK

Summer Vulpin'

She/Her

Strange Internet Person
Really love Foxes, Tech, Arts, Good Vibes

Glacier Kitsune @GlacierK5/11/2023, 10:25 PM

Aura @MOOMANiBE

@lexi5/11/2023, 3:40 PM

this is one of those articles where you think you've hit rock bottom and it just keeps and keeps on getting worse

crnkovic.dev
Testing a new encrypted messaging app's extraordinary claims
How I breached a nonexistent database and found every private key in a 'state-of-the-art' encrypted messenger.
https://crnkovic.dev/testing-converso/ (archived)

#also i wonder if someone will notice the weird thing about this chost #(tagging it like this will make the chance 100%)

Cariad Heather @Cariad5/11/2023, 4:12 PM

Wow. This is worse than Cryptocat. It is also rather impressive for me to be writing that.

Glacier Kitsune @GlacierK5/11/2023, 10:25 PM

I mean when the website of the app tries to imply it has trademarked the future of privacy, its not awfully surprising that its full of vulnerabilities...

Seriously thou, what is it about the correlation between flashy marketing and broken software?

You must log in to comment.

in reply to @lexi's post:

Kay @kaybee5/11/2023, 3:52 PM

YIKES

Sarah @catgirlcock5/11/2023, 3:53 PM

military grade security

Obspogon @obspogon5/11/2023, 3:58 PM

i have a userscript that lets me see the source code of cohost posts and I see what you did there

@lexi5/11/2023, 5:25 PM

it was only a matter of time. i did that because iframely thought it would be a good idea to include one of the last images, showing leaked data, as a thumbnail, which would've spoiled a bit. also, it was 100% handwritten because why not.

@garak5/11/2023, 4:02 PM

a different website by Converso's creator, offering SEO marketing services

In retrospect, perhaps there were warning signs.

Ξ @exerian5/11/2023, 6:35 PM

it's about like the time that ExpressVPN hired a new CEO whose previous job was CEO of a company that produced malware. anyway, ExpressVPN will def sell your data to the highest bidder and then turn around and also sell it to the lowest bidder.

Just Another Apocryphal Mess @apocryphalmess5/11/2023, 4:28 PM

was reloading my cohost tab to come post this. amazing that this just keeps happening

Kran'ts Ton @sudo-EatPant5/11/2023, 4:29 PM

Love at the bottom where (spoilers) they essentially said "yeah we closed off the database" instead of changing all the rest of the stuff wrong with the system. Also love that the first response was "how do we make it so nobody can decompile the apk"

Kran'ts Ton @sudo-EatPant5/11/2023, 4:46 PM

Actually no, they were like "wait how can you look at the code in our app? How did you do that" which is really confidence inspiring. Top security experts are definitely working at that company

ash @hierarchon5/11/2023, 7:36 PM

2023-05-05: Converso asks: "May we know what you do and where you are located? Thank you."

definitely not a thinly veiled legal threat

Kran'ts Ton @sudo-EatPant5/11/2023, 8:49 PM

"Haha thats crazy, what's your legal name and address? We'd love to send you some free converso swag"

rose @rosieposie5/11/2023, 11:58 PM

the first mistake is ever buying or using anything heard from a podcast ad read

jess @ratherforky5/12/2023, 1:52 AM

A relatively small thing compared to the rest of this disaster, but that injection vulnerability is so textbook it's comical

in reply to @Cariad's post:

concoloris @concoloris5/12/2023, 12:59 AM

well that is fucking horrifying

FavoritoHJS @FavoritoHJS5/26/2023, 7:44 AM

that was A Read to be sure.
TLDR:
You totally can do "divide value by 2, if it's greater than 100 try again" to get random base-10 digits without killing speed.
Everyone was asleep at the wheel here... at least they (appeared to) have woken up afterwards, better than most sadly.