this is one of those articles where you think you've hit rock bottom and it just keeps and keeps on getting worse
crnkovic.dev
Testing a new encrypted messaging app's extraordinary claims
How I breached a nonexistent database and found every private key in a 'state-of-the-art' encrypted messenger.
https://crnkovic.dev/testing-converso/ (archived)
Wow. This is worse than Cryptocat. It is also rather impressive for me to be writing that.
i have a userscript that lets me see the source code of cohost posts and I see what you did there
it was only a matter of time. i did that because iframely thought it would be a good idea to include one of the last images, showing leaked data, as a thumbnail, which would've spoiled a bit. also, it was 100% handwritten because why not.
a different website by Converso's creator, offering SEO marketing services
In retrospect, perhaps there were warning signs.
it's about like the time that ExpressVPN hired a new CEO whose previous job was CEO of a company that produced malware. anyway, ExpressVPN will def sell your data to the highest bidder and then turn around and also sell it to the lowest bidder.
was reloading my cohost tab to come post this. amazing that this just keeps happening
Love at the bottom where (spoilers) they essentially said "yeah we closed off the database" instead of changing all the rest of the stuff wrong with the system. Also love that the first response was "how do we make it so nobody can decompile the apk"
Actually no, they were like "wait how can you look at the code in our app? How did you do that" which is really confidence inspiring. Top security experts are definitely working at that company
2023-05-05: Converso asks: "May we know what you do and where you are located? Thank you."
definitely not a thinly veiled legal threat
"Haha thats crazy, what's your legal name and address? We'd love to send you some free converso swag"
the first mistake is ever buying or using anything heard from a podcast ad read
A relatively small thing compared to the rest of this disaster, but that injection vulnerability is so textbook it's comical
that was A Read to be sure.
TLDR:
You totally can do "divide value by 2, if it's greater than 100 try again" to get random base-10 digits without killing speed.
Everyone was asleep at the wheel here... at least they (appeared to) have woken up afterwards, better than most sadly.
