> Cryptography nerds should NOT be finding the software that activists trust with their privacy hilarious.

This is very much true. Why in the world would session do the things they listed unless it really was just a state actor trying to get something in place to snoop on people.

Glad to see someone looking into the actual security of this application finally. I couldn't find any information like this when I first heard of it.

The primary (maybe only) appeal of this app seems to be the lack of a phone number requirement. Consequently, you can run a desktop version without also having a phone.

I'm not familiar with cryptography enough to know whether these arguments make sense, but if they do, this is really damning. That's a series of intentional, unnecessary changes that each massively weaken the protocol's security...

The site is returning just a JSON response of the blog post for me. Can't view the content directly.

[flagged]