Mastodawn

This is insane: TeleGuard, a 'secure' chat app downloaded more than a million times, uploads users' private keys, meaning the company can decrypt messages. And anyone can get anyone else's private key by just sending the user ID to the API. Possibly worst ever https://www.404media.co/a-secure-chat-apps-encryption-is-so-bad-it-is-meaningless/

A Secure Chat App’s Encryption Is So Bad It Is ‘Meaningless’

TeleGuard is an app downloaded more a million times that markets itself as a secure way to chat. The app uploads users’ private keys to the company’s server, and makes decryption of messages trivial.

404 Media

Show thread

Bill 3d ago

@josephcox Let me guess. It was vibe coded, right?

Show thread

Stĳn van Drongelen 3d ago

@Sempf @josephcox It launched in 2021, so perhaps a bit too soon for that.

Show thread

Bill

@stiiin @josephcox You are probably right.

That said, I cut code using OpenAI in 2021 with the API, and it worked but was bad enough that I still stand by what I said. Or maybe it was old fashioned bad architecture - that is more likely.