A Secure Chat App’s Encryption Is So Bad It Is ‘Meaningless’

TeleGuard is an app downloaded more a million times that markets itself as a secure way to chat. The app uploads users’ private keys to the company’s server, and makes decryption of messages trivial.

404 Media
@soatok I don't have access to read that fully, but holy shit, it sounds bad, really goddamn bad lol

@soatok this is far worse than I thought even possible. I thought it'd stop somewhere reasonable, but nope, it kept going. And sure, this app is bad, horrible and so on, but also look at this paragraph from the article

Often when implementing encrypted messages, apps will assign users a public and private key. The public key is what other users use to encrypt messages for them, and the private key is what a user uses to decrypt messages meant for them.

I'm not a cryptography expert by any means and I get that simplification is sometimes useful, but this is a horrible way of describing end to end encryption to anyone, especially since the audience of this publication is often tech related from what I know. This is just wrong, I actually have no idea if anyone built an app which encrypts and decrypts all your messages with a single keypair in the last decade. I mean, maybe for pgp setups perhaps, but I thought we're past explaining encryption like it's the 90s, the only good available encryption is pgp and telling people that actually, having very long-term keys is a good thing.