Crypho – Encrypted enterprise messaging

But... but... they say "Crypho is used by financial institutions, journalists, lawyers, software companies and human rights activists in more than 70 countries." The same thing the rest of the unproven companies tell us. That people believed the salespeople is certainly a good sign, right? I imagine at least one of them was serious enough to ask questions until the C-level executives themselves stepped in to give them personal assurance of the security.

"That's the kind of [paid, personal] assurance you can count on [to make someone else money]." (TM)

I would have expected to see at least some of their source code on Github (https://github.com/Crypho), especially the client-side where the private key and passphrase are handled (as described at https://www.crypho.com/security.html). Without being able to inspect the source, why should anyone trust this company more than, say, Google or Facebook?

Hey, I used to work with their CTO! Hopefully he'll respond himself, but in case he doesn't:

> (384-bit prime) - Why not just use X448 since that's now an Internet Standard?

I believe they started working before X448 was standardized.

> It also uses Fortuna for IVs, etc. instead of directly /dev/urandom (or window.crypto in JS land). Userspace CSPRNGs are a devastatingly stupid idea.

IE doesn't have great support for window.crypto. If you're building an enterprise product, you probably care about this.

> FUD. Where you host the data shouldn't matter, because the server should never be given access to your plaintext.

I believe their point here was that most cloud services today DO have access to your plaintext. It's not FUD if it's true =).

I know I'm a bit biased, but these guys are pretty smart, and I'd trust them.

Ricochet looks interesting (https://ricochet.im/), but can it scale with TOR as the means of transport?

As much as I like the notion of anonymous communication, I wonder if the TOR network can grow beyond its current state in order to be used reliably for this type of service. From what I understand, TOR needs lots of independent exit nodes to offer dependable anonymity and have enough bandwidth, but running an exit node seems to open you up to serious legal consequences because of content passing through it that may be illegal in your jurisdiction. Doesn't that rule out normal consumers running an exit node at home?