Testing a new encrypted messaging app's extraordinary claims | Hacker News Reader

Testing a new encrypted messaging app's extraordinary claims

crnkovic.dev

199 pointscrnkovic36 comments

This is my absolute favourite kind of post on HN. It's got everything; intrigue, mystery, scandal and of course heavy on the technical side too. All packaged up in a compelling narrative.

Thanks! I'm glad you found it as interesting and thrilling as I did while discovering each (exponentially worse) mistake.

Agreed! Additional bonus points for calling snake oil out.

There is software that lives up to these claims, it's Tinfoil Chat. The article is correct about the necessary trade-offs: due to peer to peer transport (onion hidden service 2 onion hidden service) both ends of the conversation have to be online -- it at least spools the message waiting for the recipient to appear.

For hole punching and signaling that has to be done by third party, well, the third party is TOR

TFC then goes on to break out the encryption and decryption machines from the network and passes messaging over opto-couplers to prevent your keys from getting exfiltrated. Qubes qrexec could similarly isolate the components.

https://github.com/maqp/tfc

The problem with these tools is that they're extremely complicated to set up and use. Grandma wants a phone number, not a v3 Tor Onion Service address.

I'm interested in usable E2EE messaging apps -- that's what I compared Converso to. Whatever this is (I will read the docs some day) is in another realm.

Definitely - adding contacts in TFC is an unreasonable burden, cannot copy paste addresses into the source machine, 56-character tor addresses have to be typed in manually, followed by the recipients' public key.

My goodness what are they even planning to patent? Seald SDK? Ract native? Firestone? RSA? The app does nothing, LOL.

They’re probably just stalling for time, and they can blame the patent office

Who knows!

If memory serves, I was once told by an IP lawyer that during the time period when you have a patent pending (regardless of merit) some unscrupulous types then leverage that face to juice their valuation to potential investors.

Ooooh makes sense.

IMO you should consider putting Converso in the title of your blog post so that it shows up when people Google, as a warning.

I just checked and your blog post does not come up in the results for Converso.

I had this same thought. The problems with this app are serious enough to be a danger for certain people who might rely on it (journalists for example)

ironically this showed up when i googled Converso

great!

A quick search after the CEO turns out, the man is a genius: "Tanner Haas, who is an M.I.T. drop out" was a human health specialist in 2020: https://londondailypost.com/this-denver-based-startup-aims-t... ...now he is a crypto expert.

There is more: https://revealaitests.com/pages/about-us

> 2023-05-05: Converso asks: "May we know what you do and where you are located? Thank you."

What are you, a cop?

"Can we sue you, or are you subject to prosecution under the CFAA? Thanks."

How incompetent you have to be to ask "How were you able to decompile the source code of the app" after reading this post?

> 2023-05-05: Converso asks: "How were you able to decompile the source code of the app...?"

Seriously? What the fish?!

This is so incredibly bad. I’m stunned.

Great investigative blog post!

Tldr; Do not under any circumstances use or recommend “Converso”.

Thank you! Glad you enjoyed it.

Amazing.

Have you by chance looked at the new update? Not that anyone should ever use this app in the first place, but I'm curious whether the massive vulnerability you discovered was fixed.

> whether the massive vulnerability you discovered was fixed.

Which massive vulnerability in particular? You'll have to be more specific, haha.

I confirmed the Firestore collections had some kind of server-side security rules added before publishing the post.

Yes that’s the biggest issue.

The other one is seald MITM, which they probably won’t know how to fix, IMO.

This was an article about the app [0].

"Man Creates Messaging App FBI Can't Crack and Anyone Can Download, Stopped at Airport Days Later"

I would just use SimpleX tbh [1]

[0]https://www.westernjournal.com/man-creates-messaging-app-fbi...

[1] https://simplex.chat

First link:

> This article was sponsored by Converso.

It's actually kind of sad to see people actually using this and believing in the claims being made. And this is all supported by Google who, frankly, should be denying service to what should be considered spyware. I mean, I swear this type of app used to be considered spyware...

It seems these days if your data ends up on a server that's A-ok! With all the talk on HN about the "GDPR" it sure seems like an absolute failure - where's the QC from Google looking at the code and proactively doing something about the real, potential harm that can come from this? It really seems if you want to harvest user data you can whip together an app that looks and feels okay, but behind the scenes is designed to do nothing but collect your data for whatever nefarious purpose the developer has in mind - and this is all 100% legal and the chances are whoever was involved will not even get so much as a fine!

Now there's an app that openly collects user data and is publishing it as a matter of public record, consequences be damned.

Android and Google need to take responsibility here and use Play Protect to treat the app as harmful and to better shield users.

This is an excellent write-up and investigation which is something Google should be doing to expose the dangers of their own platforms - hacking together a few API's/SDK's to mass harvest user data is absolutely not okay. Frankly, they should be legally mandated to review these apps in depth, and be provided full, unobfuscated source code, along with a detailed network-map of all URL's the app accesses, API keys etc and should approve (similar to Apple) before Android allows it to be used. If you install it outside of the app-store a very strong warning should be in place to let users know of potential spy/malware

I also discovered this app is actually on the play store [1]! And the app data safety says "No data shared with third parties Learn more about how developers declare sharing". It's an absolute JOKE this is not being enforced by Google at all. Shame on them.

I believe Mozilla did an investigation and found most apps are outright LYING about their "data safety" so that feature is beyond useless when Google doesn't actively moderate it.

[1]: https://play.google.com/store/apps/details?id=com.conversoap...

Wow what a read. Best read I’ve had in months.

Glad you enjoyed it.

I wonder if there might be grounds for any users to sue based on the publishing of their personal data online and misrepresentation of the product and its security features.

This is so embarrassing. How can they even attempt to exist after this?

This big question — who is paying to develop this terrible app and why? Do they know it’s terrible?

Love these articles such as this OP where the concept is ripped apart and identified as snake-oil.

Good job, keep it up.

You should use conversations. I guess it's best and open-source also. Now getting some major overhaul

You are doing God's work, sir.

Reply on news.ycombinator.com