Hacker News Reader

The crypto appears to be fairly standard - it uses NaCl's crypto_box to encrypt and decrypt almost everything, with a per-session keypair authenticated by the user's long-term key. Code quality is a bit OpenSSL-esque though.

And, in fact, as any other piece of software.

Nothing about what you just said makes sense.

How so?

I think he is probably referring to these discussions:

- https://github.com/irungentoo/toxcore/issues/121

- https://github.com/irungentoo/toxcore/issues/578

where the devs are quite defensive about their choices to (1) reinvent the wheel (2) use technologies that are (according to the comments) not secure (3) not audit their proposed crypto/security architecture by experts.