Hacker News Reader

Comment by MichaelGG | Hacker News Reader

It'd be nice to see the fake tech journalists/reviewers issue a retraction, or even Google Play get involved as this is rather much like fraud.

And also, what does the developer even gain from using XOR? In most common frameworks, using, perhaps incorrectly, AES is about the same effort.

View on HN

I could understand this being a tough position from google's perspective. When talking about how secure something is, one has to consider the threat model - there is not absolute. If the goal is to keep naughty pictures confidential from one's mother - this may indeed be "secure" enough for that situation. Keeping blackmail photos safe from a nation state on the other hand, likely not.

I do not think that we currently have a good way as product creators to specify what secure actually means - and what is more - our customers won't understand the nuance either.

This is in no way trying to excuse passing this "encryption" scheme off as secure.

XOR is the appropriate operation if you're using a stream cipher to generate an arbitrarily long keystream. Or a one-time pad. It also makes random access a lot simpler.

Of course, you do actually need to generate that keystream and not just repeat a short key.

There are very few cases where you should be doing encryption without authentication... and as soon as you're doing authentication you'll be doing more than just xoring with a stream cipher output. :)

I believe they might have done it this way so they can claim 'encrypts a 100gb file in under 100ms!' or something equally dumb.

It is a Chinese company, so it isn't beyond belief that the Chinese government asked them to make the encryption "reversible" and doing it correctly was behind their technical know-how.

I don't know if this falls under fraud. It is a form of encryption, albeit minimal to a ridiculous degree.

Reply on news.ycombinator.com