dinodaizovi

Hello! I'm the author of this tool.

That quote is from the data forensics report on Bezos' phone, so the missing context was them stating that even with a full logical file data acquisition, they couldn't decrypt the .enc file. That is what inspired me to write this tool to demonstrate how end-to-end encryption is only impossible to decrypt by intermediate hosts, it's very possible with full access to the filesystem of one of the endpoints.

I could likely make that part of the README clearer by adding more context from the original forensics report that was published.

Thanks!

-Dino

It definitely does take a considerable amount of work to get proficient to that level and even more to develop the intuition of where to look. It must be stated, however, that the authors of these blog posts are not attackers. They are proactively finding and demonstrating where software already in common use could be exploited by attackers.

Just like how research into cryptanalysis strengthens cryptography for everybody, research into software vulnerabilities and exploitation strengthens software security for everybody.

As a researcher, it's always safer to only test online services that have a bounty program and/or researcher amnesty program in place. By virtue of having those programs, however, those companies are demonstrating a certain level of information security maturity. If your interest is in warning users of risks to their privacy, the greatest risks to it are most often found in companies who haven't quite gotten there yet. By finding the issues and reporting them to the company, they may spur them to improve. If the company is unresponsive, disclosing the issues publicly instead may motivate them to respond. We don't want that response to be a lawsuit or criminal charges when the researcher is performing a public service.

Security researchers try to call attention to security and privacy risks early. They aren't always right, but even when they're wrong, it's still beneficial for the rest of us to have them sounding their warning calls.