* No discussion of how key exchange problem is solved
* Makes misleading security claims "when you delete a sent message it will be removed from the receivers phone"
Basically falls into "don't touch with a barge pole" category of crypto software.
Crypto software isn't a category where you can make it up as you go along, it has to be designed upfront with a set of security considerations for it to have a chance of survival in the real world.
To understand the standard approaches to threat modelling.
It should be trivial for someone to look at the documentation and quickly answer basic security questions like "Does it defend against replay attacks ?" and "Does it leak message size ?"
Comments
First impression:
* No details of threat model
* No details of crypto protocols used
* No discussion of how key exchange problem is solved
* Makes misleading security claims "when you delete a sent message it will be removed from the receivers phone"
Basically falls into "don't touch with a barge pole" category of crypto software.
Crypto software isn't a category where you can make it up as you go along, it has to be designed upfront with a set of security considerations for it to have a chance of survival in the real world.
Perhaps you can get a second impression-
details of threat model- https://www.surespot.me/documents/threat.html
details of how surespot works including crypto- https://www.surespot.me/documents/how_surespot_works.html
you can always review the code on GitHub- https://github.com/surespot/android
You should have a look at:
https://www.owasp.org/index.php/Threat_Risk_Modeling
To understand the standard approaches to threat modelling.
It should be trivial for someone to look at the documentation and quickly answer basic security questions like "Does it defend against replay attacks ?" and "Does it leak message size ?"