Conversation

Encrypted messenger billed as better than Signal is riddled with vulnerabilities

This is a cautionary tale for anyone who works with crypto (as in cryptography). When you spin out your own protocols, you have a high chance of getting a critical part of it wrong. In the case of Threema, an app that's mandated for use by the Swiss Army and used by many other high-profile organizations in Euope, it got several critical parts wrong.

Remember: don't roll your own crypto.

Threema's case is aggravated by the unusually bold security claims it made. Pride comes before the fall, I suppose.

https://arstechnica.com/information-technology/2023/01/messenger-billed-as-better-than-signal-is-riddled-with-vulnerabilities/