PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Audit of Session Secure Messaging Application

blog.quarkslab.com | research | #cryptography | #privacy | #audit | #secure-messaging | #session | #oxen
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab audited Session, the Signal-forked secure messenger by Oxen, reviewing its Android, iOS and desktop apps and its onion-routing cryptography; all findings were patched during the audit.
Published
Collected

Related coverage

vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
blog · blog.trailofbits.com
How Trail of Bits helps verify the integrity of your Signal chats
Trail of Bits explains Signal's Automatic Key Verification key-transparency system and describes the independent auditor it operates, one of three signers that make server key substitution detectable.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · blog.quarkslab.com
Triple Threat: Signal's Ratchet Goes Post-Quantum
Quarkslab examines Signal's new Sparse Post Quantum Ratchet (SPQR): how it piggybacks on ML-KEM to add post-quantum security to message-key derivation alongside the existing double ratchet.
research · blog.quarkslab.com
Make Confide great again? No, we cannot
Assessment of Confide: modifying its Electron client and inspecting TLS traffic shows the server can read messages via man-in-the-middle; anti-screenshot and deletion features can also be defeated.
research · blog.quarkslab.com
Security assessment of instant messaging app ChatSecure: when privacy matters
Quarkslab's assessment of the iOS ChatSecure messenger for OpenITP: three researchers spent about 20 days probing cryptography, XML fuzzing and app security of version 2.2 for information leaks.
Back