What is Reddit's opinion of
SureSpot?
From 3.5 billion Reddit comments
17 reviews of this app found across Reddit:
If you read the "How It Works" for SureSpot it is obvious that the server can MITM users on demand.
> MITM is currently thwarted by the following: > > - standard SSL implementation. > - When a user is created and its public keys uploaded to the server, the server signs the public keys. Clients that download the public key then validate the signature of the key against the hardcoded server public key in the client. This ensures a MITM attack trying to use a rogue key pair to impersonate a user will be prevented.
and
> * adam wants to send cherie a message > * adam asks the server for the latest version of cherie's public key > * adam verifies cherie's public key (which is signed by the server) against the hard coded server public key in the app and proceeds if valid
Does anyone who uses SureSpot know if it even tells a user when keys are updated?
surespot is pretty great. And the devs are responsive, which makes me hopeful for the future of the app.
(A guide for properly setting it up, if you need one.)
I've been using surespot since the early days and it's a fantastic app. Simple even for the non-technical - I use it with my Mom. I've been beta testing the iOS version and it's even better than Android. Watch for it in the app store any day now. And toss a donation to the developers, they're doing it for all of us!
According to their description of the protocol there is no forward or reverse security. If a key is discreetly copied, all messages can be read. Signal uses a different key for every message
There have also been no updates to the Android client since April 2019 so it seems like a dead project.
Where have you seen word of it being fixed? It's still listed as a threat on their threat page and the possible mitigation is still listed as not implemented.
If you read the "How It Works" for SureSpot it is obvious that the server can MITM users on demand.
> MITM is currently thwarted by the following: > > - standard SSL implementation. > - When a user is created and its public keys uploaded to the server, the server signs the public keys. Clients that download the public key then validate the signature of the key against the hardcoded server public key in the client. This ensures a MITM attack trying to use a rogue key pair to impersonate a user will be prevented.
and
> * adam wants to send cherie a message > * adam asks the server for the latest version of cherie's public key > * adam verifies cherie's public key (which is signed by the server) against the hard coded server public key in the app and proceeds if valid
Does anyone who uses SureSpot know if it even tells a user when keys are updated?
I consider surespot the best alternative in terms of security.
The fact that it is open source is a big plus for me so we (the community) can verify what they are actually doing with our data.
I've been checking out surespot as IM alternative. No mobile number required. Just a centralised DB for public key verification. A strong private key is generated on the client side.
Surespot is open source. I wouldn't recommend it at all because I haven't seen an audit and there's no forward secrecy (so not very modern).
Further, look at the amount of data they store: https://www.surespot.me/documents/threat.html
They also have made some strange choices of which curves to use: https://github.com/surespot/android/issues/28
Been hearing these Surespot rumors for a while now.
From their website:
>100% open source
>It is not magic, it is all software code. surespot encrypted messenger put every bit of it's code up on display for the world to review, scrutinize, contribute to and even use. Be assured that surespot does exactly what it says it does.
This is all I could find:
>In theory, the fact that Surespot uses end-to-end encryption should make it impossible to spy on users’ communications, even if 3fours has indeed been compromised. The app’s failure to implement Perfect Forward Secrecy might provide a way to decrypt users’ messages, however, and the amount of metadata stored on the Surespot database could provide an adversary with valuable clues about users’ identities.
>If we were worried about our communications being spied on, we might be tempted to look elsewhere for a secure messaging app…
Surespot. https://www.surespot.me
Free text/picture/voice (voice upgrade is a one time $2 fee) client. Open source, end to end encryption, screenshots disabled, messages can be deleted at any time on both ends by either party, is not connected to your phone number or email. Anyone that values privacy should have this.
I find it interesting they recommend Cryptocat when I've been told that's not secure either because it's mostly coded by one guy who has had trojans put on his computer in the past, in some /r/privacy thread from a while back. And as far as I am aware, group chats in Cryptocat use custom crypto too, only two person chats use a standard, OTR. Also, I'm reading the article you linked, and it's exploiting a third party client which did not follow the standards set by Telegram rather than any official client.
I wouldn't call Telegram secure myself purely because it stores all your conversations on their servers and even if both participants delete the threads you're basically relying on the Telegram team being honest in removing them from the servers.
That said, as far as the data on servers goes, this thing is Russian. ~~While the Russian government may very well look at the data stored~~ [edit: the company isn't even based in Russia, so even this isn't a concern], we can also be pretty sure they won't let the NSA or GCHQ in either unlike WhatsApp (now it's owned by Facebook) and pretty much every social media platform.
Anyway, I'd be interested in seeing how secure Surespot really is.
Meine Empfehlung im Moment ist SureSpot, bis Whisper von Whispersystems kommt (was noch ein bisschen dauern kann)...
Gibt langsam leider auch wieder ZU viele konkurrierende Apps. :/
https://www.surespot.me/ Open-source, end-to-end encryption, Nachrichten können auch wieder gelöscht werden (so dass sie auch beim Empfänger wieder verschwinden), kein Bezug zu Handynr oder Emailadresse, keine Werbung, kostenlos.