Jami calls itself "ultimate privacy and control for your voice, video and chat communications". But forums online mentioned in passing (little depth) that it uses bad cryptography protocols and has messy source code. What exactly is insecure about its architecture and why are those aspects issues?
It does not look like they offer perfect forward security for either voice or chat conversations. ... They are not using a protocol like OTR or Axolotl that is designed for real time communications. ... Their description of their encryption confirms my concerns. They are not using a protocol like ZRTP to prevent MITM attacks. (link)
... other software, such as WhatsApp, Ring, ChatSecure, and Signal are not secure than you think. ... "Ring" is using SIP protocol, which is very old and not P2P friendly. They claimed it as a "decentralized" software, and it's bulls***. (link)
Ring, on the other hand seems to want to use "established standards", which are full of loopholes that strip out security.
This does not reflect reality of secure protocols, and actual security experts typically consider "DIY security" dangerous and rely on established primitives or even protocols. (link)
Greetings, Ring developer here. Ring is a distributed communication platform, its nodes are part of a DHT network, so their IP is indeed exposed. (link)
They support crypto that is considered to be broken. https://en.wikipedia.org/wiki/POODLE Also they're patching their crypto lib – there's something deeply wrong if you have to patch the crypto lib you're using.. And no, it's not about patches itself, but about "how broken is your crypto lib, so that you have to patch it?" – ring-daemon @ 8ca874d790be92649187aabcb55fa998dae045df I'd look more into stuff, but the more I looked the worse it got. Not comparable to Tox at all.
(…) it takes a slightly different approach from Tox's by building not only on established cryptographic libraries, but also on established protocols. If that's enough (as it's being made to appear) to make it unsound security-wise... well, to put it simply, it is not enough.
Isn't it build on top of broken stuff? Namely, TLS/SSL. ... It's a matter of complexity – the more complex something is to work with, the more bugs there will be as a result. Using something as complex as TLS/SSL really helps to have buggy crypto code. IMO anything using SSL/TLS is going to be broken, be it sooner or later. One of reasons why Tox uses NaCl/libsodium. (link)
SIP protocol, which is very old and not P2P friendly
- SIP is by definition a P2P protocol so I would take at least some of those comments with a pinch of salt.