But wait – it gets much, much worse
As I was finishing up the above post, I noticed something a little strange in the code – something I’d glossed over earlier. There are a ton of references to what looks to be functions related to Google’s #Firestore database.
is the databag protocol/design documented somewhere? does it claim to have forward secrecy?
from a quick glance I see here they’re generating an AES key from a passphrase and using it to encrypt an RSA private key, which is… not a good sign.
fwiw https://simplex.chat is another thing which seems to have similar goals and functionality but is better documented.