Security issues?

[bohwaz]

Code of conduct

• I have read and agree to adhere to the Code of Conduct

Self-training on how to write a bug report

• I have learned how to write a bug report

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Hi there are some security issues raised here:
https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

I haven't seen any other way to get these to the developers.

Expected Behavior

Steps To Reproduce

Desktop Version

Anything else?

[KeeJef]

We've written up a full response here. In short, no these are not security issues. All of the "flaws" presented by the researcher are either plainly incorrect or misunderstandings of Session code or cryptography.

[soatok]

We've written up a full response here. In short, no these are not security issues. All of the "flaws" presented by the researcher are either plainly incorrect or misunderstandings of Session code or cryptography.

EXTREMELY LOUD INCORRECT BUZZER

https://soatok.blog/2025/01/20/session-round-2/

[KeeJef]

We've written up a full response here. In short, no these are not security issues. All of the "flaws" presented by the researcher are either plainly incorrect or misunderstandings of Session code or cryptography.

EXTREMELY LOUD INCORRECT BUZZER

https://soatok.blog/2025/01/20/session-round-2/

We have now updated our original blog post with a response to the PoC provided by the security researcher here https://getsession.org/blog/a-response-to-recent-claims-about-sessions-security-architecture . In short

• The approach implemented in the PoC by the security researcher does not achieve any reduction in security for individual Session accounts. If attacking a single account, the proposed approach offers no advantage versus a traditional brute force attack against a 128 bit key, something which is impossible given current computing technology.
• The security researchers PoC for a multi-target attack performs worse than a common benchmark algorithm for this type of attack, called a linear search.
• When calculating a worst-case scenario for a multi-target attack on Session using linear search, we find that on average it would cost tens of thousands of times more power than the entire planet consumes in one year to compromize even a single random Session account out of 4 Billion + accounts—even when the parameters for such an attack are set very favorably for the attacker.
• Given this Session Accounts remain secure against both specific and targeted attacks and multi-target or batch attacks.