Slashdot Mirror

← Back to Stories (view on slashdot.org)

Popular Android Package Uses Just XOR -- and That's Not the Worst Part

Posted by timothy on from the ightray-onyay-ethay-urfacesay dept.

siddesu writes A popular "encryption" package for Android that even charges a yearly subscription fee of $8 actually does nothing more than give a false sense of security to its users. Not only is the app using a worthless encryption method, it also uses weak keys and "encrypts" only a small portion of the files. One wonders how much snake oil flows through the app stores, from "battery savers" to "antivirus." What is the most worthless app purchase you made? Did you ask for a refund?

5 of 277 comments (clear)

  1. Web sites by danbob999 · · Score: 5, Insightful

    CTIA - "The Best App of CTIA by the Techlicious 2012 Best of CTIA Awards"
    PC Magazine - "PC Magazine Best Apps"
    TRUSTe - Received "TRUSTe Privacy Seal"
    Global Mobile Internet Conference App Space - "A top 50 app"

    Thanks, I will take a note to never trust these web site reviews.

    1. Re:Web sites by Darinbob · · Score: 4, Insightful

      People will gladly give good reviews to things they haven't even tried out yet. And even if they tried it they probably have no clue how to validate its effectiveness. It's the yelp effect, let someone give a review and they'll jump on board and proclaim "best broccoli beef ever".

  2. Re:The big advantage of XOR by hcs_$reboot · · Score: 4, Insightful

    If the key is as long as the message, XOR is not that weak.

    --
    Slashdot, fix the reply notifications... You won't get away with it...
  3. Re:DMCA by Anonymous Coward · · Score: 2, Insightful

    you are modded funny, but the sad thing is your post is actually informative.

  4. Re:XOR is useless by Jane+Q.+Public · · Score: 3, Insightful

    XOR is much much faster than your run-of-the-mill encryption algorithm.

    OP and TFA are very misleading. XOR is not a "worthless" encryption method in itself... it all depends on how it is used.

    For example, if used with a good quality key in a one-time pad, it is one of the few encryption methods that is even theoretically unbreakable.

    But it does require a well-constructed key, and as with any one-time-pad scheme, key management is everything.