Popular Android Package Uses Just XOR -- and That's Not the Worst Part

siddesu writes A popular "encryption" package for Android that even charges a yearly subscription fee of $8 actually does nothing more than give a false sense of security to its users. Not only is the app using a worthless encryption method, it also uses weak keys and "encrypts" only a small portion of the files. One wonders how much snake oil flows through the app stores, from "battery savers" to "antivirus." What is the most worthless app purchase you made? Did you ask for a refund?

Comments

Web sites

[danbob999]

CTIA - "The Best App of CTIA by the Techlicious 2012 Best of CTIA Awards"
PC Magazine - "PC Magazine Best Apps"
TRUSTe - Received "TRUSTe Privacy Seal"
Global Mobile Internet Conference App Space - "A top 50 app"

Thanks, I will take a note to never trust these web site reviews.

Re:Web sites

[AmiMoJo]

Maybe they read the actual description of the app. The only thing it claims to encrypt is text messages, which TFA doesn't bother to check. The description doesn't claim to encrypt files, so unless it has been changed since the article was written it seems to be making stuff up to complain about.

The app hides files on your device. It does that by using a simple XOR cypher to encrypt the header of files and make them invisible to apps like the Gallery that look for files with valid JPEG/PNG/GIF headers. It works perfectly, the XOR cypher has the desired effect. Obviously it won't stop forensic examination from finding and decrypting the files, but it doesn't claim to. It's an app designed to hide your nude selfies and dick pics, not stops the NSA/GCHQ dataraping your phone.

XOR encyption is uncrackable as long as...

[pcritter]

There's nothing wrong with XOR for encryption as long as your key size is >= plain text size. In fact it's uncrackable!

Re:XOR encyption is uncrackable as long as...

[Anonymous Coward]

And you NEVER reuse that key.

DMCA

[martin-boundary]

I think Slashdot should take down this article. Under the DMCA it's illegal to bypass flimsy methods intended to enforce security.

Re:The big advantage of XOR

[swillden]

If the key is as long as the message, XOR is not that weak.

As long as the key is as long as the message, and all of the key is unpredictable, and is never reused, then you have a provably unbreakable encryption system called a one-time pad. However, if you ever reuse the key someone can XOR the two ciphertexts together and the result will be the XOR of the two plaintexts, which can often be disentangled. Also, if the key is somewhat predictable, plaintext can be recovered. The US actually managed to decrypt some texts encrypted with a Russian one-time pad system, because the keys were produced by humans pounding "randomly" on typewriters... except humans aren't very good at generating random keystreams.

Re:The big advantage of XOR

[Beryllium Sphere(tm)]

And what data structure do you have lying around at encryption time that's as long as the plaintext?

That's right, the plaintext. Use that as your one time pad. It saves you the headache of generating high-quality randomness if you just XOR the plaintext with itself.

The resulting ciphertext is not only theoretically unbreakable without the key, it is also highly compressible for economical transmission.

"XOR"? WTF? This thing is a "Vigenère cipher"

[gweihir]

You could at least have some minimal accuracy in the stories. XOR is not a problem and perfectly secure if used with a secure key-stream, like is done in modern stream ciphers. The problem here is that this is a "Vigenère cipher", where a very short, repeating key-stream is used. It was designed in 1553 and a general break was published in 1863.