Session stores your messages and even your private access key in memory without any real protection.
This means any third-party app on your phone or computer can freely read Session’s memory and extract all your messages plus the private access key for your account. I would never trust an app like Session (with such vulnerability) that is even supposed to be specialized in privacy.
This is a basic vulnerability, if they didn't even notice this, it makes you wonder how many other flaws exist in their infrastructure. (I also wouldn’t trust their Tor routing to be honest)
Demonstration:
Ah btw, even when you delete your messages, they still appear in the memory.
This means any third-party app on your phone or computer can freely read Session’s memory and extract all your messages plus the private access key for your account. I would never trust an app like Session (with such vulnerability) that is even supposed to be specialized in privacy.
This is a basic vulnerability, if they didn't even notice this, it makes you wonder how many other flaws exist in their infrastructure. (I also wouldn’t trust their Tor routing to be honest)
Demonstration:
Ah btw, even when you delete your messages, they still appear in the memory.