Soatok

I started following a fellow cryptography enthusiast who is awesome, he is called Soatok Dreamseeker. https://soatok.blog/ I learned a lot about the furry culture because of him. Furries are outcasts, very often with an LGBTQ identity, and there are fascist furries too. Those groups generally prey on vulnerable people and being a furry is about seeking an emotional connection. Furries are rather weird, but intelligent and interesting people.

> Soatok seems unable to acknowledge that centralisation is a real (privacy, security, reliability, political, …) concern here, nor to see value in the decentralised (federated/P2P) alternative protocols implementing the same double-ratched/PFS crypto primitives. I genuinely do not understand where this impression is coming fron. The only thing I've ever written about this topic acknowledges that centralization has risks, but a perfectly decentralized system that doesn't properly encrypt data end-to-end is bad for user privacy. The cryptography needs to be excellent. "But decentralization" doesn't cut it. https://soatok.blog/2025/07/09/jurisdiction-is-nearly-irrelevant-to-th… Disagreeing with me is one thing, but claiming I seem "unable to acknowledge" anytbing is dishonest.

The problem with XMPP is that most clients use an outdated and insecure implementation of OMEMO. This includes popular clients such as Conversations and Gajim. Currently only Profanity and Kaidan use the latest version and you must always assume that the encryption has been secretly downgraded because the other person is using an insecure client. I highly recommend Soatek's blog post on this topic. https://soatok.blog/2024/08/04/against-xmppomemo/

This is great post about this from Soatok back when visa and Mastercard pulled support from itch and steam in July. https://soatok.blog/2025/07/24/against-the-censorship-of-adult-content…

It is not very secure: https://soatok.blog/2025/01/14/dont-use-session-signal-fork/ https://soatok.blog/2025/01/20/session-round-2/ They also wrote an article about Signal security, worth to read: https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-sign…

My understanding - largely based on this person's blog - is that Signal is the best secure messaging app that exists today: https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-signal-compet…

If you want to read more about cryptographic key wear out, Soatok wrote an excellent explainer on this a few years ago https://soatok.blog/2020/12/24/cryptographic-wear-out-for-symmetric-en…

> Ed25519 is one of the two digital signature algorithms today that use the EdDSA algorithm framework. The other is Ed448, which targets a higher security level (224-bit vs 128-bit) but is also slower and uses SHAKE256 (which is overkill and not great for performance). * https://soatok.blog/2022/05/19/guidance-for-choosing-an-elliptic-curve…

It does exactly what I've been describing! They provide AE, not AEAD. They feed an IV and ciphertext into HMAC. They don't feed additional authenticated data. If someone followed Signal's example, they either wouldn't have AEAD, or they're likely to make the exact mistake described in the post I linked above. I don't know how to be more helpful here. I've been only repeating myself. AEAD modes let you bind a ciphertext to a context without increasing bandwidth. This is super important for database cryptography. Read more: https://soatok.blog/2023/03/01/database-cryptography-fur-the-rest-of-u… Whether "it's not AEAD" matters for an application depends on many factors. Signal doesn't need it.

Two very closely-related exceptions, and a host of very closely-related copycats. Essentially, one problem space which makes up a small (I would say) percentage of the use of cryptography. In terms of daily impact on the lives of random folks, anyway. I never said secp256k1 was depreciated (nor deprecated), I said that I have seen recommendations from people far more knowledgeable than I who say, effectively, don't use it unless forced to interoperate with Bitcoin. For example: https://soatok.blog/2022/05/19/guidance-for-choosing-an-elliptic-curve… The above link, in case you don't want to read through, basically says "use ed25519. If you can't do that, use secp256r1." This tracks with what I have read from others, and with the direction Filo is taking, so I consider it pretty good advice.

https://soatok.blog/2022/01/27/the-controversy-surrounding-hybrid-cryp… Is fantastic because it’s really well written, illustrated, and informative. I find the furry overtones to be fun. I also really like Julia Evans for their breakdowns and notes on investigations. Super well written. https://jvns.ca/blog/2022/04/26/new-zine--how-dns-works-/

You are correct, but to someone new, the phrase sounds like an absolute and probably discourages them from ever trying. A great blog post about this phenomenon is https://soatok.blog/2021/03/04/no-gates-no-keepers/ . For my part, I've met people who have told me to not even try because I need to get a PhD before I even implement crypto. Not design crypto; implement crypto. So while you are correct that it is the mainstream interpretation, that's not how it looks from the outside.

In your PQ safety blanket article https://soatok.blog/2026/04/13/hybrid-constructions-the-post-quantum-s… you make it pretty clear the reason you support hybrid is tactical, not cryptographic. Your wording ("Once Q-Day happens") strongly suggests Q-Day will happen, like, it’s so certain you don’t even need to state it explicitly, you can just assume it will. And your references to the PQ timeline give the impression that you think it will likely happen soon. It’s pretty clear from there that you think ECDH is now technically useless, and the only real justification for hybrid schemes (as opposed to pure PQ), is to reassure the people still unsure about the likes of ML-KEM. Sure you still do recommend going hybrid, but from what I can tell, you would have preferred a world where we go pure PQ right away. And so would I to be honest (if ECC is a bust): one algorithm is simpler and faster than two.

Which is ironic, because my whole point is "if you want to fight it, try to be credible". Every bit of energy spent saying "it's fundamentally not possible to do that, you would have to be stupid to consider it" is, IMHO, wasted. Because what I read is "ok, this person is either not competent to talk about it, or arguing in bad faith, so I won't listen to them". And to be very honest, I can't remember a good argument against "privacy-preserving age verification". It's mostly "hmm I don't like it, that should be the responsibility of the parents anyway". The EFF has a valid point which is "such technology will leave people out who won't be able to access important services". I don't have a definitive stance on it, but that would be worth debating. I can't remember another argument from the EFF. Pretty sure they don't say "it's technically impossible to do". Actually Soatok [1] starts by acknowledging it's possible, before going straight to their opinion: "we should not do it". Again, I think it's a debate worth having. But I won't debate with people who either don't have a clue or downright lie about it, saying "it's not possible, period". [1]: https://soatok.blog/2025/07/31/age-verification-doesnt-need-to-be-a-pr…

This changed about two years ago, when they added usernames. ( https://signal.org/blog/phone-number-privacy-usernames/ ) Signal can still tell law enforcement (1) whether a phone number is registered with Signal, and (2) when that phone number signed up and (3) when it was last active. That's all, and not very concerning to me. To prevent an enumeration attack (e.g. an attacker who adds every phone number to their system contacts), you can also disable discovery my phone number. While Session prevents that, Session lacks forward secrecy. This is very serious- it's silly to compare Session to Signal when Session is flawed in its cryptography. (Details and further reading here https://soatok.blog/2025/01/14/dont-use-session-signal-fork/ ). Session has recently claimed they will be upgrading their cryptography in V2 to be up to Signal's standard (forward secrecy and post-quantum security), but until then, I don't think it's worth considering. I agree that Briar is better, but unfortunately, it can't run on iPhones. I'm in the United States and that excludes 59% of the general population, and about 90% of my generation. It's not at fault of the Briar project, but it's a moot point when I can't use it to talk to people I know.

Doesn't help that all of the major decentralized protocols have been very effectively undermined and pushed aside. GTalk first de-federated (weakening XMPP as a whole), then killed XMPP support completely. Reader effectively killed RSS for casual users. Email has been swallowed whole by the oligopoly of GMail+Yahoo+Outlook+iCloud+etc; spam is a real problem, so if you're self-hosting your email, you kinda expect to be blocked by default by the large networks. Existing, corporate-backed efforts are "open-washing" their services. Signal is supposed to be using an open protocol, but IIRC won't even let you join their network if you use an alt client. Following Twitter's demise, Bluesky popped up, and promised federation. I didn't check in a while - did it happen yet? Actually open networks? Mastodon took off like crazy, but everyone tried to register on the "main", biggest instance - we got bamboozled so hard, we can't even comprehend what "decentralized" is actually supposed to mean. ActivityPub as a protocol? Ted Unangst decided to build his own client from the spec, and was constantly running into Mastodonisms. <https://flak.tedunangst.com/search?q=activitypub> Matrix? It has effectively one client (Element) that isn't a security disaster. <https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/… Anything left, worth of anyone's attention?

> I've literally blogged about tool recommendations before Do you happen to know of a similar resource applicable to common HN deployment scenarios, like regular client-server auth? For example, in your Beyond Bcrypt blog post[0] you seem to propose hand-writing a wrapper around bcrypt as the best option for regular password hashing. Are there any vetted cross-language libraries which take care of this? If one isn't available, should I risk writing my own wrapper, or stick with your proposed scrypt/argon2 parameters[1] instead? Should I perhaps be using some kind of PAKE to authenticate users? The internet is filled with terrible advice ("hash passwords, you can use md5"), outdated advice ("hash passwords, use SHA with a salt"), and incomplete advice ("just use bcrypt") - followed up by people telling you what not to do ("don't use bcrypt - it suffers from truncation and opens you up to DDOS"). But to me as an average programmer, that just leave behind a huge void. Where are the well-vetted batteries-included solutions I can just deploy without having to worry about it? [0]: https://soatok.blog/2024/11/27/beyond-bcrypt/ [1]: https://soatok.blog/2022/12/29/what-we-do-in-the-etc-shadow-cryptograp…

Good job releasing your project! It's a cool idea and surprisingly minimalist. That said, I've found a number of cryptographic flaws in the application source. This should not be used in instances where the encryption is mission-critical. 1) You generate a random key [0] and then feed it into PBKDF2 [1] to generate a 32-byte AES-GCM key. If you can generate 32 random bytes instead of 10 reduced-ASCII characters and a key stretch, just do that. PBKDF2 is for turning a password into a key, and it's far from the recommended algorithm nowadays; prefer scrypt if you need to do this sort of thing. 2) AES-GCM with random 12-byte nonces. Never use random IVs with GCM; this breaks the authentication [2] [3]. Given the pitfalls of AES-GCM with respect to random nonces, you might prefer switching to XSalsa20+Poly1305. The advantage of XSalsa is it has an extended nonce length, so you can use random nonces without fear. 3) Random key derivation with a restricted character set can make brute force attacks easier. You should have a 256-bit random key, and if you want that key to be within a certain character set, then encode the byte output from the CSPRNG using that character set. 4) 1fps achieves symmetric key distribution via a URL with a fragment identifier ("#") which IIRC is not sent to the server. Therefore it assumes you have a secure key distribution channel - the link contains the key, so it's important that only the intended recipient can view the part after the "#". If the…

Ack. Thanks for the points. Un-packing a few things: 3. Definitely — We're working to cut our dependencies in the coming months. Most existing dependencies (the backend at least - I focus more here) we stick to those widely used; there're also certain dependencies directly linked to integrations with third-party platforms (e.g. AWS, Octokit - GitHub, etc.). 4. We'll take a look — This is on our immediate roadmap as well. 5. We actually did evaluate both PKDF2 and Argon2id options in addition to seeing what other secure platforms are doing. We found most to start out with PKDF2 but overtime to introduce support for Argon2id — Take Bitwarden and Dashlane as two examples of this; Bitwarden of which introduced it as of only a few months back. This article may help: https://soatok.blog/2022/12/29/what-we-do-in-the-etc-shadow-cryptograp… The choice of Argon2id KDF is sound and recommended; we have it with memory cost of 64MiB, ops cost of 3, and parallelism of 1. 6. argon2-browser is still used well and reliably throughout the ecosystem — take Bitwarden as the biggest example of a solution recently making the switch to use it. Anyways, happy to move this discussion to email!

You've written about the minimum bar before (https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-signal-compet… Have you written up your Signal criticisms / desired features anywhere? (Or, do you know where anyone else has?) I have my own ideas about requirements, but they're not concrete enough to say "requirements analysis done, let's start programming"; and most people I talk to haven't thought about this enough to be helpful.

No worries, thanks for sharing that post anyway! Another post of yours[1] turned out to be a useful resource for me not too long ago, and the artwork is pretty entertaining. 1: https://soatok.blog/2021/08/20/lobste-rs-password-reset-vulnerability

>The bug is a use-after-free triggered when a TLS connection is handled by GnuTLS Color me surprised. The GNU ecosystem has had more than its fair share of CVEs over the years to the point that it's now a common trope: https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-cryptography/

> OMEMO is built on the same encryption that Signal uses, so I’m comfortable trusting it. I'm not saying that you shouldn't trust OMEMO (we all have our own threat models), but OMEMO and Signal have fewer similarities that people often assume and has some important caveats [0]. [0] https://soatok.blog/2024/08/04/against-xmppomemo/

Bad clients issue stemming from the bad design. Soatok covered it very well here: https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/ I'm quite sure most of these issues were fixed by now, but the fundamental issues remain, at least in this federation.

Session is a low-privacy fork of Signal. source: https://soatok.blog/2025/01/14/dont-use-session-signal-fork/ hn discussion: https://news.ycombinator.com/item?id=42707409

OMEMO has its own flaws too https://soatok.blog/2024/08/04/against-xmppomemo/

You (knowingly?) picked the one counter example, lol. Web of trust is the one application of PGP/GPG for which there isn’t a product ready replacement tool to point towards. GPG is built around web of trust, but this is generally believed to have been a very, very bad idea and the source of innumerable security problems for nearly every application that has tried to make use of it. The GPG replacements I would point to are purpose-built for specific domains and eschew web of trust: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ That said, you might find what you are looking for in the Rebooting Web of Trust project, and the various decentralized identity (DID) implementations that have come out of it: https://www.weboftrust.info/

Recently, this opinionated list of PGP alternatives went around: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ One use case I've not seen covered is sending blobs asynchronously with forward secrecy. Wormhole requires synchronously communicating the password somehow, and Signal requires reasonable buy-in by the recipient. Basically, I'd like to just email sensitive banking and customer data in an encrypted attachment without needing to trust that the recipient will never accidentally leak their encryption key.

This is exactly that, in more detail than you could possibly ever ask for: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

I wouldn't trust Matrix for my personal security: https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/ https://web.archive.org/web/20240606031827/https://gist.github.com/soa…