oh lmao i didn't realise, the repository itself is populated though which is funny

#infosec #cybersec i think

contact page denies access so rip disclosure

fair, i guess for cases where an attacker can only observe the network noise really makes the timing leaks much less helpful

the plot thickens...

thank you so much!

i feel like i came across unencrypted Chat messages as i looked into the app, but it is likely that those ended up being a different packet type and that the app just always encrypts "Chat" messages everytime. it might have been an attempt of having security perhaps

i don't know too much abt it personally. there was a case of qq browser being scrutinized for using non-cryptographic PRNG before. and looking into wechat there does seem to be another proprietary protocol but at a quick glance backed by actual cryptography

thank you so much for helping me get this out there 😭
this means the world to me

yep, the encryption pretty much acts more as obfuscation than encryption and you can even end up authenticating with this API without needing to know the encryption is a thing that happens.

the authentication is always in plaintext and you can then just find the "send message" proto and send one