angela Session doesn't require a phone number and doesn't consolidate everything of AWS servers. Winner: Session, even with slightly weaker encryption.
K8y Maybe sessions 128 is good enough...
That is the question here I think. If it indeed is 128 bit security like Session claims, it would be secure enough, even if it is a downgrade compared to Signal protocol. However, if it is 64 bit security like the security researcher claimed, and my teacher in cryptography told us as a rule of thumb, then it is not secure enough, as 64 bit security is trivial to break for anyone with a decent computer. Which we can assume all state actors and other possible enemies have.
K8y If a city builds a 50 meter high wall surrounding it, then another builds theirs 65 meters high does it really mean the first city is subverting its security?
This analogy doesn't hold. When we say it is 64 bit security, we mean it takes 264 effort to break the security. If we say 128 bit security, we mean it takes 2128 effort to break the security. That is 128-bit security is 20,000,000,000,000,000,000 times harder to break. Hopefully then you understand why those bits of security really matters. In your analogy, it would be a wall that is that many times taller.
K8y However are there any experts here that can see things from Sessions point of view? Like play Devil's advocate...
We would need an actual cryptographic expert to state an opinion about this, and explain why. It is very rare to come across someone that actually understands cryptography to the degree where they can design, analyze and break the security of cryptographic algorithms. And yet, it is a person with that knowledge that must state whether what Session is doing is actually secure. Ideally, Session wouldn't even have deviated from known secure constructs to begin with, but they insist on doing that, and that is what makes everyone so anxious or outright skeptical.