I'm aware that Session has been discussed twice before on this community, but the last thread was 6 months old so excuse my starting a new one.
There's one big concern I wanted to bring up, which is the disagreements over whether it has forward secrecy. The spec says it does, but I've found two other sources saying it doesn't:
https://restoreprivacy.com/secure-encrypted-messaging-apps/session/ (search for "Perfect Forward Secrecy removed") https://www.securemessagingapps.com
Why are they saying this? Is there a critical caveat to Session's forward secrecy (does it not have it in closed groups?), or are both sources just wrong?
(I've also heard one source say its closed groups are limited to 10 members which would be a showstopper for me and another source say they're limited to 100 and the spec says 500 so i don't know what to believe.)
I'm also concerned about it being built on top of a blockchain and cryptocurrency, not because I'm suspicious of cryptocurrency in general but because I find it difficult to understand, and because that it costs thousands of dollars to run a Session node seems to me like the network is bound to be owned exclusively by a few rich companies and investors. Is it? Is there a place I can see who owns how much of it, particularly how much is owned by the Oxen developers?
UPDATE: I believe I've just learned that Sesison DOES NOT have forward secrecy or deniability; the whitepaper linked on their CURRENT website is outdated. https://getsession.org/blog/session-protocol-technical-information
You can't separate people from their products.
You can, you have to do it. When someone's doing software, ask yourself software related questions. You just can't go with "this guy's Trump supporter" or "this guy's a communist". Just forget about it as long as the software doesn't reflect those facts (you should never have or care about that information in the first place). Stop politicizing software, stick to the technical aspect of it. Imagine science like "this paper is brilliant... but it's from someone tied to a political scene we don't support, so we'll just ignore it". How stupid is this?
That's happening a lot and some circles like to p-hack their way to success. You can't completely separate the author from their work.
Also if on the basis of that science they are going to be in a powerful position (leading a project), that should be criticized.