[Sony Xperia S, Acro S, Ion] lindworm:
Do you even read what I write?

As I explained he does now work there any more.

You seem to have noticed that too:

Are you kidding me? How the flying **** did you get to this conclusion? The company that was bought by twitter was Whisper Systems.

They are publishing the new source under Open Whisper Systems. (none of those was ever called Whisper)

See the difference? They also state this here: http://support.whispersystems.org/customer/portal/articles/1474591-is-textsecure-owned-by-twitter-

So you are saying CyanogenMod is part of this grand conspiracy of yours? Come on...

It's a binary blob and it sends data to google, but you have no proof whatsoever if it records keystrokes. You can know if you want to tough. Decompile it and analyze it. I don't like binary blobs, but you can't just say they do something without having any proof. I may not be able to guarantee that they don't do something, because I have not personally decompiled and analyzed every bit of it, but until you have and have proof that it does do something you can't just claim it does.

It is not something the average user should have access to, for several reasons. The TextSecure V2 protocol is NOT comparable with PGP/GPG because it has forward secrecy and deniability. The keys that are actually used to encrypt a message are not static as with PGP.

They are derived from the original keys and are changed with every message. No need to change them after X days/months/years.

Even if one key is intercepted, you would only be able to decrypt one message and not every message as it is the case with PGP.

If you get a new key, all your contacts get alerts that your key changed and that somebody may be listening in. That's not something the average user should be exposed to. If you think for whatever reason that you really want to do this, back up your conversations, uninstall TextSecure, install it again, import the backup and you have your new key.

Every average user has the google blobs, because they are preinstalled on nearly every phone and it's nearly unusable without them. This app is supposed to make encryption available to the masses.

Google may be undermined by your beloved three letter agencies, but it's not one of them. This is not to hide from them.

You have your threat model wrong.

No app alone can ever protect you from those agencies. They have hundreds of 0days for every platform and will simply own your Android, open source or not.

And this is not what TextSecure tries to do. They protect the content of every conversation with extremely strong encryption, no matter what the transport is. This does protect you from dragnet surveillance. But they can not protect you from someone who targets you and is willing to spend hundreds of thousands or millions to break into your operating systems.

If the NSA really wants you they get you, period. But TextSecure protects you from theives, cyber criminals and nearly everybody else who wants to read your messages.

You say you think the encrypted SMS mode was safe? With this your provider (and thus your government and every agency that wants it) has all the metadata. Who sent something to whom etc.

Google on the other hand has actually LESS meta data, because your phone sends the message to the TextSecure server, which relays the message to GCM. GCM then delivers the message. Because everything is encrypted none of the servers get contact data. But google only gets the receiver, not the sender. Your provider gets everything.

A global passive adversary may still do time corellation attacks, by listening who sends something when and who receives something at this time. After some sessions it's pretty clear who is talking to whom. It doesn't matter if Google is evil or not in this case. They get the metadata if they want to.

If you want protection against something like this take a look at pond, or meet i person: https://github.com/agl/pond

As I explained there is no weakening whatsoever. Even if you consider google the adversary, they get less meta data than your SMS provider.

You can use this exactly as before without the google blobs if you want to.

They are actively working on a way to get away from the play store and GCM by building their own distribution method (which is finished, but not yet released, see #127 in their github) and implementing Websockets (server works, client is on the way).

Before you start slamming something you should really understand how it works, or ask if you understood it correctly.