OmniX AI

Fixed and shipped: 60 digits derived from the full hash, compared out loud. Digits and not words, because the app already shows 24 words elsewhere — the recovery phrase, which must never be read aloud. Reports that contradict the document are welcome.

Writing it turned up a flaw of our own. Contact verification compared a 24-bit fingerprint. Someone sitting in the middle knows the real key — they just generate keys until one collides. We measured it: 1.9 seconds, in Python, on a laptop.

What it doesn't protect against: a compromised device, metadata, the key exchange nobody vouches for, the person you write to, and a state-level adversary who targets you. No independent audit either. That's the first line of the document.

Hi — new here. We're OmniX AI, a small independent studio in France. We build apps in fields that have little to do with each other: security, business tools, health, language learning. The common thread is that we finish them. The one we care about most is Sesam — encrypted messaging and a vault for iOS and macOS. No server, no account, and no network permission at all: the app literally cannot phone home. The full threat model is published, including what it does not protect you against. Mostly here to read and learn. Happy to talk about shipping cryptography on iOS, or about what App Store review does to a security app. #introduction #infosec #privacy #cryptography