Quote from: LoyceV on Today at 01:29:49 PM

I was hoping the site itself would be enough, but it asks me to install software on my phone.

End-to-end encryption in web browser is not possible. Protonmail, Hushmail etc. are subject to Javascript backdoors. Hushmail actually backdoored itself and documented it. https://www.wired.com/2007/11/hushmail-to-war/

Quote from: LoyceV on Today at 01:29:49 PM

This is a lot more complicated than using Protonmail to send an password to another Protonmail user. Protonmail uses end-to-end encryption by default without sending codes and passwords, and can also set an expiration time.

Besides the web issue, the same critique I have in the FAQ on WhatsApp applies to Protonmail. You have to trust the public key that Protonmail gives you for the recipient, and so it can easily position itself as a MITM. That, unless you check key fingerprints against the recipient's. But if you have to do this, it is no longer an easy process. (How would you check them? You would need something like Crosspass for that.)

Quote

..
If I really, really have to share something encrypted online, I'd prefer Protonmail.
...
If someone tells me to install an app to receive a code, I'll tell them to use something else. I don't even install apps from my bank.

Yet, you would expect the recipient to sign up with Protonmail? I think that a recipient is more likely to install an app than create an account online somewhere. He knows that he can easily delete it as soon as he is done using it. Also, you would need to wait for the recipient to sign up with Protonmail before you can compose a message to him.

Quote

So if someone knows your Lookup ID, there's a 3 in 10,000 chance they can read your message. I wouldn't trust that for sending a credit card number, and it's much worse when dealing with Bitcoin private keys.

3 out of 10,000 is like 1 out of 3333, is harder than guessing a sequence of 11 flips of a coin. I though that if it's good enough for a bank, it's good enough for Crosspass. I could have made the PIN 6 digits long and it would still be user friendly because OTPs now are commonly a pair of 3 digits. But I am not convinced it's necessary. (If there is real demand for a six digit PIN, I could incorporate it as a future feature.)

Quote

If it's not going to be open source, you can always add a backdoor later.

Every version will be reviewed just before it's published to the App store and Play store. There would not be a need to review everything from scratch, just need to review the changes to source code since previous release.

Crosspass does not compete with WhatsApp, Signal, Telegram Secure Chat or Protonmail, Hushmail. Keep using those systems, but use Crosspass to verify the public keys in order to secure those systems.