Dan Guido

The entire point of my conclusion was that there are very real & practical privacy issues in apps where zcash is used that need consideration and that aren't being given consideration while these apps are also being promoted widely (and the security patched versions less so)

I stand by my conclusion. There is a very real need for the development of robust threat models for ecosystem software and the resources on the development side to incorporate those into design and testing.

Agreed. There are some difficult trade-offs between security and performance/usability that need to be navigated by shielded light clients. I believe that users with "life and limb" threat models should use full nodes and appropriate layered network privacy solutions.

That is completely besides the main point, the other cryptographic vulnerability referenced in the first tweet was in the full node version of zecwallet. We're not talking about trade-offs here, we're talking about fundamental (lack of) secure design practice.

It's my understanding that the disabled TLS verification issue was quickly corrected after disclosure. I agree that was a rookie mistake. What is the other cryptographic vulnerability that you're referring to? I can't find a link to it in your original tweet.

I wanted to respond since @trailofbits was mentioned: We rapidly reviewed ZecWallet over 1 week in Apr 2019 and found a record 26 bugs; a substantial number for a short project that implies more bugs exist. Security review is not a guarantee of safety. https://github.com/trailofbits/publications/blob/master/reviews/zecwallet.pdf …