Examples:

• Encrypt a ZIP file and send the password by Crosspass
• Send your gate code to your AirBnb cleaner
• Let your mom watch your Netflix
• Send a password or an API token to your client
• Access the same encrypted drive (Veracrypt, BitLocker, DMG, Cryptomator)

More use cases

Your secrets are stored on your mobile phone and are shared in encrypted form.

• The Crosspass server never sees your passwords or private notes.
• It relays blobs of data between two phones, but it cannot decrypt them.
• It does not hold any encryption keys of users (no public, private, symmetric, or Diffie-Hellman shares).

If the Crosspass server is compromised, the perpetrator must guess an equivalent of 11 coin flips in sequence in order to MITM a single exchange. Other server-based encryption apps can MITM without difficulty by giving out rogue cryptographic keys.

Whoever gets to use the PIN first is the winner. However, a theft would be hard to conceal. If a thief uses the PIN first but cannot be a MITM, then the real recipient will complain to the sender that he cannot access the share. (The share can be accessed only once.)

You can send both the Lookup ID and PIN together. However, if you are communicating over an insecure channel and you need to refer to the share without mentioning the PIN, then you can refer to it by the Lookup ID.

First, the sender cannot compose a message by IM unless the recipient already has the same IM and the sender knows recipient’s phone number.

Second, the Signal server keeps track of “who is who,” namely it proxies public keys and Diffie-Hellman shares. Therefore, the server can MITM any conversation. Preventing this requires verifying “Safety Numbers”, which are 60 digits long, before texting. Use Crosspass to exchange and verify them conveniently.

Ditto for WhatsApp where the “Safety Numbers” are called “Security Code”.

If they rely on asymmetric encryption, then they have the same MITM issue as Signal and WhatsApp.

If they rely on symmetric encryption, then the password manager stores a first part of cryptographic data on the server and a second part in a shared code or web link. However, the assumption is that no thief can collect these two parts, neither immediately nor at any future time. But this cannot be guarranteed because no one can guarrantee the deletion of data.

There are usability problems with PGP which is the reason for its small adoption since it was invented in 1991. However, if you already use PGP with success, then you can still benefit from using Crosspass to exchange PGP public keys or fingerprints.

From the perspective of the Crosspass server the user is anonymous. Only Apple or Google can map the collected information to the identity of the owner of the iOS or Android device respectively.

The Crosspass API server observes the following information:

• Device ID of the sender’s device.
• IP addresses of both sender and recipient.
• The date and time when requests are made.
• App Store or Play Store payment receipt of the sender.
• Device Check (for iOS only).
• Attestation that the requests to the server originate from authentic Crosspass app running on a real device.

The Crosspass app stores the following on the device:

• The outbound password is stored on sender’s device until it is retrieved by recipient.
  Then it is deleted on the sender’s device.

• Cryptographic keys that can decode ciphertext are stored on the sender’s device until the password is retrieved by the recipient. Then all cryptographic keys pertaining to this password are deleted on the sender’s device.

• If the recipient has not retrieved the password, the password will remain on the sender’s device for two weeks, then will be deleted.

• Received password is stored on the recipient’s device for 24 hours, then it is deleted.

Note that data on either device is not backed up in iCloud.

The short answer is no, however a desktop version is planned in the future. Until then, use Crosspass in conjunction with a password manager to copy-paste text between your desktop and your phone.

Communication web apps by their nature are subject to JavaScript Backdoor attacks, thus they cannot provide an end-to-end encryption guarantee. For this reason a web app for Crosspass will not be available.

Crosspass is designed to complement existing workflows. For example, use WinZip to create an AES-encrypted ZIP archive and transfer it by Dropbox. Then, use Crosspass to send the encryption password.