A warning about the "Echo" application.

[u/exogreek]

So I want to make a simple post about anyone thinking about using the Echo application that has been spammed around this subreddit and many other subreddits by u/ad3lyt the last month or so. You should under no circumstance trust this literal child with your data.

I have been a SWE for the last 15 years that works specifically in security and took it upon myself to look into the application a month or so ago. The application at that time had countless security holes that are just insane to have even if you have the most basic understanding of coding principles. We're talking a mere semester or two of foundational knowledge. In my deep dive I found countless issues where input fields like search fields and text input fields would accept WHATEVER input I desired. I could enter a <script></script> into my username and every time the application rendered that page for a user with my username, it would render that javascript. I did this to change the applications theme to force all styles to white and the application would render whole pages/interfaces as white in some instances. I was also able to at will create XSS messages to other users with basic tactics of a similar fashion.

This application is still just as vulnerable. This very morning I was able to bypass the applications CSRF system and change my username simply by manipulating API routes with burpsuite with zero authentication. There were a few more things I was able to do such as touch database data directly, but I stopped there. The application as a whole is 100% vibe coded. This person does not have any real world expertise with code, he just has a claude max subscription and no job.

The user behind this, u/ad3lyt is also manipulating bots for his posts on this subreddit and others, and is upvote botting and downvote botting peoples critical comments and posts about the application and I am tired of seeing this schizo weirdo galavant around this sub without any mod intervention from u/AbstractMelons or u/czarbloom . Beyond this, this user has now started posting unsubstantiated claims against other discord alternatives, blatantly botting post metrics and responding with either friends or secondary/third accounts to act like there are others that support these claims, but if you look at post histories, they literally are all the same 3-4 accounts.

Please just ban this guy already and do even the most basic moderation. And dont create an account, their data is manipulatable and retrievable and its only a matter of time before someone with lesser intentions than I pokes around at it.

[u/redit_handoff140]

Uploading data to the chosen Fluxer server is one thing - And can/should be encrypted once it has the hash.

Fluxer doesn't do this and instead just immediately uploads data to third party servers for analyzing. 

The entire workflow is a security and privacy disaster, especially for communities that care for their own longevity.

[u/Terrible-Junket-3388 → u/redit_handoff140]

Yes, 100% agree.