I'm not convinced requirements 3 and 4 are actually needed.<p>3) make internal state not useful to the attacker.<p>4) assuming the ciphertexts won't leak seems silly. Might as well hand them out.<p>Which leads to what they call "trial decryption" to be a better solution. If you are that worried about the scalability of your whistleblower protocol at that level, we are trying to solve the wrong problem.
They say don't roll your own encryption protocol (if something similar or same already exists and it's maintained), but these guys just can't resist.<p>Using a secure decentralized messenger to share a download (or upload) location on a Hidden S3 Service or one of those decentralized S3 services can't possibly be worse than this.<p>To commenter in <a href="https://news.ycombinator.com/item?id=40289777">https://news.ycombinator.com/item?id=40289777</a>: BitMessage doesn't solve anything, it uses broadcast and Bitcoin peer nodes that first get the message know where it came from. And BitMessage is not an illegal content hazard of any kind (what a ridiculous statement!).