The point of this research isn't to make a decision about what messenger you use. The point is to help inform the designers of future, better messaging protocols about what does and doesn't work. Threema's design is littered with stuff that didn't work; it's an important cautionary tale.
You can, according to the paper, send a classic Threema protocol user a message that, if repeated or forwarded, allows someone else to log in as them. That's a distinctively weird and bad problem for a protocol to have. As I said in a comment elsewhere: the Matrix vulnerabilities were much more damaging to Matrix, but the Threema vulnerabilities were much worse as cryptographic flaws. There is more to learn from Threema's failures than from Matrix's.
I lament the dissemination by that group, always through a PR wave trying to place shocking headlines amplified by the school PR. that was the same in their past discoveries.
> You can, according to the paper, send a classic Threema protocol user a message that, if repeated or forwarded, allows someone else to log in as them. That's a distinctively weird and bad problem for a protocol to have.
Can you be precise about what specific claims they made and how the claims were deceptive?
Image if they tried to downplay the heartbeat or speculative execution bugs with arguments like “but you’d need access to the server and what can you do with a small chunk of memory anyway?”
IMHO just take your swat on the nose and fix your shit without going into defensive mode is the way to handle these things.