From my initial investigation they have some <bad> code behind, race conditions and I think I found a place where it's leaking the IP of the guy you're calling. I'll post my findings later. Messages are sent over SSL but not encrypted in any other way, so they can read them :)