#OLDER VERSION OF CRYPTOCAT SOFTWARE#
#OLDER VERSION OF CRYPTOCAT MAC#

Kobeissi has plans for quite a few Cryptocat improvements. By using a '.onion' URL for Cryptocat, the Cryptocat server will not know the users' true IP addresses, Kobeissi said.

#OLDER VERSION OF CRYPTOCAT SOFTWARE#

But you have to understand that when you tell people to rely on your software for their lives, you better be 100,000 percent sure you know what you are doing.'Ĭryptocat's code is open source, and Kobeissi has published details on how its encryption works in order to get feedback from other cryptology specialists.Īs an added security measure, Cryptocat is compatible with TOR (The Onion Router), a worldwide network that make web surfing more anonymous by randomly routing traffic through its servers. 'I'll tell activists to use it in maybe five years,' Kobeissi said. Still, there are limitations with Cryptocat, mostly because it hasn't been as rigorously tested as PGP and OTR, which have been vetted by the world's best cryptographers, Kobeissi said. Kobeissi has worked other features into the web-based client, including the ability to invite Facebook friends and send encrypted files to another person. Even if an attacker seizes a server running Cryptocat, the conversations would be meaningless and impossible to decrypt. Kobeissi said only recently have web browsers incorporated JavaScript engines powerful enough to use very long encryption keys. The encryption and decryption keys are only stored within a person's Web browser, providing true end-to-end encryption. A user creates a chat session, picks a nickname and then types a random string of characters in order to generate the 256-bit AES encryption keys for the public key cryptography system it uses. First, one of its versions is web-based, so no application has to be downloaded. Crypto.cat v2 should amend this, but as a result, it requires an addon always for all users.The beauty of Cryptocat is its simplicity. Note that if any single member of the chat fails to use the chrome browser extension, it’s as though no one is, effectively. This is the heart of the attack: if the server sends you a special applet that spies on you, all your encrypted data is now wide open.” But it also remembers your passphrase, and sends it secretly back to the host. As usual, it does all the encryption and decryption for you, right on your computer. So if the host wants to attack you, all they need to do is send you a special encryption engine that captures your passphrase the next time you use the service. Remember that the host already has your key. If an attacker can get access to your key and your passphrase, all your encrypted data is now accessible to him. Simplified excerpt of the vulnerability from cited by Schneier: Please don’t trust host-based encryption systems with your mission critical information. This is their attempt to overcome this large security flaw. More generally, your security in a host-based encryption system is no better than having no crypto at all.” This means that in practice, CryptoCat is no more secure than Yahoo chat, and Hushmail is no more secure than Gmail. I’ll detail it below, but the short version is if you use one of these applications, your security depends entirely the security of the host. Unfortunately, these tools are subject to a well-known attack. The most famous tool in this group is Hushmail, an encrypted e-mail service that takes the same approach. “CryptoCat is one of a whole class of applications that rely on what’s called “host-based security”. You might want to mention that if you don’t use the chrome extension (or whatever future extensions they offer for other platforms), it might not be very secure.

Options are available to either chat privately with a select user, or publicly to the whole group of users. You see users who joined it on the right, and the actual messages on the left. The chat room looks like all other chat rooms you may have come across. The service creates an encryption key for you during set up. Instead of having to generate and exchange keys before you can even get started, you simply select the name of a chat room and a user name to connect. Probably the biggest difference to existing secure communication services is the ease of use with which you can get started. CryptocatĬryptocat, available as a browser extension for Firefox, Google Chrome and Safari, may be that alternative.

#OLDER VERSION OF CRYPTOCAT MAC#

You may use a desktop program for Windows, Mac or Linux instead, or switch to Cryptodog for Chrome which is a fork of the original extension. Note: Cryptocat was discontinued in 2016.

If you don't trust companies such as Google, Microsoft or Facebook when it comes to communication, for instance because of the recording of your chat conversations on said networks and possibility that those records are made available to third parties or used for user profiling, you may prefer a secure solution instead.

Older version of cryptocat