4 ms·
Have you taken a look at Cyph (mentioned elsewhere in this thread)? Their app is also basically cryptocat, but they've taken the time to engineer an interesting
by garrettr_ 11y ago
Have you taken a look at Cyph (mentioned elsewhere in this thread)? Their app is also basically cryptocat, but they've taken the time to engineer an interesting solution [0] to the "Trust on Every Use" problem that secure web applications have.
Of course, you still have the problem of deploying a secure application within the attack surface minefield of a web browser, but that's a separate issue.
[0]: https://docs.google.com/document/d/1PGS50eZB9Ud7wVKmrc0HU_FDygZkyuFjmTRrukAz3sw/edit https://docs.google.com/document/d/1PGS50eZB9Ud7wVKmrc0HU_FD...
- tptacek 11y agoSecure messaging has to work. All the time. If your threat model is criminals, Gchat will protect you just fine. You use encrypted messaging to prevent governments from reading your messages. Look at the Telegram/Iran fiasco for an example of this. So: my recommendation is, never use any secure messaging system that boots off a web page. No matter what they claim to do to mitigate the risk. I'm actually, for a bunch of specific reasons, not super comfortable with browser extension applications either. But at least the browser tries to protect an extension you have to explicitly install and explicitly run.