6 ms·

Cryptocat was a good concept (i.e. it was USABLE!), but the execution was flawed. It grew a lot of criticism and Nadim made mistakes in handling some of his cri

Cryptocat was a good concept (i.e. it was USABLE!), but the execution was flawed. It grew a lot of criticism and Nadim made mistakes in handling some of his critics, creating a schism between him and the cryptographers who might have been able to help him. (Not all of this was his fault, of course.) I hope that not only will this new product of his be developed with "A pure vision of democratized, pleasant secure messaging", but also that he has matured significantly. I hope that Cryptocat v3 will come out after it has been thoroughly audited by several reputable third parties. Most importantly, I hope their crypto is boring. https://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase/6116#6116 https://security.stackexchange.com/questions/6095/xkcd-936-s... http://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf http://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf

tptacek 11y ago
What does it matter if a secure messenger is USABLE if it's not secure? Cryptocat wasn't.
- nfd 11y ago
  A usable, secure messenger is a pretty important niche to fill. Cryptocat is a good concept (usability is important), but its implementation is flawed enough that it's worse than useless. With some TLC, better ground-up design, and through auditing? Pretty sweet. There isn't one messenger that fills every niche reasonably well (eg. Tox is fragmented and hasn't been audited as far as I'm aware, Jitsi is clunky and relies heavily on outside services, Retroshare requires an intricate knowledge of GPG, several other messengers sit over Tor which requires education, and libpurple is garbage, etc.).
  - tptacek 11y ago
    I completely agree that a usable, secure messenger is important!
    - middleclick 11y ago
      And a one that runs on mobile as well.
  - brbsix 11y ago
    Ricochet sits over Tor and doesn't require much or any in the way of education. The implementation details and use of Tor is virtually invisible to the end-user. It's nothing like using public key encryption to send an email for instance, and more akin to AOL Instant Messenger from a user perspective.
  - buovjaga 11y ago
    > Retroshare requires an intricate knowledge of GPG This is not true. Pasting the certificate of your friend in a field does not require intricate knowledge of GPG.
- sarciszewski 11y ago
  See: "but the execution was flawed." > Security at the expense of usability comes at the expense of security. It got the usability part down, it just wasn't secure. And I wasn't claiming it was.
  - deleted 11y ago
    [deleted]
  - ska 11y ago
    Are you sure that the usability wasn't fundamentally insecure? Because in that case, whether or not it was usable is meaningless as a benchmark for a system that works.
    - nickpsecurity 11y ago
      I don't think so. I did a brief look at how it works. It was basically a centrally-hosted, shared-secret setup. I've built those before. Super easy to build and use compared to high-secure, P2P apps w/ their trust management. Here was the user experience when I tried it: 1. Go to the right site. So, tell them to check domain and HTTPS. 2. Type in information you and other person agreed to preferably in person. 3. Chat. Very, very usable. That could've been implemented in a simple, secure-coded app communicating over a secure tunnel with another simple app on a robust server. The crypto to do that sort of thing right (outside a browser) is pretty basic. One could even run the deployment server and untrusted storage separately so complex TCB couldn't affect trusted app delivery or operation. Not past availability. Cryptocat's design was actually simpler than some high assurance systems of the past. That tells me it could be done robustly with a different implementation and protocol. Is it the best idea? Hell no for all kinds of reasons that start with centralization then get worse from there. Its usability can be recreated, though, in a more secure solution. Note: As I said to tptacek, even the original with its security issues kept users safer than fads like Facebook Chat that spy on them. A fun, usable solution with better than average privacy is still a step up if used by the right people. Just gotta be clear to use something stronger (less fun) to stop hackers.
- leppr 11y ago
  It at least set a bar in UX that other projects aiming to do it right will try to match.
  - tptacek 11y ago
    Cryptocat's usability was also problematic; it was usable because it cut corners. Because of that, the "bar" they "set" wasn't entirely helpful.
- KMag 11y ago
  Agreed. There must be a cryptographic aphorism along the lines of John Gall's famous saying about the provenance of complex systems that work. Something like: "Usable secure systems are created by iterating from secure unusable systems, not by iterating from insecure usable systems." Someone must have said something like this before, and put it more eloquently.
- nickpsecurity 11y ago
  What's it matter if it's secure but not usable? That problem, aside from demand, is why almost everyone uses insecure messengers. Usability is more important if one is targeting the masses. Especially if the alternatives they find cool and usable are horribly insecure. That leads to other side: what is a secure messenger? Secure against WHO? If it's hackers, then Cryptocat is entirely inappropriate as it will be smashed. Yet, average person's threat model includes all kinds of snoops that might not have hacking skill not to mention the service host. Especially in high school & college. Cryptocat would protect them from many of those while its own problems would be found and improved over time. Widespread adoption of Cryptocat over services like Facebook Messenger stashing & analyzing the messages would be a win in privacy. So, the question is use case. I gave it a positive review for potential to get insecure crowd on something a little better. It was also fun thanks to good art. I just said they should clearly indicate it's not for stopping hackers, governments, etc. Plus keep links to good products that are. If people want those, they'll use them. If not, Cryptocat wasn't a bad fallback compared to straight-up invasive apps they were likely using.
  - tptacek 11y ago
    People say things like this a lot. I understand why they say it. But, no. Emphatically, no. Let me put a bullet right in the head of this argument in favor of Cryptocat and things like it: In June 2013, Cryptocat was used by journalist Glenn Greenwald while in Hong Kong to meet NSA whistleblower Edward Snowden for the first time, after other encryption software failed to work. And, you know what else? Guess what happened right around June 2013? Decryptocat.
    - sarciszewski 11y ago
      Cryptocat was not secure. No argument there! Decryptocat was the proof in the pudding. If a secure product could be as user-friendly as Cryptocat was while still being secure, then most peoples' communications would be more secure. That's all I was saying. I'm not trying at all to hand-wave the proven insecurity. I'm saying that the only thing they got right was the one thing that secure products have consistently gotten wrong. (Barring Signal.)
- rsingel 11y ago
  Secure from whom? A school IT admin? An abusive spouse? A kiddie with a wifi packet sniffer? From hackers going after email accounts? There are lots of threat models that CryptoCat was useful against; and in the long run, CryptoCat was right about usability.
  - tptacek 11y ago
    How about "secure against the best funded, best staffed signals intelligence agency in the world"? Because that's the adversary Cryptocat ended up with. When it came out that Greenwald had used it for Snowden, Kobeissi was over the moon about it on Twitter; he treated it as an endorsement.
- Panino 11y ago
  Just to play devil's advocate for the sake of discussion I'll say, the main benefit is "education" for designers of actual secure messaging apps such as those from Open Whisper Systems. I remember Moxie writing about intentionally using insecure messaging apps that have great UI for the purpose of learning what non-technical users want, and he then built stuff that was both secure and usable. I think it's interesting how apps like Cryptocat (on one side) and those from e.g. Open Whisper Systems (on another) play off each other. Some secure messaging apps were pressured to up their UI game, and now some "usable" apps are pressured to up their security game or shut down. Whatsapp got X25519 via the TextSecure protocol, and now Cryptocat is shutting down. It sends a message that designers of new apps will be competing against successful deployments of messengers that are both secure and usable. There are still things like Telegram that are apparently big, but I think the trend is clear.

tptacek 11y ago

What does it matter if a secure messenger is USABLE if it's not secure? Cryptocat wasn't.

nfd 11y ago
A usable, secure messenger is a pretty important niche to fill. Cryptocat is a good concept (usability is important), but its implementation is flawed enough that it's worse than useless. With some TLC, better ground-up design, and through auditing? Pretty sweet. There isn't one messenger that fills every niche reasonably well (eg. Tox is fragmented and hasn't been audited as far as I'm aware, Jitsi is clunky and relies heavily on outside services, Retroshare requires an intricate knowledge of GPG, several other messengers sit over Tor which requires education, and libpurple is garbage, etc.).
- tptacek 11y ago
  I completely agree that a usable, secure messenger is important!
  - middleclick 11y ago
    And a one that runs on mobile as well.
- brbsix 11y ago
  Ricochet sits over Tor and doesn't require much or any in the way of education. The implementation details and use of Tor is virtually invisible to the end-user. It's nothing like using public key encryption to send an email for instance, and more akin to AOL Instant Messenger from a user perspective.
- buovjaga 11y ago
  > Retroshare requires an intricate knowledge of GPG This is not true. Pasting the certificate of your friend in a field does not require intricate knowledge of GPG.
sarciszewski 11y ago
See: "but the execution was flawed." > Security at the expense of usability comes at the expense of security. It got the usability part down, it just wasn't secure. And I wasn't claiming it was.
- deleted 11y ago
  [deleted]
- ska 11y ago
  Are you sure that the usability wasn't fundamentally insecure? Because in that case, whether or not it was usable is meaningless as a benchmark for a system that works.
  - nickpsecurity 11y ago
    I don't think so. I did a brief look at how it works. It was basically a centrally-hosted, shared-secret setup. I've built those before. Super easy to build and use compared to high-secure, P2P apps w/ their trust management. Here was the user experience when I tried it: 1. Go to the right site. So, tell them to check domain and HTTPS. 2. Type in information you and other person agreed to preferably in person. 3. Chat. Very, very usable. That could've been implemented in a simple, secure-coded app communicating over a secure tunnel with another simple app on a robust server. The crypto to do that sort of thing right (outside a browser) is pretty basic. One could even run the deployment server and untrusted storage separately so complex TCB couldn't affect trusted app delivery or operation. Not past availability. Cryptocat's design was actually simpler than some high assurance systems of the past. That tells me it could be done robustly with a different implementation and protocol. Is it the best idea? Hell no for all kinds of reasons that start with centralization then get worse from there. Its usability can be recreated, though, in a more secure solution. Note: As I said to tptacek, even the original with its security issues kept users safer than fads like Facebook Chat that spy on them. A fun, usable solution with better than average privacy is still a step up if used by the right people. Just gotta be clear to use something stronger (less fun) to stop hackers.
leppr 11y ago
It at least set a bar in UX that other projects aiming to do it right will try to match.
- tptacek 11y ago
  Cryptocat's usability was also problematic; it was usable because it cut corners. Because of that, the "bar" they "set" wasn't entirely helpful.
KMag 11y ago
Agreed. There must be a cryptographic aphorism along the lines of John Gall's famous saying about the provenance of complex systems that work. Something like: "Usable secure systems are created by iterating from secure unusable systems, not by iterating from insecure usable systems." Someone must have said something like this before, and put it more eloquently.
nickpsecurity 11y ago
What's it matter if it's secure but not usable? That problem, aside from demand, is why almost everyone uses insecure messengers. Usability is more important if one is targeting the masses. Especially if the alternatives they find cool and usable are horribly insecure. That leads to other side: what is a secure messenger? Secure against WHO? If it's hackers, then Cryptocat is entirely inappropriate as it will be smashed. Yet, average person's threat model includes all kinds of snoops that might not have hacking skill not to mention the service host. Especially in high school & college. Cryptocat would protect them from many of those while its own problems would be found and improved over time. Widespread adoption of Cryptocat over services like Facebook Messenger stashing & analyzing the messages would be a win in privacy. So, the question is use case. I gave it a positive review for potential to get insecure crowd on something a little better. It was also fun thanks to good art. I just said they should clearly indicate it's not for stopping hackers, governments, etc. Plus keep links to good products that are. If people want those, they'll use them. If not, Cryptocat wasn't a bad fallback compared to straight-up invasive apps they were likely using.
- tptacek 11y ago
  People say things like this a lot. I understand why they say it. But, no. Emphatically, no. Let me put a bullet right in the head of this argument in favor of Cryptocat and things like it: In June 2013, Cryptocat was used by journalist Glenn Greenwald while in Hong Kong to meet NSA whistleblower Edward Snowden for the first time, after other encryption software failed to work. And, you know what else? Guess what happened right around June 2013? Decryptocat.
  - sarciszewski 11y ago
    Cryptocat was not secure. No argument there! Decryptocat was the proof in the pudding. If a secure product could be as user-friendly as Cryptocat was while still being secure, then most peoples' communications would be more secure. That's all I was saying. I'm not trying at all to hand-wave the proven insecurity. I'm saying that the only thing they got right was the one thing that secure products have consistently gotten wrong. (Barring Signal.)
rsingel 11y ago
Secure from whom? A school IT admin? An abusive spouse? A kiddie with a wifi packet sniffer? From hackers going after email accounts? There are lots of threat models that CryptoCat was useful against; and in the long run, CryptoCat was right about usability.
- tptacek 11y ago
  How about "secure against the best funded, best staffed signals intelligence agency in the world"? Because that's the adversary Cryptocat ended up with. When it came out that Greenwald had used it for Snowden, Kobeissi was over the moon about it on Twitter; he treated it as an endorsement.
Panino 11y ago
Just to play devil's advocate for the sake of discussion I'll say, the main benefit is "education" for designers of actual secure messaging apps such as those from Open Whisper Systems. I remember Moxie writing about intentionally using insecure messaging apps that have great UI for the purpose of learning what non-technical users want, and he then built stuff that was both secure and usable. I think it's interesting how apps like Cryptocat (on one side) and those from e.g. Open Whisper Systems (on another) play off each other. Some secure messaging apps were pressured to up their UI game, and now some "usable" apps are pressured to up their security game or shut down. Whatsapp got X25519 via the TextSecure protocol, and now Cryptocat is shutting down. It sends a message that designers of new apps will be competing against successful deployments of messengers that are both secure and usable. There are still things like Telegram that are apparently big, but I think the trend is clear.