4 ms·

Google still has access to the cleartext as it passes through their servers. Right, and cryptocat doesn't, 'cuz they said so on their website!

thirsteh 14y ago
The first implementation of Cryptocat was bad in this regard, but the new version uses OTR. OTR virtually guarantees that a middle man can't interpret your communications by performing public key authentication and key negotiation--similar to SSL with mutual authentication using a shared secret (see http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html, particularly the section on the Socialist Millionaires' Protocol.) You don't have to trust anyone to transport your data without snooping. Not only that, Cryptocat's new implementation is open source: https://github.com/cryptocat/cryptocat https://github.com/cryptocat/cryptocat. Inform yourself, ignoramus.
- JesseObrien 14y ago
  As you said. "Virtually". All of this relies on you trusting the third party involved here and that was my point. Whether its Google or some 23 year old kid, or if its open source or not doesn't matter. He is quite literally doing the same thing as I could do in setting us open fire on a box and inviting everyone to conne t and turn on their client side OTR. Just because it's a chrome extension and written in JavaScript somehow changes that? No.
  - thirsteh 14y ago
    > As you said. "Virtually". All of this relies on you trusting the third party involved here and that was my point. No, it doesn't. That's not what "virtually" means. It's guaranteed, barring some unexpected advance against one of the cryptographic algorithms used. In cryptography you use words like "essentially" or "infeasible", not "completely" and "impossible," because at the end of the day you are just hiding behind hard math problems. The whole point of OTR is that you don't have to trust the third party, and you obviously do not understand that. They are just a transport. The analogy you are making could just as well be applied to any ISP inbetween you and the person you are talking to. They are a transport. Don't trust the client? Use another. Or are you seriously suggesting writing your own? Then you're starting down a very long path: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html You also keep comparing it to Google's "no log" feature, but they have absolutely nothing in common. The "specs are not different"; they are completely different things. It's disappointing that you're so stubborn, arrogant, insulting to the author, and wrong at the same time. OTR is a brilliant and fascinating protocol, particularly because it gives people who communicate deniability, which PGP, for example, doesn't. Cryptocat is helping popularize it, and that's good.
    - hagios 14y ago
      > OTR is a brilliant and fascinating protocol, particularly because it gives people who communicate deniability, which PGP, for example, doesn't. This is a point which a lot of people seem to overlook. Sometimes, non-repudiation is desirable. Sometimes it is not.
- deleted 14y ago
  [deleted]

thirsteh 14y ago

The first implementation of Cryptocat was bad in this regard, but the new version uses OTR. OTR virtually guarantees that a middle man can't interpret your communications by performing public key authentication and key negotiation--similar to SSL with mutual authentication using a shared secret (see http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html, particularly the section on the Socialist Millionaires' Protocol.) You don't have to trust anyone to transport your data without snooping. Not only that, Cryptocat's new implementation is open source: https://github.com/cryptocat/cryptocat https://github.com/cryptocat/cryptocat. Inform yourself, ignoramus.

JesseObrien 14y ago
As you said. "Virtually". All of this relies on you trusting the third party involved here and that was my point. Whether its Google or some 23 year old kid, or if its open source or not doesn't matter. He is quite literally doing the same thing as I could do in setting us open fire on a box and inviting everyone to conne t and turn on their client side OTR. Just because it's a chrome extension and written in JavaScript somehow changes that? No.
- thirsteh 14y ago
  > As you said. "Virtually". All of this relies on you trusting the third party involved here and that was my point. No, it doesn't. That's not what "virtually" means. It's guaranteed, barring some unexpected advance against one of the cryptographic algorithms used. In cryptography you use words like "essentially" or "infeasible", not "completely" and "impossible," because at the end of the day you are just hiding behind hard math problems. The whole point of OTR is that you don't have to trust the third party, and you obviously do not understand that. They are just a transport. The analogy you are making could just as well be applied to any ISP inbetween you and the person you are talking to. They are a transport. Don't trust the client? Use another. Or are you seriously suggesting writing your own? Then you're starting down a very long path: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html You also keep comparing it to Google's "no log" feature, but they have absolutely nothing in common. The "specs are not different"; they are completely different things. It's disappointing that you're so stubborn, arrogant, insulting to the author, and wrong at the same time. OTR is a brilliant and fascinating protocol, particularly because it gives people who communicate deniability, which PGP, for example, doesn't. Cryptocat is helping popularize it, and that's good.
  - hagios 14y ago
    > OTR is a brilliant and fascinating protocol, particularly because it gives people who communicate deniability, which PGP, for example, doesn't. This is a point which a lot of people seem to overlook. Sometimes, non-repudiation is desirable. Sometimes it is not.
deleted 14y ago
[deleted]