24 ms·

DecryptoCat

516 points by thejosh 13y ago

616c 13y ago
Unfortunately I am not too well-versed in cryptography, and I guess I must start taking the Matasano crypto challenge. I am very scared too use most crypto platforms for reasons like this; I would never have picked up on such stuff. I only trust PGP because it has decades of skepticism and so far no one has scared me out of using that. The other stuff needs more eyeballs, and I am more or less blind. Time to read some books.
- jiggy2011 13y ago
  What about NACL? http://nacl.cr.yp.to/index.html http://nacl.cr.yp.to/index.html Seems to provide most of the building blocks you would need and has bindings for various languages.
  - 616c 13y ago
    I have seen it. I am a middling programmer at best. I guess I need to step it up.
mahmoudhossam 13y ago
I'm pretty sure there's a nicer way of saying "You're doing crypto wrong." I don't know the author of either software, but as software professionals we have to maintain a certain level of respect for one another.
- rorrr2 13y ago
  People relied on crypto.cat, some probably with their lives. Who gives a crap about hurt feelings of the author who failed at crypto for so long, while advertising it as secure?
  - pfortuny 13y ago
    It is not "hurt feelings", it is "the tone of the environment." Really, education and politeness have much more to do with "building a strong society" (and by society I mean "developers' environment") than "not hurting the feelings of an individual." Think big, not small. Think long-term, not short. Think global, not local. If you do these, then you will end up also thinking small, short and local. (Edit typos etc) Reedit: The first comment by DanBC is what I deem "polite criticism". One does not need to mince words but one does not need to insult either.
    - throwaway2048 13y ago
      Sorry, but people that continually ignore polite advice to the detriment of the community badly need naming and shaming like this. People's lives are literally on the line.
      - raganwald 13y ago
        Way to miss the point. This isn't about Nadim. Ask yourself this question: If there's an intelligent person with expert skills to contribute to either of two communities, and one of them is full of naming and shaming but the other iusn;t, where will they go?
        Nursie 13y ago
        If they're into crypto, hopefully the one with a robust attitude to handling security flaws, rather than the one where pointing them out is considered bad form.
    - rorrr2 13y ago
      Why should we be polite to a person who endangered people who relied on his expertise? He had one task (that he chose), that task was extremely sensitive and had to be implemented correctly. He failed. Shaming and ridicule is the least he deserves.
      - 13y ago
- DanBC 13y ago
  People tried politely telling Cryptocat that they were doing crypto wrong. Cryptocat ignored those people. Cryptocat dismissed the advice they were being given.
- flarg 13y ago
  I disagee, The cryptocat team must 'suck it up' and do better, or GTFO. If they know anything about their field, they should not expect any respect or politeness. As software professionals we have a responsibility to accept criticisms from others in our field, no matter what their tone and manner may be - and this is especially true in crypto. In our field we have a lot of very bright people with literally no politeness or respect - and we must still work with them to make things better.
DanBC 13y ago
Cryptography is hard. Software is full of bugs. Most of those bugs can be left without too much impact on the users. See any bug tracker for bugs which have been left for years. With cryptographic software a small, subtle, hard to find bug could render the product pointless; could make the cryptography trivially easy to crack. Smart people and many eyes make mistakes with crypto. See, for example, the random number generator bug in Debian. People learn by doing. They read a book or two, they read some source code, and then they implement their own version. This is especially dangerous for crypto because these people might not understand the bugs they've created. It's fine to release your code snippets as "proof of concept" or "demonstrations" so long as you give warnings that these are not to be used in real life. Cryptocat did not give those warnings. Cryptocat said it was secure. They ignored the advice from many people. They even took the ultimate snakeoil step of running a competition to crack their software. Except the badguys are not going to enter your competition; the badguys either already know how to break the crypto or they use all the publicly available entries as help. People shouldn't have been waiting for something like DecryptoCat before they stopped using CryptoCat. It's particularly frustrating because people risk death or torture or long term imprisonment in some parts of the world, and they need strong crypto. (https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...)
- sneak 13y ago
  > Cryptocat did not give those warnings. Cryptocat said it was secure. They ignored the advice from many people. Yeah, I saw a bunch of people I respect saying things like "Nadim[1] is a good kid and he's learning, give him the benefit of the doubt" when I suggested that nobody use CryptoCat. But... > It's particularly frustrating because people risk death or torture or long term imprisonment in some parts of the world, and they need strong crypto. We have an obligation to the safety of others (especially in light of the fact that we know all the transmitted cyphertext is being stored) to denounce poor crypto implementations whenever and wherever we see them, regardless of the implementor. [1] https://en.wikipedia.org/wiki/Nadim_Kobeissi https://en.wikipedia.org/wiki/Nadim_Kobeissi
- mtgx 13y ago
  I don't know what he usually says, because I don't follow him, but I remember hearing him in a speech say that "you shouldn't use Cryptocat if your life depends on it" or something like that. I've just checked, and he seems to give that warning on the site, although below the fold: "Cryptocat is not a magic bullet. You should never trust any piece of software with your life, and Cryptocat is no exception" https://crypto.cat/ https://crypto.cat/
zainny 13y ago
What is it with people in the crypto community always coming across as complete and utter jerks? Question for those in this space: is it possible for you to give constructive criticism for a project without calling people "incompetent"? Seriously, if there any domain in CS more full of these types of personalities I can't think of it.
- DanBC 13y ago
  > is it possible for you to give constructive criticism for a project without calling people "incompetent"? Cryptocat had many such bits of constructive criticism. They chose to ignore it. They continued to promote their broken product as secure.
  - zainny 13y ago
    You're making statements like that in a very matter of fact way. Can you please give references? It seems to me like the developers have been earnestly trying to build and improve on Cryptocat and shore up any weaknesses only to be constantly shit on your typical internet crypto experts.
    - DanBC 13y ago
      > earnestly trying to build and improve on Cryptocat and shore up any weaknesses The release an insecure product. People tell them it's insecure, and that they don't know what they're doing, and that they should stop. They make a tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. At this point, imagine no-one tells them about any bugs. Does that mean the product is secure? Does that mean people should be using it? Here's one thread on HN where they get mostly polite advice (https://news.ycombinator.com/item?id=2855257 https://news.ycombinator.com/item?id=2855257) and the whack-a-mole game of "our software is secure", "here's a bug", tweak "Our software is secure" happens. Here's a nice article about the hype surrounding cryptocat (which, admittedly, isn't the fault of cryptocat) (http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hyping-unproven.html http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hy...)
boi_v2 13y ago
I wish people would get involved with projects like Cryptocat instead of pointing the finger with some kind of superiority that will never construct anything, at least this is what I would do if I were a Cryptographer, but why bother? It is better to work for a bank and use others mistakes to make some self-promotion and maybe feel better with myself. You missed a excellent opportunity to make some good.
- dionyziz 13y ago
  You're right. However, the guy actually did write a patch for Cryptocat, so you have to give him that.
  - _djo_ 13y ago
    Which was subsequently modified to make it less secure before being added to the project. That tends to dampen one's enthusiasm to contribute.
    - thezoid 13y ago
      It's always fun to watch patches you make to projects get removed or changed a few weeks/months later for arbitrary reasons :(
- jlgreco 13y ago
  If I were to write a book that pretended to teach laymen how to perform major surgery in their own kitchen, would it be reasonable for real surgeons to tell me to knock it the fuck off, or should they "get involved" and attempt to provide me with constructive criticism?
  - StavrosK 13y ago
    Your analogy means that people shouldn't expect to have secure group chatting capability. It would be more like (groan) saying "I want to perform surgery in my kitchen so I'll just read some books while I'm opening the person up, but real surgeons are telling me to knock it the fuck off and read all the books before trying it". It's legitimate and commendable to try to write your own cryptosystem, but winging it is not going to end well.
kimlelly 13y ago
Give RetroShare a try: http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ It's: 1. Decentralized (real p2p, no central servers) 2. Encrypted communication 3. Easier to set up than encrypted email: Install -> Exchange "certificates" -> Done.
- deleted 13y ago
  [deleted]
- InternalRun 13y ago
  You need to stop spamming this.
- makomk 13y ago
  4. Not developed by cryptographers.
davidw 13y ago
> The bug that lasted 347 days was the confusion between a string and an array of integers. Maybe they are Erlang programmers :-)
- rwg 13y ago
  Every programmer should be forced to implement a non-trivial algorithm that involves lots of bit twiddling in a few languages that don't have integers ("all you need are double-precision IEEE 754 floats...and love!"), don't have unsigned integers, have undefined or implementation-specific integer sizes, and/or don't have a "convenient" string type.
  - tptacek 13y ago
    Watch out, he's just trying to get you to implement ECDLP in Applescript and DOS BAT files.
  - Dylan16807 13y ago
    Honestly I think you need to make that challenge harder. Lua, for example, has built-in 32-bit bitwise operations despite having no integer types. I did a prototype implementation of SHA3 and it was a walk in the park, I wouldn't expect that to change with a larger algorithm.
noonespecial 13y ago
Cryptography is different than regular software. It requires even more than full transparency or even "full" competency. It requires radical humility. Both from the creators and the critics. Once the dialog stops, sides are chosen and people dig in, the project fails regardless of how well or poorly it had been doing.
leke 13y ago
Steve's pages are very easy on the eyes.
EliRivers 13y ago
Also I learned that it means nothing when I hear "it is open source and peer reviewed". I get his point, but I take exactly the other conclusion from this; perhaps ironically, because Steve Thomas has ripped it to pieces and gone to town on the code, as long as the flaws he found are fixed, I now have greater faith in it because it's open source and peer reviewed - Steve Thomas' own peer review is a big part of that. Perhaps we should take open source and peer reviewed as meaning it can be peer reviewed; it's still on us to check who's done those reviews and, if needs be, do it ourselves and give something back.
- deleted 13y ago
  [deleted]
ParadisoShlee 13y ago
Nadim Kobeissi spends most of his spare time fighting with people who know better. This is no surprise. I remember the 50 long twitter reply chains with a number of crypto developers calling him out for bad design choices.
davidw 13y ago
For all the people ranting about what an incompetent this guy is, why does no one complain that stuff like GPG is so complicated that 1) Ordinary people probably can't use it. 2) It probably would be pretty easy to talk ordinary people into sending you their private keys/passphrases/etc... in the guise of 'helping' them, because it's so complicated. No one seems to talk about horrible complexity as a big security vulnerability. Also, I agree that there is something not quite right in the security community that often makes them talk with their Comic Book Guy voices.
- DanBC 13y ago
  eh, I've said that many times. I've even said it on HN.
  - zainny 13y ago
    But why would anyone even bother trying to fix the situation? Any attempt to will just result in the entire crypto community community calling you "worthless" and "unqualified". This is the entire problem. Funnily enough, I imagine the original implementers of the major crypto libraries we use today and take for granted would probably equally be called "idiots" and "losers" if judged by today's internet crypto heroes. The crypto community is flat out toxic. You ain't gonna see progress from anywhere until the situation changes.
    - davidw 13y ago
      I think you're being unfair by painting them all with the same brush. But there is definitely a 'tone' in that community that I find very off-putting. This thread was interesting - tptacek seems like a nice enough guy - he's very helpful here and certainly knowledgeable, and generally pleasant to interact with: https://news.ycombinator.com/item?id=5776111 https://news.ycombinator.com/item?id=5776111 I agree with you that the "don't do that" attitude seems a bit... binary. Who decides who gets to do what? At what point does it become 'ok' to do crypto stuff? What kind of crypto stuff? Putting together pieces like SSL and GPG? Writing crypto libraries? New crypto algorithms? I'm mostly a believer in leaving the latter to people who have demonstrable competence in the field, but lots of people need to put together pieces in some way and the "don't do that" attitude does not really solve that problem.
tptacek 13y ago
The hardest part of this to read for me isn't the vulnerability, but rather: 2011 Passwords: BPKDF2-HMAC-SHA1 with 1000 iterations 2011 Passwords: BPKDF2-HMAC-SHA1 with 600 iterations 2011 768 bit RSA 2011 512 bit RSA 2011 600 bit RSA 2011 1280 bit RSA 2011 1024 bit RSA 2011 1048 bit RSA 2011 1536/1152 bit RSA (Chrome/other) 2011 1536/1024 bit RSA (Chrome/other) 2011 "3072 bit" D-H 2011 "3072 bit" D-H 2011 "4096 bit" D-H 2012 ECC Curve25519 (edited for clarity) Major red flag. The difference between symmetric-keyed password-based encryption, RSA, Diffie-Hellman and ECC (presuming ECDH?) isn't minor; it isn't a feature-level distinction. These are radically different designs. I'm not sure I've ever seen a system as popular as this so quickly take a tour of so much of cryptography. How could anyone have any kind of grip on the safety of a system that fundamentally changes its crypto constructions so often? A lesson here: if you have to implement cryptography --- and you and your users would be much better off if you didn't, and rather relied on a standard implementation like PGP --- do one thing and stick with it. Think of it like being a little kid lost in a shopping mall. Don't make it harder to get found.
- jiggy2011 13y ago
  What about NACL? It seems more flexible that PGP but still provides a fairly high level of abstraction. Not sure what is a good library for doing PBKDF2 or similar though.
  - tptacek 13y ago
    I like Nacl. I also like Keyczar. I would be very worried about a project that oscillated from PGP to Nacl to Keyczar, though.
  - drostie 13y ago
    Probably the best KDF you'll get right now is scrypt[1]. NaCl did not see common adoption because until a relatively recent distribution called Sodium[2], it was not portable. And I mean really, not portable. Like, just to give an example, suppose you want to use NaCl in Node.js, which is pretty good about accepting C/C++ modules. You have two options today: one doesn't work on a 64-bit system[3] and one isn't C, it's JS which was transpiled with Emscripten[4]. I mean, don't get me wrong: the fact that we can now do this in pure JS via Emscripten is amazing, but yeah, NaCl was not universally buildable and therefore was not reliably deployable, and nobody really wanted to fix it until Sodium came along. [1] https://www.tarsnap.com/scrypt.html https://www.tarsnap.com/scrypt.html [2] https://github.com/jedisct1/libsodium https://github.com/jedisct1/libsodium [3] https://github.com/thejh/node-nacl https://github.com/thejh/node-nacl [4] https://github.com/tonyg/js-nacl https://github.com/tonyg/js-nacl
amouat 13y ago
Crytpocat have now posted a reply: https://blog.crypto.cat/2013/07/new-critical-vulnerability-in-cryptocat-details/ https://blog.crypto.cat/2013/07/new-critical-vulnerability-i...
phryk 13y ago
https://blog.crypto.cat/2013/07/new-critical-vulnerability-in-cryptocat-details/ https://blog.crypto.cat/2013/07/new-critical-vulnerability-i... There seems to be a response to this on the cryptocat dev blog. Since I have no clue about crypto, I can't make any assessments though; Still might be interesting for some of you guys.
deleted 13y ago
[deleted]
plg 13y ago
Nadim has a good idea here in Cryptocat. The implementation has some problems, clearly. Is anyone surprised (including Nadim)? Clearly Nadim is learning as he goes. Let's dispense with the personal attacks and instead, if we think Cryptocat is a good idea, let's help make it as secure as we can. Can we get experienced crypto experts on board? Nadim ought to be interested in that.
- DanBC 13y ago
  Cryptocat have rejected the advice from experienced crypto experts. Cryptocat have been given a lot of advice and they argue against it; they tell experienced crypto experts that they are wrong and that the flaws are not really flaws.
  - plg 13y ago
    If this is true, then it is disappointing.
deleted 13y ago
[deleted]
dobbsbob 13y ago
Shouldnt this be called DecryptoDog? I've never trusted any in browser/java nonsense crypto since FireGPG was exposed for dozens of problems and leaks.
parennoob 13y ago
BTW, everyone using the "But lives depend upon this, the CryptoCat author put lives at risk!" argument to excuse Steve Thomas's attacking tone in this article is more or less being a hypocrite. What about the fact that Steve Thomas, by releasing a tool that makes it extremely easy to decrypt the conversations encoded by CryptoCat at specific times, has done exactly the same thing? Disclosing a vulnerability in this public manner and providing a decryption tool on a platter has probably done more damage to the hypothetical journalists who were hypothetically using CryptoCat. I don't think bad crypto should be forgiven, but it would be easier and probably less arrogant to just submit a diff / pull request publicly that fixes all of the problems that the author observed, and then have people comment upon it. If the author rejects it, these "you are incompetent" comments can go there. Arrogant takedowns like this "the author clearly has no effing idea about crypto" make it more difficult for newbies like me to understand and try to work on crypto. What chance do I have if any piece of software I write is going to be destroyed by withering comments like "you're a moron" without mathematically explaining what the problem is and laying out the fixes clearly and positively?
- corresation 13y ago
  by releasing a tool that makes it extremely easy to decrypt the conversations encoded by CryptoCat at specific times, has done exactly the same thing? Assuming that cryptocat is used to avoid the monitoring of entire nations, you can be absolutely certain that those with the motivations have long ago cracked this. That is exactly why security professionals get so passionate about this, because they know that bad crypto is literally much worse than no crypto at all -- at least in the latter case you have no illusions. Cryptocat has been under significant criticism for a long time. For instance- https://news.ycombinator.com/item?id=5194713 https://news.ycombinator.com/item?id=5194713 -and for very good reason. After the farcical story about being investigated by CSIS (which seems laughable, because if there's one thing that government security agencies love, it's bad crypto), this project seems to be held aloft by nothing more than people saying "But he's young and passionate, so give him a chance" -- that isn't credible reasoning for crypto.
- DanBC 13y ago
  > that fixes all of the problems Yet again: Cryptocat is broken. It is so broken that there is no possibility of making it work.
mtgx 13y ago
Are there any implications for the WebCrypto API after this? I think he used Javascript crypto at first, but not sure after he turned it into a "Chrome app" (presumably based on Native Client - or is it still Javascript?).
networked 13y ago
Rolling your own crypto is incredibly perilous. Now, the Cryptocat team could discard their own code, compile GnuPG with emscripten [1] and adopt the existing UI/UX to using that but who's to say GnuPG is still going to work correctly on that new platform? The only "easy" (if insane) solution I can think of for building GPG on a known platform and still having it run in the browser is to use something like JSLinux [2] and run GnuPG inside a hidden VM communicating with it over an emulated serial interface. Then again, I'm sure that could introduce all sorts of interesting issues related to timing and randomness. Cryptography is damn hard. Edit: I'm aware that they've used CryptoJS but, much like calling OpenSSL directly, I would still count that as "rolling your own". [1] See, e.g., http://manuels.github.io/unix-toolbox.js-gnupg/ http://manuels.github.io/unix-toolbox.js-gnupg/. [2] http://bellard.org/jslinux/ http://bellard.org/jslinux/
- amouat 13y ago
  But they didn't roll their own crypto as far as I can tell. They used CryptoJS [1]. They just failed to use it correctly. EDIT: Here's the code https://github.com/cryptocat/cryptocat/blob/master/src/core/js/lib/multiParty.js#L37 https://github.com/cryptocat/cryptocat/blob/master/src/core/... [1] https://code.google.com/p/crypto-js/ https://code.google.com/p/crypto-js/
- amouat 13y ago
  Whilst there may still be plenty of scope for error, I think there is a large difference between using CryptoJS and "rolling your own". I wonder how "correct" CryptoJS itself is though.
  - networked 13y ago
    > Whilst there may still be plenty of scope for error, I think there is a large difference between using CryptoJS and "rolling your own". I agree to some extent but as the article we're commenting on proves, the scope for error is enough for you to render your encryption useless against an attacker armed with just a modern desktop PC.
wyck 13y ago
Does anyone remember this.. https://news.ycombinator.com/item?id=5194489 https://news.ycombinator.com/item?id=5194489 The story where he thought his computer was backdoored by a government agency and provides no evidence other than some weird paranoid hunches. His original blog post http://log.nadim.cc/?p=110 http://log.nadim.cc/?p=110 has been removed, but you can find it here: https://gist.github.com/chrisbutcher/4748293/ https://gist.github.com/chrisbutcher/4748293/
mykhal 13y ago
i think that someone, who is teaching others that they are writing crap crypto, should express himself less vaguely than like: "... depending on your browser you might get these two lines of extra data ..." (in "public key")
coldcode 13y ago
If everyone here who complains about the folks behind Cryptocat being dumb is such much smarter, how about some of you build something like this so we can all see compare. Commenting in HN doesn't prove you know better, ship something and we can all be sure.
- DanBC 13y ago
  I genuinely don't know if you're trolling or not. Some of the people criticising cryptocat are respected, knowledgeable, experienced researchers with shipped product used by many people everyday. Other people criticising cryptocat know enough about crypto to know that they should not be doing it. That's not a negative, that's a strong positive point.
kragen 13y ago
I was really hoping Nadim would be successful with CryptoCat, but at least in my eyes, this bug is the failure of the project — especially because his response is, "Cryptocat is not any different from any of the other notable privacy, encryption and security projects, in which vulnerabilities get pointed out on a regular basis and are fixed. Bugs will continue to happen in Cryptocat, and they will continue to happen in other projects as well. This is how open source security works." <http://blog.crypto.cat/2013/07/new-critical-vulnerability-in-cryptocat-details/> http://blog.crypto.cat/2013/07/new-critical-vulnerability-in... No. This is how open-source "security" fails. GnuPG has not had a security bug since 2008, and I don't think it's ever had a security bug that left your encrypted messages open to interception. You can't start with insecure cryptographic software and bugfix it until it's secure. You'll just bugfix it until only the bad guys know where the new holes are. How long has the Russian equivalent of the NSA (or, if you're Russian, the NSA) known about Lucky Thirteen, for example? How long did they know about the Million Message Attack? (That, and the array of "15-bit" single-digit integers.)
mgraczyk 13y ago
I would just like to say that it makes me very happy to see even modestly technical discussions about cryptology make it so high up on HN. Lately it has seemed like all the highly ranked articles have been about the PEOPLE or COMPANIES doing crypto, and not about the cryptology itself. Crypto is interesting not because people are doing it, breaking it, and improving it every day. Crypto is interesting because of HOW people are breaking it and improving it.
blt 13y ago
There should be no benefit of the doubt or warm encouragement for these developers. The bug with the array of decimal digits shows minimal programming competence: the author either does not understand how numbers and strings work in a computer, or doesn't read API documentation. Nadim seems like a naive person without a computer science background who is attracted to cryptography as an activist, but has no knowledge beyond a 3-page tutorial. It is extremely arrogant and irresponsible for a developer with such little domain expertise to promote this product as secure.
deleted 13y ago
[deleted]
TempleOS 13y ago
It's mean to tickle the president or a person. ------------------------------------------------ Daniel 5 New International Version (NIV) The Writing on the Wall 5 King Belshazzar gave a great banquet for a thousand of his nobles and drank wine with them. 2 While Belshazzar was drinking his wine, he gave orders to bring in the gold and silver goblets that Nebuchadnezzar his father[a] had taken from the temple in Jerusalem, so that the king and his nobles, his wives and his concubines might drink from them. 3 So they brought in the gold goblets that had been taken from the temple of God in Jerusalem, and the king and his nobles, his wives and his concubines drank from them. 4 As they drank the wine, they praised the gods of gold and silver, of bronze, iron, wood and stone. 5 Suddenly the fingers of a human hand appeared and wrote on the plaster of the wall, near the lampstand in the royal palace. The king watched the hand as it wrote. 6 His face turned pale and he was so frightened that his legs became weak and his knees were knocking. 7 The king summoned the enchanters, astrologers[b] and diviners. Then he said to these wise men of Babylon, “Whoever reads this writing and tells me what it means will be clothed in purple and have a gold chain placed around his neck, and he will be made the third highest ruler in the kingdom.” 8 Then all the king’s wise men came in, but they could not read the writing or tell the king what it meant. 9 So King Belshazzar became even more terrified and his face grew more pale. His nobles were baffled. 10 The queen,[c] hearing the voices of the king and his nobles, came into the banquet hall. “May the king live forever!” she said. “Don’t be alarmed! Don’t look so pale! 11 There is a man in your kingdom who has the spirit of the holy gods in him. In the time of your father he was found to have insight and intelligence and wisdom like that of the gods. Your father, King Nebuchadnezzar, appointed him chief of the magicians, enchanters, astrologers and diviners. 12 He did this because Daniel, whom the king called Belteshazzar, was found to have a keen mind and knowledge and understanding, and also the ability to interpret dreams, explain riddles and solve difficult problems. Call for Daniel, and he will tell you what the writing means.” 13 So Daniel was brought before the king, and the king said to him, “Are you Daniel, one of the exiles my father the king brought from Judah? 14 I have heard that the spirit of the gods is in you and that you have insight, intelligence and outstanding wisdom. 15 The wise men and enchanters were brought before me to read this writing and tell me what it means, but they could not explain it. 16 Now I have heard that you are able to give interpretations and to solve difficult problems. If you can read this writing and tell me what it means, you will be clothed in purple and have a gold chain placed around your neck, and you will be made the third highest ruler in the kingdom.” 17 Then Daniel answered the king, “You may keep your gifts for yourself and give your rewards to someone else. Nevertheless, I will read the writing for the king and tell him what it means. 18 “Your Majesty, the Most High God gave your father Nebuchadnezzar sovereignty and greatness and glory and splendor. 19 Because of the high position he gave him, all the nations and peoples of every language dreaded and feared him. Those the king wanted to put to death, he put to death; those he wanted to spare, he spared; those he wanted to promote, he promoted; and those he wanted to humble, he humbled. 20 But when his heart became arrogant and hardened with pride, he was deposed from his royal throne and stripped of his glory. 21 He was driven away from people and given the mind of an animal; he lived with the wild donkeys and ate grass like the ox; and his body was drenched with the dew of heaven, until he acknowledged that the Most High God is sovereign over all kingdoms on earth and sets over them anyone he wishes. 22 “But you, Belshazzar, his son,[d] have not humbled yourself, though you knew all this. 23 Instead, you have set yourself up against the Lord of heaven. You had the goblets from his temple brought to you, and you and your nobles, your wives and your concubines drank wine from them. You praised the gods of silver and gold, of bronze, iron, wood and stone, which cannot see or hear or understand. But you did not honor the God who holds in his hand your life and all your ways. 24 Therefore he sent the hand that wrote the inscription. 25 “This is the inscription that was written: mene, mene, tekel, parsin 26 “Here is what these words mean: Mene[e]: God has numbered the days of your reign and brought it to an end. 27 Tekel[f]: You have been weighed on the scales and found wanting. 28 Peres[g]: Your kingdom is divided and given to the Medes and Persians.” 29 Then at Belshazzar’s command, Daniel was clothed in purple, a gold chain was placed around his neck, and he was proclaimed the third highest ruler in the kingdom. 30 That very night Belshazzar, king of the Babylonians,[h] was slain, 31 and Darius the Mede took over the kingdom, at the age of sixty-two.[i]
dakimov 13y ago
It is totally fine! Compare this to Android: http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/ http://bluebox.com/corporate-blog/bluebox-uncovers-android-m... Security, privacy, copyright — these are three problems the humankind is as dumb as a monkey with.
hnolable 13y ago
Does anyone know if there are any issues with the javascript OTR library they use (https://github.com/arlolra/otr https://github.com/arlolra/otr)? Or are all the issues only with their custom multi party chat encryption system?
arthulia 13y ago
> Both comments are wrong since "Cryptocat.randomString(64, 0, 0, 1, 0)" generates a string that is 64 decimal digits which is 212.6 bits or 26.6 bytes. How can you have .6 bytes or bits?
- bmh100 13y ago
  A bit is a 0 or a 1. Two bits is 00, 01, 10, or 11. Each bit doubles the amount of information. This means that information representing information as bits products powers of 2. To get the number of bits (the power of 2 to represent the number), one takes the log, base 2, of the number. If I took the example of 2 bits and limited it to 00, 01, 10, there would be 1.6 bits. Log2(3) = 1.6.
stefanix 13y ago
Author complains "I learned that it means nothing when I hear it is open source and peer reviewed." Yet his article wonderfully illustrates the opposite.
jaekwon 13y ago
What alternatives are there for group chatting?
mxcm 13y ago
It would almost be too comical if cryptocat was actually sponsored (developed)? in proxy by some secret service. In general, people that use cryptocat are probably using it to discuss more intellectual thoughts, such thoughts might be useful to record and analyze. It is interesting that as the relative adoption of the service grew, the encryption mechanism became weaker..

516 points by thejosh 13y ago

616c 13y ago

Unfortunately I am not too well-versed in cryptography, and I guess I must start taking the Matasano crypto challenge. I am very scared too use most crypto platforms for reasons like this; I would never have picked up on such stuff. I only trust PGP because it has decades of skepticism and so far no one has scared me out of using that. The other stuff needs more eyeballs, and I am more or less blind. Time to read some books.

jiggy2011 13y ago
What about NACL? http://nacl.cr.yp.to/index.html http://nacl.cr.yp.to/index.html Seems to provide most of the building blocks you would need and has bindings for various languages.
- 616c 13y ago
  I have seen it. I am a middling programmer at best. I guess I need to step it up.

mahmoudhossam 13y ago

I'm pretty sure there's a nicer way of saying "You're doing crypto wrong." I don't know the author of either software, but as software professionals we have to maintain a certain level of respect for one another.

rorrr2 13y ago
People relied on crypto.cat, some probably with their lives. Who gives a crap about hurt feelings of the author who failed at crypto for so long, while advertising it as secure?
- pfortuny 13y ago
  It is not "hurt feelings", it is "the tone of the environment." Really, education and politeness have much more to do with "building a strong society" (and by society I mean "developers' environment") than "not hurting the feelings of an individual." Think big, not small. Think long-term, not short. Think global, not local. If you do these, then you will end up also thinking small, short and local. (Edit typos etc) Reedit: The first comment by DanBC is what I deem "polite criticism". One does not need to mince words but one does not need to insult either.
  - throwaway2048 13y ago
    Sorry, but people that continually ignore polite advice to the detriment of the community badly need naming and shaming like this. People's lives are literally on the line.
    - raganwald 13y ago
      Way to miss the point. This isn't about Nadim. Ask yourself this question: If there's an intelligent person with expert skills to contribute to either of two communities, and one of them is full of naming and shaming but the other iusn;t, where will they go?
      - Nursie 13y ago
        If they're into crypto, hopefully the one with a robust attitude to handling security flaws, rather than the one where pointing them out is considered bad form.
  - rorrr2 13y ago
    Why should we be polite to a person who endangered people who relied on his expertise? He had one task (that he chose), that task was extremely sensitive and had to be implemented correctly. He failed. Shaming and ridicule is the least he deserves.
    - 13y ago
DanBC 13y ago
People tried politely telling Cryptocat that they were doing crypto wrong. Cryptocat ignored those people. Cryptocat dismissed the advice they were being given.
flarg 13y ago
I disagee, The cryptocat team must 'suck it up' and do better, or GTFO. If they know anything about their field, they should not expect any respect or politeness. As software professionals we have a responsibility to accept criticisms from others in our field, no matter what their tone and manner may be - and this is especially true in crypto. In our field we have a lot of very bright people with literally no politeness or respect - and we must still work with them to make things better.

DanBC 13y ago

Cryptography is hard. Software is full of bugs. Most of those bugs can be left without too much impact on the users. See any bug tracker for bugs which have been left for years. With cryptographic software a small, subtle, hard to find bug could render the product pointless; could make the cryptography trivially easy to crack. Smart people and many eyes make mistakes with crypto. See, for example, the random number generator bug in Debian. People learn by doing. They read a book or two, they read some source code, and then they implement their own version. This is especially dangerous for crypto because these people might not understand the bugs they've created. It's fine to release your code snippets as "proof of concept" or "demonstrations" so long as you give warnings that these are not to be used in real life. Cryptocat did not give those warnings. Cryptocat said it was secure. They ignored the advice from many people. They even took the ultimate snakeoil step of running a competition to crack their software. Except the badguys are not going to enter your competition; the badguys either already know how to break the crypto or they use all the publicly available entries as help. People shouldn't have been waiting for something like DecryptoCat before they stopped using CryptoCat. It's particularly frustrating because people risk death or torture or long term imprisonment in some parts of the world, and they need strong crypto. (https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...)

sneak 13y ago
> Cryptocat did not give those warnings. Cryptocat said it was secure. They ignored the advice from many people. Yeah, I saw a bunch of people I respect saying things like "Nadim[1] is a good kid and he's learning, give him the benefit of the doubt" when I suggested that nobody use CryptoCat. But... > It's particularly frustrating because people risk death or torture or long term imprisonment in some parts of the world, and they need strong crypto. We have an obligation to the safety of others (especially in light of the fact that we know all the transmitted cyphertext is being stored) to denounce poor crypto implementations whenever and wherever we see them, regardless of the implementor. [1] https://en.wikipedia.org/wiki/Nadim_Kobeissi https://en.wikipedia.org/wiki/Nadim_Kobeissi
mtgx 13y ago
I don't know what he usually says, because I don't follow him, but I remember hearing him in a speech say that "you shouldn't use Cryptocat if your life depends on it" or something like that. I've just checked, and he seems to give that warning on the site, although below the fold: "Cryptocat is not a magic bullet. You should never trust any piece of software with your life, and Cryptocat is no exception" https://crypto.cat/ https://crypto.cat/

zainny 13y ago

What is it with people in the crypto community always coming across as complete and utter jerks? Question for those in this space: is it possible for you to give constructive criticism for a project without calling people "incompetent"? Seriously, if there any domain in CS more full of these types of personalities I can't think of it.

DanBC 13y ago
> is it possible for you to give constructive criticism for a project without calling people "incompetent"? Cryptocat had many such bits of constructive criticism. They chose to ignore it. They continued to promote their broken product as secure.
- zainny 13y ago
  You're making statements like that in a very matter of fact way. Can you please give references? It seems to me like the developers have been earnestly trying to build and improve on Cryptocat and shore up any weaknesses only to be constantly shit on your typical internet crypto experts.
  - DanBC 13y ago
    > earnestly trying to build and improve on Cryptocat and shore up any weaknesses The release an insecure product. People tell them it's insecure, and that they don't know what they're doing, and that they should stop. They make a tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. At this point, imagine no-one tells them about any bugs. Does that mean the product is secure? Does that mean people should be using it? Here's one thread on HN where they get mostly polite advice (https://news.ycombinator.com/item?id=2855257 https://news.ycombinator.com/item?id=2855257) and the whack-a-mole game of "our software is secure", "here's a bug", tweak "Our software is secure" happens. Here's a nice article about the hype surrounding cryptocat (which, admittedly, isn't the fault of cryptocat) (http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hyping-unproven.html http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hy...)

boi_v2 13y ago

I wish people would get involved with projects like Cryptocat instead of pointing the finger with some kind of superiority that will never construct anything, at least this is what I would do if I were a Cryptographer, but why bother? It is better to work for a bank and use others mistakes to make some self-promotion and maybe feel better with myself. You missed a excellent opportunity to make some good.

dionyziz 13y ago
You're right. However, the guy actually did write a patch for Cryptocat, so you have to give him that.
- _djo_ 13y ago
  Which was subsequently modified to make it less secure before being added to the project. That tends to dampen one's enthusiasm to contribute.
  - thezoid 13y ago
    It's always fun to watch patches you make to projects get removed or changed a few weeks/months later for arbitrary reasons :(
jlgreco 13y ago
If I were to write a book that pretended to teach laymen how to perform major surgery in their own kitchen, would it be reasonable for real surgeons to tell me to knock it the fuck off, or should they "get involved" and attempt to provide me with constructive criticism?
- StavrosK 13y ago
  Your analogy means that people shouldn't expect to have secure group chatting capability. It would be more like (groan) saying "I want to perform surgery in my kitchen so I'll just read some books while I'm opening the person up, but real surgeons are telling me to knock it the fuck off and read all the books before trying it". It's legitimate and commendable to try to write your own cryptosystem, but winging it is not going to end well.

kimlelly 13y ago

Give RetroShare a try: http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ It's: 1. Decentralized (real p2p, no central servers) 2. Encrypted communication 3. Easier to set up than encrypted email: Install -> Exchange "certificates" -> Done.

deleted 13y ago
[deleted]
InternalRun 13y ago
You need to stop spamming this.
makomk 13y ago
4. Not developed by cryptographers.

davidw 13y ago

> The bug that lasted 347 days was the confusion between a string and an array of integers. Maybe they are Erlang programmers :-)

rwg 13y ago
Every programmer should be forced to implement a non-trivial algorithm that involves lots of bit twiddling in a few languages that don't have integers ("all you need are double-precision IEEE 754 floats...and love!"), don't have unsigned integers, have undefined or implementation-specific integer sizes, and/or don't have a "convenient" string type.
- tptacek 13y ago
  Watch out, he's just trying to get you to implement ECDLP in Applescript and DOS BAT files.
- Dylan16807 13y ago
  Honestly I think you need to make that challenge harder. Lua, for example, has built-in 32-bit bitwise operations despite having no integer types. I did a prototype implementation of SHA3 and it was a walk in the park, I wouldn't expect that to change with a larger algorithm.

noonespecial 13y ago

Cryptography is different than regular software. It requires even more than full transparency or even "full" competency. It requires radical humility. Both from the creators and the critics. Once the dialog stops, sides are chosen and people dig in, the project fails regardless of how well or poorly it had been doing.

leke 13y ago

Steve's pages are very easy on the eyes.

EliRivers 13y ago

Also I learned that it means nothing when I hear "it is open source and peer reviewed". I get his point, but I take exactly the other conclusion from this; perhaps ironically, because Steve Thomas has ripped it to pieces and gone to town on the code, as long as the flaws he found are fixed, I now have greater faith in it because it's open source and peer reviewed - Steve Thomas' own peer review is a big part of that. Perhaps we should take open source and peer reviewed as meaning it can be peer reviewed; it's still on us to check who's done those reviews and, if needs be, do it ourselves and give something back.

deleted 13y ago
[deleted]

ParadisoShlee 13y ago

Nadim Kobeissi spends most of his spare time fighting with people who know better. This is no surprise. I remember the 50 long twitter reply chains with a number of crypto developers calling him out for bad design choices.

davidw 13y ago

For all the people ranting about what an incompetent this guy is, why does no one complain that stuff like GPG is so complicated that 1) Ordinary people probably can't use it. 2) It probably would be pretty easy to talk ordinary people into sending you their private keys/passphrases/etc... in the guise of 'helping' them, because it's so complicated. No one seems to talk about horrible complexity as a big security vulnerability. Also, I agree that there is something not quite right in the security community that often makes them talk with their Comic Book Guy voices.

DanBC 13y ago
eh, I've said that many times. I've even said it on HN.
- zainny 13y ago
  But why would anyone even bother trying to fix the situation? Any attempt to will just result in the entire crypto community community calling you "worthless" and "unqualified". This is the entire problem. Funnily enough, I imagine the original implementers of the major crypto libraries we use today and take for granted would probably equally be called "idiots" and "losers" if judged by today's internet crypto heroes. The crypto community is flat out toxic. You ain't gonna see progress from anywhere until the situation changes.
  - davidw 13y ago
    I think you're being unfair by painting them all with the same brush. But there is definitely a 'tone' in that community that I find very off-putting. This thread was interesting - tptacek seems like a nice enough guy - he's very helpful here and certainly knowledgeable, and generally pleasant to interact with: https://news.ycombinator.com/item?id=5776111 https://news.ycombinator.com/item?id=5776111 I agree with you that the "don't do that" attitude seems a bit... binary. Who decides who gets to do what? At what point does it become 'ok' to do crypto stuff? What kind of crypto stuff? Putting together pieces like SSL and GPG? Writing crypto libraries? New crypto algorithms? I'm mostly a believer in leaving the latter to people who have demonstrable competence in the field, but lots of people need to put together pieces in some way and the "don't do that" attitude does not really solve that problem.

tptacek 13y ago

The hardest part of this to read for me isn't the vulnerability, but rather: 2011 Passwords: BPKDF2-HMAC-SHA1 with 1000 iterations 2011 Passwords: BPKDF2-HMAC-SHA1 with 600 iterations 2011 768 bit RSA 2011 512 bit RSA 2011 600 bit RSA 2011 1280 bit RSA 2011 1024 bit RSA 2011 1048 bit RSA 2011 1536/1152 bit RSA (Chrome/other) 2011 1536/1024 bit RSA (Chrome/other) 2011 "3072 bit" D-H 2011 "3072 bit" D-H 2011 "4096 bit" D-H 2012 ECC Curve25519 (edited for clarity) Major red flag. The difference between symmetric-keyed password-based encryption, RSA, Diffie-Hellman and ECC (presuming ECDH?) isn't minor; it isn't a feature-level distinction. These are radically different designs. I'm not sure I've ever seen a system as popular as this so quickly take a tour of so much of cryptography. How could anyone have any kind of grip on the safety of a system that fundamentally changes its crypto constructions so often? A lesson here: if you have to implement cryptography --- and you and your users would be much better off if you didn't, and rather relied on a standard implementation like PGP --- do one thing and stick with it. Think of it like being a little kid lost in a shopping mall. Don't make it harder to get found.

jiggy2011 13y ago
What about NACL? It seems more flexible that PGP but still provides a fairly high level of abstraction. Not sure what is a good library for doing PBKDF2 or similar though.
- tptacek 13y ago
  I like Nacl. I also like Keyczar. I would be very worried about a project that oscillated from PGP to Nacl to Keyczar, though.
- drostie 13y ago
  Probably the best KDF you'll get right now is scrypt[1]. NaCl did not see common adoption because until a relatively recent distribution called Sodium[2], it was not portable. And I mean really, not portable. Like, just to give an example, suppose you want to use NaCl in Node.js, which is pretty good about accepting C/C++ modules. You have two options today: one doesn't work on a 64-bit system[3] and one isn't C, it's JS which was transpiled with Emscripten[4]. I mean, don't get me wrong: the fact that we can now do this in pure JS via Emscripten is amazing, but yeah, NaCl was not universally buildable and therefore was not reliably deployable, and nobody really wanted to fix it until Sodium came along. [1] https://www.tarsnap.com/scrypt.html https://www.tarsnap.com/scrypt.html [2] https://github.com/jedisct1/libsodium https://github.com/jedisct1/libsodium [3] https://github.com/thejh/node-nacl https://github.com/thejh/node-nacl [4] https://github.com/tonyg/js-nacl https://github.com/tonyg/js-nacl

amouat 13y ago

Crytpocat have now posted a reply: https://blog.crypto.cat/2013/07/new-critical-vulnerability-in-cryptocat-details/ https://blog.crypto.cat/2013/07/new-critical-vulnerability-i...

phryk 13y ago

https://blog.crypto.cat/2013/07/new-critical-vulnerability-in-cryptocat-details/ https://blog.crypto.cat/2013/07/new-critical-vulnerability-i... There seems to be a response to this on the cryptocat dev blog. Since I have no clue about crypto, I can't make any assessments though; Still might be interesting for some of you guys.

deleted 13y ago

[deleted]

plg 13y ago

Nadim has a good idea here in Cryptocat. The implementation has some problems, clearly. Is anyone surprised (including Nadim)? Clearly Nadim is learning as he goes. Let's dispense with the personal attacks and instead, if we think Cryptocat is a good idea, let's help make it as secure as we can. Can we get experienced crypto experts on board? Nadim ought to be interested in that.

DanBC 13y ago
Cryptocat have rejected the advice from experienced crypto experts. Cryptocat have been given a lot of advice and they argue against it; they tell experienced crypto experts that they are wrong and that the flaws are not really flaws.
- plg 13y ago
  If this is true, then it is disappointing.

deleted 13y ago

[deleted]

dobbsbob 13y ago

Shouldnt this be called DecryptoDog? I've never trusted any in browser/java nonsense crypto since FireGPG was exposed for dozens of problems and leaks.

parennoob 13y ago

BTW, everyone using the "But lives depend upon this, the CryptoCat author put lives at risk!" argument to excuse Steve Thomas's attacking tone in this article is more or less being a hypocrite. What about the fact that Steve Thomas, by releasing a tool that makes it extremely easy to decrypt the conversations encoded by CryptoCat at specific times, has done exactly the same thing? Disclosing a vulnerability in this public manner and providing a decryption tool on a platter has probably done more damage to the hypothetical journalists who were hypothetically using CryptoCat. I don't think bad crypto should be forgiven, but it would be easier and probably less arrogant to just submit a diff / pull request publicly that fixes all of the problems that the author observed, and then have people comment upon it. If the author rejects it, these "you are incompetent" comments can go there. Arrogant takedowns like this "the author clearly has no effing idea about crypto" make it more difficult for newbies like me to understand and try to work on crypto. What chance do I have if any piece of software I write is going to be destroyed by withering comments like "you're a moron" without mathematically explaining what the problem is and laying out the fixes clearly and positively?

corresation 13y ago
by releasing a tool that makes it extremely easy to decrypt the conversations encoded by CryptoCat at specific times, has done exactly the same thing? Assuming that cryptocat is used to avoid the monitoring of entire nations, you can be absolutely certain that those with the motivations have long ago cracked this. That is exactly why security professionals get so passionate about this, because they know that bad crypto is literally much worse than no crypto at all -- at least in the latter case you have no illusions. Cryptocat has been under significant criticism for a long time. For instance- https://news.ycombinator.com/item?id=5194713 https://news.ycombinator.com/item?id=5194713 -and for very good reason. After the farcical story about being investigated by CSIS (which seems laughable, because if there's one thing that government security agencies love, it's bad crypto), this project seems to be held aloft by nothing more than people saying "But he's young and passionate, so give him a chance" -- that isn't credible reasoning for crypto.
DanBC 13y ago
> that fixes all of the problems Yet again: Cryptocat is broken. It is so broken that there is no possibility of making it work.

mtgx 13y ago

Are there any implications for the WebCrypto API after this? I think he used Javascript crypto at first, but not sure after he turned it into a "Chrome app" (presumably based on Native Client - or is it still Javascript?).

networked 13y ago

Rolling your own crypto is incredibly perilous. Now, the Cryptocat team could discard their own code, compile GnuPG with emscripten [1] and adopt the existing UI/UX to using that but who's to say GnuPG is still going to work correctly on that new platform? The only "easy" (if insane) solution I can think of for building GPG on a known platform and still having it run in the browser is to use something like JSLinux [2] and run GnuPG inside a hidden VM communicating with it over an emulated serial interface. Then again, I'm sure that could introduce all sorts of interesting issues related to timing and randomness. Cryptography is damn hard. Edit: I'm aware that they've used CryptoJS but, much like calling OpenSSL directly, I would still count that as "rolling your own". [1] See, e.g., http://manuels.github.io/unix-toolbox.js-gnupg/ http://manuels.github.io/unix-toolbox.js-gnupg/. [2] http://bellard.org/jslinux/ http://bellard.org/jslinux/

amouat 13y ago
But they didn't roll their own crypto as far as I can tell. They used CryptoJS [1]. They just failed to use it correctly. EDIT: Here's the code https://github.com/cryptocat/cryptocat/blob/master/src/core/js/lib/multiParty.js#L37 https://github.com/cryptocat/cryptocat/blob/master/src/core/... [1] https://code.google.com/p/crypto-js/ https://code.google.com/p/crypto-js/
amouat 13y ago
Whilst there may still be plenty of scope for error, I think there is a large difference between using CryptoJS and "rolling your own". I wonder how "correct" CryptoJS itself is though.
- networked 13y ago
  > Whilst there may still be plenty of scope for error, I think there is a large difference between using CryptoJS and "rolling your own". I agree to some extent but as the article we're commenting on proves, the scope for error is enough for you to render your encryption useless against an attacker armed with just a modern desktop PC.

wyck 13y ago

Does anyone remember this.. https://news.ycombinator.com/item?id=5194489 https://news.ycombinator.com/item?id=5194489 The story where he thought his computer was backdoored by a government agency and provides no evidence other than some weird paranoid hunches. His original blog post http://log.nadim.cc/?p=110 http://log.nadim.cc/?p=110 has been removed, but you can find it here: https://gist.github.com/chrisbutcher/4748293/ https://gist.github.com/chrisbutcher/4748293/

mykhal 13y ago

i think that someone, who is teaching others that they are writing crap crypto, should express himself less vaguely than like: "... depending on your browser you might get these two lines of extra data ..." (in "public key")

coldcode 13y ago

If everyone here who complains about the folks behind Cryptocat being dumb is such much smarter, how about some of you build something like this so we can all see compare. Commenting in HN doesn't prove you know better, ship something and we can all be sure.

DanBC 13y ago
I genuinely don't know if you're trolling or not. Some of the people criticising cryptocat are respected, knowledgeable, experienced researchers with shipped product used by many people everyday. Other people criticising cryptocat know enough about crypto to know that they should not be doing it. That's not a negative, that's a strong positive point.

kragen 13y ago

I was really hoping Nadim would be successful with CryptoCat, but at least in my eyes, this bug is the failure of the project — especially because his response is, "Cryptocat is not any different from any of the other notable privacy, encryption and security projects, in which vulnerabilities get pointed out on a regular basis and are fixed. Bugs will continue to happen in Cryptocat, and they will continue to happen in other projects as well. This is how open source security works." <http://blog.crypto.cat/2013/07/new-critical-vulnerability-in-cryptocat-details/> http://blog.crypto.cat/2013/07/new-critical-vulnerability-in... No. This is how open-source "security" fails. GnuPG has not had a security bug since 2008, and I don't think it's ever had a security bug that left your encrypted messages open to interception. You can't start with insecure cryptographic software and bugfix it until it's secure. You'll just bugfix it until only the bad guys know where the new holes are. How long has the Russian equivalent of the NSA (or, if you're Russian, the NSA) known about Lucky Thirteen, for example? How long did they know about the Million Message Attack? (That, and the array of "15-bit" single-digit integers.)

mgraczyk 13y ago

I would just like to say that it makes me very happy to see even modestly technical discussions about cryptology make it so high up on HN. Lately it has seemed like all the highly ranked articles have been about the PEOPLE or COMPANIES doing crypto, and not about the cryptology itself. Crypto is interesting not because people are doing it, breaking it, and improving it every day. Crypto is interesting because of HOW people are breaking it and improving it.

blt 13y ago

There should be no benefit of the doubt or warm encouragement for these developers. The bug with the array of decimal digits shows minimal programming competence: the author either does not understand how numbers and strings work in a computer, or doesn't read API documentation. Nadim seems like a naive person without a computer science background who is attracted to cryptography as an activist, but has no knowledge beyond a 3-page tutorial. It is extremely arrogant and irresponsible for a developer with such little domain expertise to promote this product as secure.

deleted 13y ago

[deleted]

TempleOS 13y ago

It's mean to tickle the president or a person. ------------------------------------------------ Daniel 5 New International Version (NIV) The Writing on the Wall 5 King Belshazzar gave a great banquet for a thousand of his nobles and drank wine with them. 2 While Belshazzar was drinking his wine, he gave orders to bring in the gold and silver goblets that Nebuchadnezzar his father[a] had taken from the temple in Jerusalem, so that the king and his nobles, his wives and his concubines might drink from them. 3 So they brought in the gold goblets that had been taken from the temple of God in Jerusalem, and the king and his nobles, his wives and his concubines drank from them. 4 As they drank the wine, they praised the gods of gold and silver, of bronze, iron, wood and stone. 5 Suddenly the fingers of a human hand appeared and wrote on the plaster of the wall, near the lampstand in the royal palace. The king watched the hand as it wrote. 6 His face turned pale and he was so frightened that his legs became weak and his knees were knocking. 7 The king summoned the enchanters, astrologers[b] and diviners. Then he said to these wise men of Babylon, “Whoever reads this writing and tells me what it means will be clothed in purple and have a gold chain placed around his neck, and he will be made the third highest ruler in the kingdom.” 8 Then all the king’s wise men came in, but they could not read the writing or tell the king what it meant. 9 So King Belshazzar became even more terrified and his face grew more pale. His nobles were baffled. 10 The queen,[c] hearing the voices of the king and his nobles, came into the banquet hall. “May the king live forever!” she said. “Don’t be alarmed! Don’t look so pale! 11 There is a man in your kingdom who has the spirit of the holy gods in him. In the time of your father he was found to have insight and intelligence and wisdom like that of the gods. Your father, King Nebuchadnezzar, appointed him chief of the magicians, enchanters, astrologers and diviners. 12 He did this because Daniel, whom the king called Belteshazzar, was found to have a keen mind and knowledge and understanding, and also the ability to interpret dreams, explain riddles and solve difficult problems. Call for Daniel, and he will tell you what the writing means.” 13 So Daniel was brought before the king, and the king said to him, “Are you Daniel, one of the exiles my father the king brought from Judah? 14 I have heard that the spirit of the gods is in you and that you have insight, intelligence and outstanding wisdom. 15 The wise men and enchanters were brought before me to read this writing and tell me what it means, but they could not explain it. 16 Now I have heard that you are able to give interpretations and to solve difficult problems. If you can read this writing and tell me what it means, you will be clothed in purple and have a gold chain placed around your neck, and you will be made the third highest ruler in the kingdom.” 17 Then Daniel answered the king, “You may keep your gifts for yourself and give your rewards to someone else. Nevertheless, I will read the writing for the king and tell him what it means. 18 “Your Majesty, the Most High God gave your father Nebuchadnezzar sovereignty and greatness and glory and splendor. 19 Because of the high position he gave him, all the nations and peoples of every language dreaded and feared him. Those the king wanted to put to death, he put to death; those he wanted to spare, he spared; those he wanted to promote, he promoted; and those he wanted to humble, he humbled. 20 But when his heart became arrogant and hardened with pride, he was deposed from his royal throne and stripped of his glory. 21 He was driven away from people and given the mind of an animal; he lived with the wild donkeys and ate grass like the ox; and his body was drenched with the dew of heaven, until he acknowledged that the Most High God is sovereign over all kingdoms on earth and sets over them anyone he wishes. 22 “But you, Belshazzar, his son,[d] have not humbled yourself, though you knew all this. 23 Instead, you have set yourself up against the Lord of heaven. You had the goblets from his temple brought to you, and you and your nobles, your wives and your concubines drank wine from them. You praised the gods of silver and gold, of bronze, iron, wood and stone, which cannot see or hear or understand. But you did not honor the God who holds in his hand your life and all your ways. 24 Therefore he sent the hand that wrote the inscription. 25 “This is the inscription that was written: mene, mene, tekel, parsin 26 “Here is what these words mean: Mene[e]: God has numbered the days of your reign and brought it to an end. 27 Tekel[f]: You have been weighed on the scales and found wanting. 28 Peres[g]: Your kingdom is divided and given to the Medes and Persians.” 29 Then at Belshazzar’s command, Daniel was clothed in purple, a gold chain was placed around his neck, and he was proclaimed the third highest ruler in the kingdom. 30 That very night Belshazzar, king of the Babylonians,[h] was slain, 31 and Darius the Mede took over the kingdom, at the age of sixty-two.[i]

dakimov 13y ago

It is totally fine! Compare this to Android: http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/ http://bluebox.com/corporate-blog/bluebox-uncovers-android-m... Security, privacy, copyright — these are three problems the humankind is as dumb as a monkey with.

hnolable 13y ago

Does anyone know if there are any issues with the javascript OTR library they use (https://github.com/arlolra/otr https://github.com/arlolra/otr)? Or are all the issues only with their custom multi party chat encryption system?

arthulia 13y ago

> Both comments are wrong since "Cryptocat.randomString(64, 0, 0, 1, 0)" generates a string that is 64 decimal digits which is 212.6 bits or 26.6 bytes. How can you have .6 bytes or bits?

bmh100 13y ago
A bit is a 0 or a 1. Two bits is 00, 01, 10, or 11. Each bit doubles the amount of information. This means that information representing information as bits products powers of 2. To get the number of bits (the power of 2 to represent the number), one takes the log, base 2, of the number. If I took the example of 2 bits and limited it to 00, 01, 10, there would be 1.6 bits. Log2(3) = 1.6.

stefanix 13y ago

Author complains "I learned that it means nothing when I hear it is open source and peer reviewed." Yet his article wonderfully illustrates the opposite.

jaekwon 13y ago

What alternatives are there for group chatting?

mxcm 13y ago

It would almost be too comical if cryptocat was actually sponsored (developed)? in proxy by some secret service. In general, people that use cryptocat are probably using it to discuss more intellectual thoughts, such thoughts might be useful to record and analyze. It is interesting that as the relative adoption of the service grew, the encryption mechanism became weaker..