6 ms·

Also of interest is their blog post about how they plan to handle the issues described in this report: https://blog.crypto.cat/2014/04/recent-audits-and-coming-

Also of interest is their blog post about how they plan to handle the issues described in this report: https://blog.crypto.cat/2014/04/recent-audits-and-coming-improvements/ https://blog.crypto.cat/2014/04/recent-audits-and-coming-imp... Reading that, I still am not sure why anyone would use CryptoCat especially with things like TextSecure on the market that seem to take crypto far more seriously. The only reason I can see for that is that they have clients on more platforms, but if this is similar to the state of all of them, then what's the point?

kaeporan 13y ago
Thanks for linking to the blog post. This audit concerns a pre-release version of Cryptocat for iPhone. Many of the bugs were due to debugging code and were fixed before release.
- tptacek 13y ago
  Which of the bugs were due to debugging code?
  - daira 13y ago
    Findings iSEC-RFACC0114-1 and iSEC-RFACC0114-3. (2 out of the 17 vulnerabilities found by iSec, of varying severity.)
- sneak 13y ago
  Why use donated money to pay for an audit of software that has known bugs and isn't ready yet? That's wasteful. The point of an audit is to find bugs you don't already know about.
  - ibmthrowaway218 13y ago
    It can be a useful technique for testing the quality of the audit. At a previous company we had to have words with a company that performed a software audit as they failed to find two issues we'd planted to test them. (Of course, they did find several things we didn't know about.)
mandalar12 13y ago
Has anyone done the same level of analysis on TextSecure ? I feel like their model/seriousness is better but there might be flaws in the implementation (or protocol) and being audited might highlight some of them.
- natdempk 13y ago
  I don't believe they've had an independent security audit. I think their team however is comprised of more respected cryptographers like Moxie Marlinspike, who introduced the concept of SSL stripping, one of the issues that was found in the CryptoCat app. I mean no disrespect to CryptoCat, and more eyes can always find something someone overlooked, but I think the Open Whisper Systems (TextSecure) team is stronger and using better cryptographic techniques.
  - tptacek 13y ago
    TextSecure also has design contributions from Trevor Perrin, who is also amazing.
    - nathan-at-least 13y ago
      natdempk and tptacek have both asserted that TextSecure is trustworthy and solid by dint of being implemented and designed by reliable experts. This pretty much boils down to argument by authority. mandalar12 asks about "the same level of analysis on TextSecure". Since our (Least Authority's) audit and the iSEC audit are public, random people on the internet can know what that level is, without having to know or rely on Least Authority or iSEC to be non-malicious. With enough eyes all bugs are shallow, but to whom? We need to communicate transparently to achieve this ideal. Disclaimers: I worked on the Least Authority audit of Cryptocat; I've worked at iSEC in the past; I've met Moxie Marlinspike and Trevor Perrin and greatly respect their expertise and motivations; I also don't know if they've been infected by malicious puppetmaster aliens since I last saw them.
      - daira 13y ago

kaeporan 13y ago

Thanks for linking to the blog post. This audit concerns a pre-release version of Cryptocat for iPhone. Many of the bugs were due to debugging code and were fixed before release.

tptacek 13y ago
Which of the bugs were due to debugging code?
- daira 13y ago
  Findings iSEC-RFACC0114-1 and iSEC-RFACC0114-3. (2 out of the 17 vulnerabilities found by iSec, of varying severity.)
sneak 13y ago
Why use donated money to pay for an audit of software that has known bugs and isn't ready yet? That's wasteful. The point of an audit is to find bugs you don't already know about.
- ibmthrowaway218 13y ago
  It can be a useful technique for testing the quality of the audit. At a previous company we had to have words with a company that performed a software audit as they failed to find two issues we'd planted to test them. (Of course, they did find several things we didn't know about.)

mandalar12 13y ago

Has anyone done the same level of analysis on TextSecure ? I feel like their model/seriousness is better but there might be flaws in the implementation (or protocol) and being audited might highlight some of them.

natdempk 13y ago
I don't believe they've had an independent security audit. I think their team however is comprised of more respected cryptographers like Moxie Marlinspike, who introduced the concept of SSL stripping, one of the issues that was found in the CryptoCat app. I mean no disrespect to CryptoCat, and more eyes can always find something someone overlooked, but I think the Open Whisper Systems (TextSecure) team is stronger and using better cryptographic techniques.
- tptacek 13y ago
  TextSecure also has design contributions from Trevor Perrin, who is also amazing.
  - nathan-at-least 13y ago
    natdempk and tptacek have both asserted that TextSecure is trustworthy and solid by dint of being implemented and designed by reliable experts. This pretty much boils down to argument by authority. mandalar12 asks about "the same level of analysis on TextSecure". Since our (Least Authority's) audit and the iSEC audit are public, random people on the internet can know what that level is, without having to know or rely on Least Authority or iSEC to be non-malicious. With enough eyes all bugs are shallow, but to whom? We need to communicate transparently to achieve this ideal. Disclaimers: I worked on the Least Authority audit of Cryptocat; I've worked at iSEC in the past; I've met Moxie Marlinspike and Trevor Perrin and greatly respect their expertise and motivations; I also don't know if they've been infected by malicious puppetmaster aliens since I last saw them.
    - daira 13y ago