5 ms·

Care to elaborate on that? I'm in the habit of more or less trusting the EFF, but I don't use cryptocat (no need for it) and I have heard that it is insecure. M

Care to elaborate on that? I'm in the habit of more or less trusting the EFF, but I don't use cryptocat (no need for it) and I have heard that it is insecure. My understanding (possibly flawed), is that it was mostly tied to the JS Crypto implementation. What about the rest of the scorecard?

tptacek 12y ago
You can look around for what other crypto and security people thought of the EFF scorecard. It was not well-regarded. They factored the JS into a Chrome application awhile back, and while Chrome-extension JS crypto isn't particular safe either (there are realistic side-channel attacks on it), it's not the cluster•••• that content-controlled JS crypto is. There are much, much bigger problems with Cryptocat than Javascript. I would also recommend avoiding the mobile apps, which are native.
- woah 12y ago
  Pray tell
Strom 12y ago
This is a good post pointing out some of the problems with CryptoCat http://tobtu.com/decryptocat.php http://tobtu.com/decryptocat.php
DanBC 12y ago
That scorecard carefully says that it's not an endorsement of any product yet here in this thread we have someone using it as an endorsement of a product. The scorecard lists "good features" and gives you a tick if you claim to offer that feature. The score card does not currently test any of those and certainly hasn't tested the auditing or done their own audit.