Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CryptoCat iOS Application Penetration Test [pdf]

isecpartners.github.io

Post reply on HN
Print view View original

1–10 of 137 posts

Re: CryptoCat iOS Application Penetration Test [pdf]

#4

Post by rancor »

When I saw one of the main CryptoCat developers present in 2012, I came away with the impression that nobody on the core team understood crypto, security, or software engineering. This audit is another rock on the mountain of evidence I've seen supporting this impression in the following years.

A really nice job by iSec, though.

Re: CryptoCat iOS Application Penetration Test [pdf]

#5

Post by natdempk »

Also of interest is their blog post about how they plan to handle the issues described in this report: https://blog.crypto.cat/2014/04/recent-audits-and-coming-imp...

Reading that, I still am not sure why anyone would use CryptoCat especially with things like TextSecure on the market that seem to take crypto far more seriously. The only reason I can see for that is that they have clients on more platforms, but if this is similar to the state of all of them, then what's the point?

Re: CryptoCat iOS Application Penetration Test [pdf]

#6

Post by pokstad »

imkevinxu wrote: post #3

Didn't realize how vulnerable even a simple NSLog was... I wonder how many websites have sensitive information they console.log but forgot to take out for production

Remember when the iPhone was under fire for logging everywhere a user went? That was due to careless devs logging location data. Also, logging data is a blocking operation, so if done too often it slows the performance of an app.

CORRECTION: the 3rd party apps were part of it, along with Apple's own logging, when reported in the news.

Re: CryptoCat iOS Application Penetration Test [pdf]

#8

Post by kaeporan »

natdempk wrote: post #5

Also of interest is their blog post about how they plan to handle the issues described in this report: https://blog.crypto.cat/2014/04/recent-audits-and-coming-imp... Reading that, I still am not sure why anyone would use CryptoCat especially with things like TextSecure on the market that seem to take crypto far more seriously. The only reason I can see for that is that they have clients on more platforms, but if thi…

Thanks for linking to the blog post. This audit concerns a pre-release version of Cryptocat for iPhone. Many of the bugs were due to debugging code and were fixed before release.

Re: CryptoCat iOS Application Penetration Test [pdf]

#9

Post by sliverstorm »

venomsnake wrote: post #7

There is a "many ways to skin a cat" joke here somewhere. It is actually terrible - the hmac timing attack requires around 3 minutes of google searching to avoid and is basic public domain knowledge. The other are much worse.

I wish I knew how to find my way into security as a hobby. Such a fun topic.
Post reply on HN