Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptocat for iPhone and Android – Call for Review

blog.crypto.cat

Post reply on HN
Print view View original

11–20 of 84 posts

Re: Cryptocat for iPhone and Android – Call for Review

#11

Post by magikarp »

fosap wrote: post #9
magikarp wrote: post #4

Earlier quoted context omitted.

Cryptocat's private chat uses OTR. Our group chat function uses an open and studied multiparty protocol. Generally, our security bugs have been implementation errors much more than protocol design errors. Surely, the best we can do as a community project is open up our code for more volunteers and experts to help and take a look. :-)

Great to hear that you switched to older and audited code. Could you explain what relationship this app has to the javascript version?

There are currently three Cryptocat clients:

* Cryptocat: The original client. It's a signed browser extension that you download and install in your browser. It offers OTR implemented in JavaScript in a friendly chat interface. We take every precaution to make JavaScript more secure, such as using a signed browser extension to prevent code delivery MITM, using native cryptographically secure random number generation, and so on. More info on our JavaScript approach at my personal blog: http://log.nadim.cc/?p=33

* Cryptocat for iPhone: No JavaScript here! This is an app written in Cocoa Touch/Objective-C that implements OTR and our multiparty group chat protocol. It's really quite a simple app compared to what we had to do to put encrypted chat in the browser. It's new and needs review! Find bugs! Help a cool open source project! We'll send you rewards!

* Cryptocat for Android: No JavaScript here! This is an app written in Java that implements OTR and our multiparty group chat protocol. It's really quite a simple app compared to what we had to do to put encrypted chat in the browser. It's new and needs review! Find bugs! Help a cool open source project! We'll send you rewards!

All three clients are made to be 100% inter-operable.

Re: Cryptocat for iPhone and Android – Call for Review

#12

Post by iagooar »

You know that using a .cat domain for something not related to Catalan culture or language is not allowed by the conditions established by ICANN and Fundació puntCAT?

You have only translated the main page (with Google Translator...) to make it look like you have some Catalan content there. That's naughty.

"In order to be granted a .cat domain, one needs to belong to the Catalan linguistic and cultural community on the Internet. A person, organization or company is considered to belong if they either:[4]

  1. already have content in Catalan published online.
  2. have access to a special code (sometimes called ENS), issued during special promotions or by agreements with certain institutions.
  3. develop activities (in any language) to promote the Catalan culture and language.
  4. are endorsed by 3 people or 1 institution already using a .cat domain name."
Read more about it: http://en.wikipedia.org/wiki/.cat

Re: Cryptocat for iPhone and Android – Call for Review

#13

Post by magikarp »

poolpool wrote: post #2

Man they are a glutton for punishment.

I like to think that the Cryptocat team and myself have matured beyond the point where we consider security disclosures to be punishment, but rather something to be expected when handling a project that wields experimental technology. We're trying to be adults by adopting principles of full disclosure, mitigation, transparency, public involvement, and making sure our process is tweaked to prevent the repetition of past mistakes.

Re: Cryptocat for iPhone and Android – Call for Review

#14

Post by magikarp »

iagooar wrote: post #12

You know that using a .cat domain for something not related to Catalan culture or language is not allowed by the conditions established by ICANN and Fundació puntCAT? You have only translated the main page (with Google Translator...) to make it look like you have some Catalan content there. That's naughty. "In order to be granted a .cat domain, one needs to belong to the Catalan linguistic and cultural community on t…

Cryptocat's website and the Cryptocat app itself are both fully translated into Catalan, and we maintain a very communicative and open relationship with PuntCAT.

Re: Cryptocat for iPhone and Android – Call for Review

#15

Post by lemonlimebubble »

magikarp wrote: post #7
bqe wrote: post #5

Glad that they're taking security seriously. It's a sharp difference from how they used to do things[1]. However, I'd still like to see either an explicit bug bounty (there's one implied here) or a paid audit. [1]: http://blog.cryptographyengineering.com/2013/03/here-come-en...

From my perspective, we've been taking security seriously a year+. Our first commissioned audit was in November 2012, and we've had a bug bounty since then as well: https://crypto.cat/bughunt/ This isn't, of course, to say that there haven't been vulnerabilities. But I have to stand behind our mitigation and disclosure policy as being very highly responsible and transparent. So far, we've had three paid audits, with…

Hi, I am working on a security-focussed startup. We have a rough cut of our initial product offering due in the next month and are trying to get initial trial users and customers on board to help us demonstrate interest.

How do you manage to afford to finance the audits and bug bounties? We have found that some potential customers want to see us get security audited before trusting our solution, but from what we can tell this is a multi-hundred thousand dollar cost and requires us to freeze development while it takes place. We currently have zero day-to-day budget and runway for 6 months. How have you afforded it?

Re: Cryptocat for iPhone and Android – Call for Review

#16

Post by n3bu »

magikarp wrote: post #11
fosap wrote: post #9

Earlier quoted context omitted.

Great to hear that you switched to older and audited code. Could you explain what relationship this app has to the javascript version?

There are currently three Cryptocat clients: * Cryptocat: The original client. It's a signed browser extension that you download and install in your browser. It offers OTR implemented in JavaScript in a friendly chat interface. We take every precaution to make JavaScript more secure, such as using a signed browser extension to prevent code delivery MITM, using native cryptographically secure random number generation,…

I guess the third one should be the android version.

Re: Cryptocat for iPhone and Android – Call for Review

#17

Post by magikarp »

n3bu wrote: post #16
magikarp wrote: post #11

Earlier quoted context omitted.

There are currently three Cryptocat clients: * Cryptocat: The original client. It's a signed browser extension that you download and install in your browser. It offers OTR implemented in JavaScript in a friendly chat interface. We take every precaution to make JavaScript more secure, such as using a signed browser extension to prevent code delivery MITM, using native cryptographically secure random number generation,…

I guess the third one should be the android version.

Derp. Fixed. Thanks!

Re: Cryptocat for iPhone and Android – Call for Review

#18

Post by magikarp »

lemonlimebubble wrote: post #15
magikarp wrote: post #7

Earlier quoted context omitted.

From my perspective, we've been taking security seriously a year+. Our first commissioned audit was in November 2012, and we've had a bug bounty since then as well: https://crypto.cat/bughunt/ This isn't, of course, to say that there haven't been vulnerabilities. But I have to stand behind our mitigation and disclosure policy as being very highly responsible and transparent. So far, we've had three paid audits, with…

Hi, I am working on a security-focussed startup. We have a rough cut of our initial product offering due in the next month and are trying to get initial trial users and customers on board to help us demonstrate interest. How do you manage to afford to finance the audits and bug bounties? We have found that some potential customers want to see us get security audited before trusting our solution, but from what we can…

> How do you manage to afford to finance the audits and bug bounties?

Public donations from our website and funding from public institutions and NGOs. Currently, our audits are funded by the Open Technology Fund: https://www.opentechfund.org

Generally, our funding tends to be very limited though, so sometimes we have to ask someone to do an audit for cheaper than they usually would, seeing as we're an open source project with no source of revenue.

EDIT: Forgot to mention, we have no funding for bug bounties. I pay all bug bounties out of my own pocket. I don't mind, I feel the money is very well-spent.

Good luck with your startup!

Re: Cryptocat for iPhone and Android – Call for Review

#19

Post by pablobaz »

Easy to be snarky about this. But I admire their persistence.

In the face of the extensive criticism they could have just given up.

Instead they have acknowledged making mistakes, didn't give up, learnt from the mistake and changed their subsequent behavior. This is admirable.

Re: Cryptocat for iPhone and Android – Call for Review

#20

Post by utnick »

pablobaz wrote: post #19

Easy to be snarky about this. But I admire their persistence. In the face of the extensive criticism they could have just given up. Instead they have acknowledged making mistakes, didn't give up, learnt from the mistake and changed their subsequent behavior. This is admirable.

Agree , I really believe they are commited to security and openness. They should be a model for a lot of security focused companies out there. Security is a process.
Post reply on HN