Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptocat for iPhone and Android – Call for Review

blog.crypto.cat

Post reply on HN
Print view View original

21–30 of 84 posts

Re: Cryptocat for iPhone and Android – Call for Review

#21

Post by DanBC »

pablobaz wrote: post #19

Easy to be snarky about this. But I admire their persistence. In the face of the extensive criticism they could have just given up. Instead they have acknowledged making mistakes, didn't give up, learnt from the mistake and changed their subsequent behavior. This is admirable.

Compare them to underground dentists -

Bob has no medical training, but has a dremel and practiced on a pig head. He offers to do a filling for his pal. He makes a bit of a botch of it, but he larns from his mistake and carries on. Dentistry is important so it's admirable that Bob ignores the criticism. Bob's first pal is currently fighting off a severe infection, but Bob uses that as a learning experience.

Bob will get there one day!

Re: Cryptocat for iPhone and Android – Call for Review

#22

Post by lemonlimebubble »

magikarp wrote: post #18
lemonlimebubble wrote: post #15

Earlier quoted context omitted.

Hi, I am working on a security-focussed startup. We have a rough cut of our initial product offering due in the next month and are trying to get initial trial users and customers on board to help us demonstrate interest. How do you manage to afford to finance the audits and bug bounties? We have found that some potential customers want to see us get security audited before trusting our solution, but from what we can…

> How do you manage to afford to finance the audits and bug bounties? Public donations from our website and funding from public institutions and NGOs. Currently, our audits are funded by the Open Technology Fund: https://www.opentechfund.org Generally, our funding tends to be very limited though, so sometimes we have to ask someone to do an audit for cheaper than they usually would, seeing as we're an open source pro…

Ah, so basically, as a for-profit company aiming at a B2B enterprise product, we are screwed in this regard until we have the capital to absorb the audit cost through either revenue or investment. Oh well.

Re: Cryptocat for iPhone and Android – Call for Review

#23

Post by aortega »

magikarp wrote: post #4
fosap wrote: post #3

And why the hell should i use a app that is written by know poeple that prooven they have no clue about crypto? Why shouldn't i use one of the many apps that support OTR?

Cryptocat's private chat uses OTR. Our group chat function uses an open and studied multiparty protocol. Generally, our security bugs have been implementation errors much more than protocol design errors. Surely, the best we can do as a community project is open up our code for more volunteers and experts to help and take a look. :-)

It's fine that you have faith in your product but I will believe what you say when other people outside the project confirm it, otherwise is just marketing.

I do not use gnupg because the creators say it's nice, I use it because everybody including their competitors says it's OK.

Re: Cryptocat for iPhone and Android – Call for Review

#24

Post by magikarp »

pablobaz wrote: post #19

Easy to be snarky about this. But I admire their persistence. In the face of the extensive criticism they could have just given up. Instead they have acknowledged making mistakes, didn't give up, learnt from the mistake and changed their subsequent behavior. This is admirable.

Thank you very much for that comment.

I believe that we've been truly open source, transparent and accountable for our code since day one. There are other projects who are currently similarly open and transparent (I respect TextSecure for this,) but I can't say this is the standard in this field.

We've always solicited and compensated feedback from security enthusiasts, hobbyists and world-famous cryptographers alike. Over the past year, we've had the opportunity to grow into a product that examined what is fundamentally responsibly possible in the browser, and we've even landed ourselves as a primary use-case for the W3C's Web Cryptography working group. We've produced a true, responsible alternative for people who just don't know how to use anything more complicated than Facebook Chat, and we've made it clear that we are not trying to replace PGP or other iron-clad 30-year old solutions. We're trying to help mom and pop users.

Regarding our past vulnerabilities, I can't think of a fuller disclosure than dedicating an entire talk to detailing every single one of them: https://blog.crypto.cat/2013/11/documenting-and-presenting-v...

We also carried out a study to verify whether users were indeed clicking on the security warnings on our website: https://blog.crypto.cat/2013/11/yes-cryptocat-users-are-read...

We want to do things right. We are truly open source, truly honest, transparent and we take immediate steps for mitigation every time. We will continue to solicit audits and feedback for our more experimental browser client, but also hope to have a more grounded product in our upcoming Objective-C (iPhone) and Java (Android) apps.

Overcoming a bad reputation is extremely more difficult than keeping a good one. We have been less lucky than other projects. The fact that we used experimental platforms and coupled that with overly loud disclosure of all the failures those platforms lended us meant that we couldn't keep face as easily as other projects.

But that said, I can't but resent the continued accusation that after three years at this, myself and all other volunteers (a wide range) working on this haven't matured enough to know what we're doing, and haven't proven that we care very much to do it right. It's very relieving to hear that the community at HN can understand this and see that we have been proceeding responsibly for quite some time now.

Re: Cryptocat for iPhone and Android – Call for Review

#25

Post by iagooar »

magikarp wrote: post #14
iagooar wrote: post #12

You know that using a .cat domain for something not related to Catalan culture or language is not allowed by the conditions established by ICANN and Fundació puntCAT? You have only translated the main page (with Google Translator...) to make it look like you have some Catalan content there. That's naughty. "In order to be granted a .cat domain, one needs to belong to the Catalan linguistic and cultural community on t…

Cryptocat's website and the Cryptocat app itself are both fully translated into Catalan, and we maintain a very communicative and open relationship with PuntCAT.

The only page I have found in Catalan so far is the homepage, and it is translated 50% by Google and 50% by someone who probably did not even finish high school.

I'm happy that the app is translated into Catalan. I hope the translation is better than the one on the website.

Just wanted to make sure you know what this domain is actually used for.

Re: Cryptocat for iPhone and Android – Call for Review

#26

Post by TallGuyShort »

DanBC wrote: post #21
pablobaz wrote: post #19

Easy to be snarky about this. But I admire their persistence. In the face of the extensive criticism they could have just given up. Instead they have acknowledged making mistakes, didn't give up, learnt from the mistake and changed their subsequent behavior. This is admirable.

Compare them to underground dentists - Bob has no medical training, but has a dremel and practiced on a pig head. He offers to do a filling for his pal. He makes a bit of a botch of it, but he larns from his mistake and carries on. Dentistry is important so it's admirable that Bob ignores the criticism. Bob's first pal is currently fighting off a severe infection, but Bob uses that as a learning experience. Bob will…

If a growing portion of the dentistry industry was discovered to have been weakening people's teeth at the government's request, I'd start to buy Bob a beer a little more often.

Re: Cryptocat for iPhone and Android – Call for Review

#27

Post by [deleted] »

TallGuyShort wrote: post #26
DanBC wrote: post #21

Earlier quoted context omitted.

Compare them to underground dentists - Bob has no medical training, but has a dremel and practiced on a pig head. He offers to do a filling for his pal. He makes a bit of a botch of it, but he larns from his mistake and carries on. Dentistry is important so it's admirable that Bob ignores the criticism. Bob's first pal is currently fighting off a severe infection, but Bob uses that as a learning experience. Bob will…

If a growing portion of the dentistry industry was discovered to have been weakening people's teeth at the government's request, I'd start to buy Bob a beer a little more often.

[deleted]

Re: Cryptocat for iPhone and Android – Call for Review

#28

Post by diminoten »

So there's a DC hackathon[0] taking place this weekend, and Cryptocat is on the list of projects to work on.

I imagine the Android and iOS apps would be ripe targets for bug finding adventures, but are there any places specifically that could use the kind of scrutiny that such an event could provide?

[0] - http://www.eventbrite.com/e/dc-internet-freedom-hackathon-ti...

Re: Cryptocat for iPhone and Android – Call for Review

#29

Post by magikarp »

diminoten wrote: post #28

So there's a DC hackathon[0] taking place this weekend, and Cryptocat is on the list of projects to work on. I imagine the Android and iOS apps would be ripe targets for bug finding adventures, but are there any places specifically that could use the kind of scrutiny that such an event could provide? [0] - http://www.eventbrite.com/e/dc-internet-freedom-hackathon-ti...

Yup! I'm leaving for D.C. tomorrow and will be at that hackathon. Please come and help!

Re: Cryptocat for iPhone and Android – Call for Review

#30

Post by jonny_eh »

iagooar wrote: post #25
magikarp wrote: post #14

Earlier quoted context omitted.

Cryptocat's website and the Cryptocat app itself are both fully translated into Catalan, and we maintain a very communicative and open relationship with PuntCAT.

The only page I have found in Catalan so far is the homepage, and it is translated 50% by Google and 50% by someone who probably did not even finish high school. I'm happy that the app is translated into Catalan. I hope the translation is better than the one on the website. Just wanted to make sure you know what this domain is actually used for.

Are you offering to help with more Catalan translations?
Post reply on HN