Cryptocat for iPhone and Android – Call for Review • Hacker News Board

Re: Cryptocat for iPhone and Android – Call for Review

#71

Post by MichaelGG » Fri, Jan 10, 2014, 4:36 AM UTC

rahimnathwani wrote: post #63

MichaelGG wrote: post #61

Earlier quoted context omitted.

Provinces can get ccTLDs - Taiwan has .tw. Sponsoring and getting .cat is a pretty cool workaround, though.

Can provinces really get ccTLDs? I thought .tw existed because Taiwan has an ISO country code: http://www.iso.org/iso/country_names_and_code_elements Having said that, I'm not sure why the UK (whose country code is GB) uses .uk

IANA considers .tw to be "Taiwan, Province of China", as does that ISO link. As I understand, China pretty much bullied everyone else into not recognizing Taiwan so the rest of the world (like the UN) agrees Taiwan isn't a country. That's why one reason Microsoft asks for your Region, not country.

There appear to be other ccTLDs like .IO and .AQ that aren't countries. (Probably more.)

And I'm just being pedantic.

Re: Cryptocat for iPhone and Android – Call for Review

#72

Post by dmacvicar » Fri, Jan 10, 2014, 8:12 AM UTC

Thiz wrote: post #44

iagooar wrote: post #12

You know that using a .cat domain for something not related to Catalan culture or language is not allowed by the conditions established by ICANN and Fundació puntCAT? You have only translated the main page (with Google Translator...) to make it look like you have some Catalan content there. That's naughty. "In order to be granted a .cat domain, one needs to belong to the Catalan linguistic and cultural community on t…

I've always wondered what is so special about catalan? Why do they deserve a special three letter domain nobody else has? Who should I address a letter to request for the wayuu culture to have a .way tld?

As a man married to a Catalan girl. Be careful where you are going :-).

Re: Cryptocat for iPhone and Android – Call for Review

#73

Post by rahimnathwani » Fri, Jan 10, 2014, 8:13 AM UTC

MichaelGG wrote: post #71

rahimnathwani wrote: post #63

Earlier quoted context omitted.

Can provinces really get ccTLDs? I thought .tw existed because Taiwan has an ISO country code: http://www.iso.org/iso/country_names_and_code_elements Having said that, I'm not sure why the UK (whose country code is GB) uses .uk

IANA considers .tw to be "Taiwan, Province of China", as does that ISO link. As I understand, China pretty much bullied everyone else into not recognizing Taiwan so the rest of the world (like the UN) agrees Taiwan isn't a country. That's why one reason Microsoft asks for your Region, not country. There appear to be other ccTLDs like .IO and .AQ that aren't countries. (Probably more.) And I'm just being pedantic.

Both IO and AQ are ISO country codes as well. I'm not sure why.

Re: Cryptocat for iPhone and Android – Call for Review

#74

Post by dmacvicar » Fri, Jan 10, 2014, 8:17 AM UTC

iagooar wrote: post #55

Thiz wrote: post #44

Earlier quoted context omitted.

I've always wondered what is so special about catalan? Why do they deserve a special three letter domain nobody else has? Who should I address a letter to request for the wayuu culture to have a .way tld?

The thing is, the Catalan community has a very strong presence on the Internet. As an example, the Catalan version of Wikipedia currently has +400.000 articles, being the 17th biggest. To make clear what this means, you have to know that Catalan isn't even under the 100 most spoken languages worldwide (it has about 7 million speakers). So there is 1 article for every 17.5 people. Compared to the English version (4.4…

For curiosity. Does Valencia and Balearics use the .cat domain?. They seem to call their Catalan "Valenciano", even if it is the same language.

Re: Cryptocat for iPhone and Android – Call for Review

#75

Post by sneak » Fri, Jan 10, 2014, 9:49 AM UTC

magikarp wrote: post #7

bqe wrote: post #5

Glad that they're taking security seriously. It's a sharp difference from how they used to do things[1]. However, I'd still like to see either an explicit bug bounty (there's one implied here) or a paid audit. [1]: http://blog.cryptographyengineering.com/2013/03/here-come-en...

From my perspective, we've been taking security seriously a year+. Our first commissioned audit was in November 2012, and we've had a bug bounty since then as well: https://crypto.cat/bughunt/ This isn't, of course, to say that there haven't been vulnerabilities. But I have to stand behind our mitigation and disclosure policy as being very highly responsible and transparent. So far, we've had three paid audits, with…

None of your incentives are sufficient to get large adversaries to drop their non-obvious zero day on you.

Re: Cryptocat for iPhone and Android – Call for Review

#76

Post by sneak » Fri, Jan 10, 2014, 9:53 AM UTC

If your multiparty protocol is actually something you want scrutinized, why not follow the accepted model and make a c library reference implementation and release a research paper outlining the basis for your design decisions?

"Hey guys, here's the code, file some bugs for software that is of no use for you to spend time auditing" is pointless.

Adium has an incentive to read the libotr sources. Every user has a small incentive to read kernel sources.

Nobody has any meaningful incentives to read the cryptocat homebrew multiparty cryptosystem except the few you've paid to do so. This is cargo cult peer review; it looks like you're doing it but it doesn't actually yield the intended results.

PS: glad to see you switched to OTR for two party. You should have done that years ago, but at least you wised up in the end. Hopefully nobody got killed or tortured in the process.

Re: Cryptocat for iPhone and Android – Call for Review

#77

Post by josephlord » Fri, Jan 10, 2014, 12:11 PM UTC

pikachu_is_cool wrote: post #51

How are you guys going to get Cryptocat on the iPhone app store? Apple rejects GPL-licensed apps.

If they own the copyright they can also release it under the 'whatever terms are appropriate for the app store licence'.

Re: Cryptocat for iPhone and Android – Call for Review

#78

Post by [deleted] » Fri, Jan 10, 2014, 12:18 PM UTC

aaronharnly wrote: post #68

pikachu_is_cool wrote: post #51

How are you guys going to get Cryptocat on the iPhone app store? Apple rejects GPL-licensed apps.

Is that the case? I thought it was more that the GPL rejects distribution on the App Store.

[deleted]

Re: Cryptocat for iPhone and Android – Call for Review

#79

Post by magikarp » Fri, Jan 10, 2014, 1:50 PM UTC

sneak wrote: post #76

If your multiparty protocol is actually something you want scrutinized, why not follow the accepted model and make a c library reference implementation and release a research paper outlining the basis for your design decisions? "Hey guys, here's the code, file some bugs for software that is of no use for you to spend time auditing" is pointless. Adium has an incentive to read the libotr sources. Every user has a smal…

It's true that we don't have a research paper per se for the multiparty protocol, but we do have a specification document [1] as well as implementations in Objective-C, Java and JavaScript. The specification, as well as the implementations, have received both professional audits (from cryptographers) as well as community audits. The reason we don't have a research paper published is simply because we're working on one right now — a redesign of the multiparty protocol based on OTR. We have cryptographers on board from various Canadian universities and are organizing an internal forum to get them to collaborate on this. We expect publishable results by June 2014.

Regarding OTR, we actually switched to that 16 months ago — it's not exactly like we recently wisened up.

[1] https://github.com/cryptocat/cryptocat/wiki/Multiparty-Proto...

Re: Cryptocat for iPhone and Android – Call for Review

#80

Post by sneak » Fri, Jan 10, 2014, 3:50 PM UTC

magikarp wrote: post #79

sneak wrote: post #76

If your multiparty protocol is actually something you want scrutinized, why not follow the accepted model and make a c library reference implementation and release a research paper outlining the basis for your design decisions? "Hey guys, here's the code, file some bugs for software that is of no use for you to spend time auditing" is pointless. Adium has an incentive to read the libotr sources. Every user has a smal…

It's true that we don't have a research paper per se for the multiparty protocol, but we do have a specification document [1] as well as implementations in Objective-C, Java and JavaScript. The specification, as well as the implementations, have received both professional audits (from cryptographers) as well as community audits. The reason we don't have a research paper published is simply because we're working on on…

> as well as implementations in Objective-C, Java and JavaScript.

Factor the ObjC version out to plain C, and call into it from your Objective C implementation. Make the plain C version the canonical version. (Things like Emscripten may be useful here for your JS use-case.) This is how libotr does it, and for good reason.

Then, others can use it, and perhaps you will get meaningful free auditing. What you're doing now probably won't attract that because unless your bug bounty is six-figures, nobody competent will spend any significant amount of time auditing it because they have no incentive to do so.