Secure messaging project, Cryptocat, apologizes over bug

The open-source IM project warned that encrypted group chats may have been easier to crack for seven months

The founder of an eavesdropping-resistant instant messaging application called Cryptocat has apologized over a now-fixed bug that made some types of messages more vulnerable to snooping.

Cryptocat, which runs inside a web browser, is an open-source application intended to provide users with a high degree of security by using encryption to scramble messages. But Cryptocat warns that users should still be very cautious with communications and not to trust their life with the application.

The vulnerability, found by Steve Thomas, affected group chats and not private conversations, said Nadim Kobeissi, in an interview from Germany Friday. The encryption keys used to encode those conversations were too short, which in theory made it easier for an attacker to decrypt and read conversations.

The error was the result of an oversight spotted by Thomas, Kobeissi said. The encrypted conversations were still carried over SSL (Secure Sockets Layers), another overlay of encryption. But if an attacker broke the SSL encryption and had the underlying encrypted chats, "it would be significantly easier to crack" using brute-force techniques, he said.

The bug was fixed in Cryptocat versions 2.0 and up about a month ago after Thomas notified the project. The vulnerability persisted for about seven months between September 2012 and April.

Although Cryptocat noted the patch in its changelog, Kobeissi wrote a detailed blog post on Thursday explaining the issue after Thomas published a sharp critique.

"This is a really difficult situation," Kobeissi said. "I am not a person who will gloss over this kind of bug for absolutely no reason just to maintain the image of the project."

The bug was completely unacceptable, but it is common for errors to be revealed in open-source projects, he said. Kobeissi said he gave Thomas a US$250 reward out of his own pocket even though Cryptocat has no formal bug bounty program.

"I wanted to be on the record that he was paid for his effort," Kobeissi said.

Cryptocat has seen surging interest since the U.S. National Security Agency's surveillance program was detailed by whistleblower Edward Snowden. Kobeissi said Cryptocat saw 65,000 new users in just a month since the revelations were published.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags instant messagingInternet-based applications and servicessecurityCryptocatencryption

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?