Secure messaging project, Cryptocat, apologizes over bug

The open-source IM project warned that encrypted group chats may have been easier to crack for seven months

The founder of an eavesdropping-resistant instant messaging application called Cryptocat has apologized over a now-fixed bug that made some types of messages more vulnerable to snooping.

Cryptocat, which runs inside a web browser, is an open-source application intended to provide users with a high degree of security by using encryption to scramble messages. But Cryptocat warns that users should still be very cautious with communications and not to trust their life with the application.

The vulnerability, found by Steve Thomas, affected group chats and not private conversations, said Nadim Kobeissi, in an interview from Germany Friday. The encryption keys used to encode those conversations were too short, which in theory made it easier for an attacker to decrypt and read conversations.

The error was the result of an oversight spotted by Thomas, Kobeissi said. The encrypted conversations were still carried over SSL (Secure Sockets Layers), another overlay of encryption. But if an attacker broke the SSL encryption and had the underlying encrypted chats, "it would be significantly easier to crack" using brute-force techniques, he said.

The bug was fixed in Cryptocat versions 2.0 and up about a month ago after Thomas notified the project. The vulnerability persisted for about seven months between September 2012 and April.

Although Cryptocat noted the patch in its changelog, Kobeissi wrote a detailed blog post on Thursday explaining the issue after Thomas published a sharp critique.

"This is a really difficult situation," Kobeissi said. "I am not a person who will gloss over this kind of bug for absolutely no reason just to maintain the image of the project."

The bug was completely unacceptable, but it is common for errors to be revealed in open-source projects, he said. Kobeissi said he gave Thomas a US$250 reward out of his own pocket even though Cryptocat has no formal bug bounty program.

"I wanted to be on the record that he was paid for his effort," Kobeissi said.

Cryptocat has seen surging interest since the U.S. National Security Agency's surveillance program was detailed by whistleblower Edward Snowden. Kobeissi said Cryptocat saw 65,000 new users in just a month since the revelations were published.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securityencryptioninstant messagingInternet-based applications and servicesCryptocat

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?