CRYPTOCAT SECURITY PATCH

The vulnerability persisted for about seven months between September 2012 and April.Īlthough Cryptocat noted the patch in its changelog, Kobeissi wrote a detailed blog post on Thursday explaining the issue after Thomas published a sharp critique. The bug was fixed in Cryptocat versions 2.0 and up about a month ago after Thomas notified the project. But if an attacker broke the SSL encryption and had the underlying encrypted chats, 'it would be significantly easier to crack' using brute-force techniques, he said. The encrypted conversations were still carried over SSL (Secure Sockets Layers), another overlay of encryption. The error was the result of an oversight spotted by Thomas, Kobeissi said. The encryption keys used to encode those conversations were too short, which in theory made it easier for an attacker to decrypt and read conversations. The vulnerability, found by Steve Thomas, affected group chats and not private conversations, said Nadim Kobeissi, in an interview from Germany Friday. But Cryptocat warns that users should still be very cautious with communications and not to trust their life with the application. The founder of an eavesdropping-resistant instant messaging application called Cryptocat has apologized over a now-fixed bug that made some types of messages more vulnerable to snooping.Ĭryptocat, which runs inside a web browser, is an open-source application intended to provide users with a high degree of security by using encryption to scramble messages.

Cryptocat security