Hacker News Reader

Seems useful.

Why not just have users type in a room name and password on creation...no need to set the salt after the fact.

Except that the encryption is handled with javascript (obviously). I wouldn't use this for anything serious.

Why not? AES has been implemented in javascript half a dozen times.

And? What is that evidence of?

That the implementation of an encryption library in Javascript is not a reason to mistrust services which use that library?

It isn't evidence of that. Implementation in browser JS is in fact a reason to distrust a cryptosystem.

Okay..? What difference does that make?

because... the server might send a broken .js therefore forcing your chat client into sending plain text.

Exactly, that's the point. Or a browser extension. Or various other fun things, see tptacek's conversation above.