Hacker News Reader

Comment by conformal | Hacker News Reader

i know the author (nadim) is in here and this is all a bit fantastic. cryptocat is one of many crypto snake-oil products that i would never consider using for any kind of secure communication.

using defective crypto products is much riskier than not using any crypto at all and exercising caution. cryptocat has always seemed a poorly disguised honeypot to me.

View on HN

It would be nice if you could meet me for coffee and say this to my face, friend.

I am trying to protect myself and my open source project, which, by the way, has been audited countless times and has progressed greatly towards security. If you have a problem with me, then call me up and discuss it instead of stressing me out even more when I just discovered that the government is building a case against me.

If you don't like my work, file a bug report. Check out our documentation. Review our OTR implementation. Submit a pull request. Hack some code. Just don't say hurtful and untrue things like that in public. You can do better.

I think that the reason you are seeing this response towards your project is that it's not entirely clear what it is intended for. As in who cares about security enough to encrypt their messages but not enough to install a standalone client, which has a stricter security model.

That being said, I think it's a cool project and it seems to be pissing off all the right people, so keep it up. And I'm not a lawyer but I don't think that the gov't has a case against you (or am I missing something). In fact, it would appear that this might be warrantless wiretapping so you might have a case against them, but I'm not sure if that is something you want to pursue.

"As in who cares about security enough to encrypt their messages but not enough to install a standalone client, which has a stricter security model."

this is so spot on. secure comms have no place in a web browser, which is a complex beast with a large set of underlying dependencies. webkit vulnerabilities leading to comms being blown is a crappy architecture.

people who care about comms use a standalone client and a separate server. if you care about the integrity of the server, you run some disk crypto, DDR3 memory, secure it physically, etc.

Are you recommending DDR3 memory because you think it's resistant to cold boot or reset attacks?

That is not the case. DDR3 memory will not help you.

Certainly DDR3 memory (as a type of main memory) has less permanence than hard disks (i.e. secondary storage). It's a side effect not a desired goal.

Especially if you're bit-flipping sensitive stuff, there's probably a good hope for protection from recovery at normal temperature after what, 30-60 seconds? So reset is an issue, but "keep sensitive things in RAM vs. on disk" is still a reasonable security precaution.

maybe they meant ECC memory?

Is ECC more secure than regular consumer grade memory?

More "secure" from single bit errors, but not for recovery -- kind of the opposite goal. The big difference is DRAM (mostly the same, including DDR3) vs. SRAM (of several types -- relevant due to use in HSMs, cpu cache, etc.). DRAM has been getting worse/longer duration as it becomes lower power, so arguably DDR3 (being relatively new) would be worse than 1985 RAM.

CPU registers are the safest place against this attack (hence stuff like TRESOR where AES keys are held in CPU registers), but are by necessity limited (especially on x86; SPARC was better, and some of the new extensions to x86 help (SSE, etc.)

Most of this has been mitigated to some extent by periodic inversion of sensitive strings in main memory (keys, usually) -- this has been implemented in ~all crypto libraries.

SRAM's huge advantage is you can clear it faster than DRAM, but that doesn't help if you can somehow prevent the clearing from happening.

Law enforcement officers come to you with a correctly formed legal document - a court order, or a warrant, or somesuch - and ask you to serve a malformed client to some cryptocat users. This malformed client will give the impression of encrypted communication, but will actually allow the law enforcement officers full access to the plain text (but only for the specified users). What do you do?

This is the Hushmail attack, and it seems like Cryptocat is vulnerable to it.

Cryptocat is a browser plugin. You need to download it like everything else. The source code is on Github.

I swear upon my father's grave I will never do something so dishonest and evil towards everyone who has supported Cryptocat, the most meaningful thing I have made with my life.

Unfortunately, I don't think you have a choice in these cases, I think you are obligated by law to do it.

You always have a choice. In this case, you can refuse and go through the legal system. If you've made that choice already, then you can further raise a big stink about it and hope public pressure forces the gov't to back down.

Oh, interesting, I didn't know that. Thanks for clarifying.

Except he's distributing his client via the Google Chrome Web Store, so if law enforcement had a way of requesting that a particular user's software be backdoor-ed [1], they'd go to Google, which would also be significantly less likely to engage in civil disobedience.

1. I'm not a lawyer, but I'd be surprised if this were legal.

Ask the law enforcement officers to send you a pull request instead?

You are handling things exceptionally well under the circumstances. If anything, I find it incredulous how eminently sensible you are being. You have my respect.

Some people are fanatics who will never believe. Perhaps there wasn't enough hacking in terminals with falling green letters or he doesn't think crypto software can possibly be easy for non-security professionals.

Again, you are doing the right thing. I'm only sorry the only thing I can give you is my support.

your original product was riddled with problems, so much so you had to entirely change the architecture. a stream of ppl popped out of the woodwork and had a laundry list of problems with your original work. making security products that are not built properly endangers those who use it, as i am sure you have heard many times before.

you are clearly very talented with marketing yourself and the project, so cryptocat getting lots of media coverage led to an essentially crowdsourced design for cryptocat 2, very similar to mega. sure enough, this design has held up relatively well and gotten through audits without too many serious issues. as someone who cares a lot about secure comms, i have seen and continue to see no reason to use cryptocat.

i find it particularly ridiculous that a supposed proponent of free speech suggest i am not entitled to my (negative) opinion of your project. i see no point in filing bug reports for software i will never use. i believe in people doing their own homework, it is not my job to improve your project.

if i assume that your govt troubles are indeed legitimate, there are a couple things that seem inconsistent to me:

- you seem very concerned about the negative ramifications of angering your local govt, and all this is linked to (1) your dev work and (2) your prominence in the media. if you are so truly concerned about govt action against you, why are you publicizing the harrassment you have experienced? it only serves to promote your dev work and elevate your media presence, which i would expect to further aggravate your local govt.

- the govt likely knows that actions like this, properly publicized, only lead to an increase in the reach and use of your product, in direct contradiction to your suggestion that they don't want to have your product circulate. it seems that "cui bono" in the context of your story is that you and your project directly benefit by getting lots of publicity.

i found it a bit difficult to fish out details on the ciphers and modes you use with cryptocat 2, which doesn't exactly inspire confidence. i am not a fan of using a stream cipher (AES-CTR) to protect non-streaming comms due to the nonce re-use issues your audit found. ssh using AES-CTR makes sense to me, an IM protocol, not so much.

You can be critical without being outright hostile. If this is how you would phrase your criticism to magikarp's face, you are not very courteous.

So what would you recommend people to you for secure communications?

They can't help it, friend. :-) It's what the human brain does.

I think a statement like that needs a little more in the way of support.

Cryptocat has been fairly well reviewed by a number of fairly smart people. While flaws have certainly been found, they've mostly been addressed, AFAIK.

"Snake oil" has been a popular term to throw around ever since the original PGP user's guide, but simply labeling something "snake oil" without any actual proof is a dangerous thing to do (especially when it's an open source product, and you should be able to point to any defects specifically).

Edit: I realize the term 'snake oil' predates PGP, I was referring to the crypto community's penchant for it.

Snake-oil? I am not sure I would go that far. I am somewhat concerned about crypto that runs in-browser after the Hushmail debacle, but the term "snake-oil" is usually reserved for cryptosystems that follow proprietary designs or "roll your own crypto," and cryptocat does not seem to fall into either category.

The fact that he's young, brilliant, and identifies as a hacktivist make it more feasible. He's a future threat.

That's how the US has treated its hackers since ... the beginning. And that's why the Chinese are almost certainly eating our crypto-lunch. You'd almost think the authorities are compelled to help CN.

I have spent a fair bit of time discussing Cryptocat with Nadim in person. He is sincere in his development goals for Cryptocat and does not intend for it to be a honeypot.

>i know the author (nadim) is in here and this is all a bit fantastic.

What aspect seems "fantastic" to you? Have you yourself been involved in activism?

It just seems exceptionally incompetently handled. The inconsistent stories? Repeated connection attempts to send data to "obvious" places instead of more careful probes and innocent looking transmission attempts to less suspicious locations.

The whole thing sounds like a bad b-movie or someone playing a practical joke, rather than a genuine attempt.

Then again, who knows, idiots manage to get hired everywhere.

from my own personal experience, govt folks like to follow. the business of knowing usually doesn't involve overt intimidation that is demonstrable to outside parties.

>govt folks like to follow

Do you mean trailing people and surveillance?

Reply on news.ycombinator.com