By the way, wasn't Cryptocat shot down initially for its "host-based security" [1]? Why didn't ChatStep learn from that?

[1]: http://www.wired.com/threatlevel/2012/08/wired_opinion_patri...