DecryptoCat

by thejosh • 13 years ago

516 276 13 years ago

616c2• 13 years ago

Unfortunately I am not too well-versed in cryptography, and I guess I must start taking the Matasano crypto challenge. I am very scared too use most crypto platforms for reasons like this; I would never have picked up on such stuff. I only trust PGP because it has decades of skepticism and so far no one has scared me out of using that. The other stuff needs more eyeballs, and I am more or less blind. Time to read some books.

jiggy20114• 13 years ago

What about NACL? http://nacl.cr.yp.to/index.html

Seems to provide most of the building blocks you would need and has bindings for various languages.

616c2• 13 years ago

I have seen it. I am a middling programmer at best. I guess I need to step it up.

mahmoudhossam• 13 years ago

I'm pretty sure there's a nicer way of saying "You're doing crypto wrong."

I don't know the author of either software, but as software professionals we have to maintain a certain level of respect for one another.

rorrr23• 13 years ago

People relied on crypto.cat, some probably with their lives.

Who gives a crap about hurt feelings of the author who failed at crypto for so long, while advertising it as secure?

pfortuny5• 13 years ago

It is not "hurt feelings", it is "the tone of the environment."

Really, education and politeness have much more to do with "building a strong society" (and by society I mean "developers' environment") than "not hurting the feelings of an individual."

Think big, not small. Think long-term, not short. Think global, not local. If you do these, then you will end up also thinking small, short and local.

(Edit typos etc)

Reedit: The first comment by DanBC is what I deem "polite criticism". One does not need to mince words but one does not need to insult either.

DanBC18• 13 years ago

People tried politely telling Cryptocat that they were doing crypto wrong.

Cryptocat ignored those people. Cryptocat dismissed the advice they were being given.

flarg• 13 years ago

I disagee, The cryptocat team must 'suck it up' and do better, or GTFO. If they know anything about their field, they should not expect any respect or politeness.

As software professionals we have a responsibility to accept criticisms from others in our field, no matter what their tone and manner may be - and this is especially true in crypto. In our field we have a lot of very bright people with literally no politeness or respect - and we must still work with them to make things better.

DanBC18• 13 years ago

Cryptography is hard.

Software is full of bugs. Most of those bugs can be left without too much impact on the users. See any bug tracker for bugs which have been left for years.

With cryptographic software a small, subtle, hard to find bug could render the product pointless; could make the cryptography trivially easy to crack.

Smart people and many eyes make mistakes with crypto. See, for example, the random number generator bug in Debian.

People learn by doing. They read a book or two, they read some source code, and then they implement their own version. This is especially dangerous for crypto because these people might not understand the bugs they've created. It's fine to release your code snippets as "proof of concept" or "demonstrations" so long as you give warnings that these are not to be used in real life.

Cryptocat did not give those warnings. Cryptocat said it was secure. They ignored the advice from many people. They even took the ultimate snakeoil step of running a competition to crack their software. Except the badguys are not going to enter your competition; the badguys either already know how to break the crypto or they use all the publicly available entries as help.

People shouldn't have been waiting for something like DecryptoCat before they stopped using CryptoCat.

It's particularly frustrating because people risk death or torture or long term imprisonment in some parts of the world, and they need strong crypto.

(https://www.schneier.com/blog/archives/2008/05/random_number...)

sneak• 13 years ago

Cryptocat did not give those warnings. Cryptocat said it was secure. They ignored the advice from many people.

Yeah, I saw a bunch of people I respect saying things like "Nadim[1] is a good kid and he's learning, give him the benefit of the doubt" when I suggested that nobody use CryptoCat.

But...

It's particularly frustrating because people risk death or torture or long term imprisonment in some parts of the world, and they need strong crypto.

We have an obligation to the safety of others (especially in light of the fact that we know all the transmitted cyphertext is being stored) to denounce poor crypto implementations whenever and wherever we see them, regardless of the implementor.

[1] https://en.wikipedia.org/wiki/Nadim_Kobeissi

mtgx2• 13 years ago

I don't know what he usually says, because I don't follow him, but I remember hearing him in a speech say that "you shouldn't use Cryptocat if your life depends on it" or something like that.

I've just checked, and he seems to give that warning on the site, although below the fold:

"Cryptocat is not a magic bullet. You should never trust any piece of software with your life, and Cryptocat is no exception"

https://crypto.cat/

DanBC18• 13 years ago

Well, that's good. I can't edit my comment, so I accept here that I'm wrong about that.

kybernetyk2• 13 years ago

To me that disclaimer sounds rather like those disclaimers on dietary supplements. They have to write that the supplement isn't medicine and might not work but the whole product packaging and marketing implies that it will work just like medicine.

"Yeah, yeah, crypto cat is software and no software is perfect. But ... that's just a stupid disclaimer. Use cryptocat anyways, guys."

tptacek29• 13 years ago

Elsewhere: "Cryptocat Passes Security Audit With Flying Colors". "It’s no secret that there was a lot of celebration here at Cryptocat over these results. Completely passing an audit with zero weaknesses or vulnerabilities is a rare event even for very high-profile software. This is perhaps Cryptocat’s greatest achievement yet."

marshray• 13 years ago

https://blog.crypto.cat/2012/12/lebanese-government-asking-f...

vvvvvv quote begins vvvvvv

(هذا المقال مترجم إلى اللغة العربية فالأسفل) – Arabic Translation follows

We’d like to talk about today’s news in Lebanon concerning the Lebanese Internal Security Forces demanding access to Facebook passwords from the Minister of Telecommunications. This notion is unacceptable, and the Cryptocat Project is moving forward on proposing solutions for Lebanese people on how to protect themselves against this sort of seizure, should it happen.

What Cryptocat can do for you

We would like to suggest to Lebanese citizens to use Cryptocat instead of Facebook chat to communicate. You can download Cryptocat here (it’s available in Arabic) — to the best of our ability, we have attempted to make Cryptocat a private, useful and open platform for easy to use IM. We want to offer it as an alternative in this time of potential legislative abuse. Cryptocat cannot promise you perfect privacy — at best, we are promising a slightly better alternative to Facebook chat.

What Cryptocat can’t do for you

Here we must repeat the warning from our project website: Cryptocat is not yet ready to be used in extreme situations. Don’t rely on Cryptocat if your life is threatened — it’s experimental software. But that doesn’t mean that Cryptocat can’t provide reliable, useful privacy for many individuals. Use Cryptocat if you are in Lebanon and want to talk with your friends without the notion of a government request for Facebook passwords hanging over your head.

I am in Beirut

I (Nadim, Cryptocat developer) am currently in Beirut. You can reach me at nadim@crypto.cat — send me an email if you have any questions on how you or your community can protect your digital privacy, please come to my workshop at the Lamba Labs hackerspace tomorrow.

^^^^^^ end of quote ^^^^^^

Nursie5• 13 years ago

> Cryptography is hard.
> Smart people and many eyes make mistakes

These things are true BUT the article says this - "They seem to not understand simple programming concepts such as a byte vs a decimal digit character" There seem to be some serious problems with the aptitude of the developers if that really is the case.

freshhawk• 13 years ago

With cryptographic software a small, subtle, hard to find bug could render the product pointless

Exactly, cryptography is science and not engineering. That's why the cryptocat response makes them seem even worse to me.

They are clearly still approaching the problem as if they can iterate on it and incrementally improve things. That's the wrong approach when things are so much closer to a binary right/wrong situation than in other types of software development.

magikarp2• 13 years ago

Cryptocat did not give those warnings. Cryptocat said it was secure.

This is just not true. There are ample warnings on the front page of the website as well as on the login screen on the app. Cryptocat has never said it's completely secure.

anu_gupta2• 13 years ago

The warnings, hidden away behind a link (unlike the stuff about journalists and LGBTQ activists)

What Cryptocat Doesn't Do
While Cryptocat aims to offer strongly encrypted, private Instant Messaging, it's important to note what Cryptocat does not protect you against:
Cryptocat does not anonymize you: While your communications are encrypted, your identity can still be traced since Cryptocat does not mask your IP address. For anonymization, we highly recommend using Tor.
Cryptocat does not protect against key loggers: Your messages are encrypted as they go through the wire, but that doesn't mean that your keyboard is necessarily safe. Cryptocat does not protect against hardware or software key loggers which might be snooping on your keyboard strokes and sending them to an undesired third party.
Cryptocat does not protect against untrustworthy people: Parties you're conversing with may still leak your messages without your knowledge. Cryptocat aims to make sure that only the parties you're talking to get your messages, but that doesn't mean these parties are necessarily trustworthy.

jamesmckenzie• 13 years ago

What's interesting is that the creator of Cryptocat, Nadim Kobeissi (who has no problem with the media introducing him as "cryptographer" or "security researcher") commented the following last year to journalists when asked about an issue with MEGA's (mega.co.nz) encryption:

“It’s a nice website, but when it comes to cryptography they seem to have no experience,” says Nadim Kobeissi, a 22-year old cryptographer and creator of the secure chat software Cryptocat, who began poring over the public portions Mega’s code as soon as it debuted over the weekend. “Quite frankly it felt like I had coded this in 2011 while drunk.” (see: http://www.forbes.com/sites/andygreenbe ... -promises/)

Perhaps he was on drugs when he coded Cryptocat...

zainny8• 13 years ago

What is it with people in the crypto community always coming across as complete and utter jerks? Question for those in this space: is it possible for you to give constructive criticism for a project without calling people "incompetent"?

Seriously, if there any domain in CS more full of these types of personalities I can't think of it.

DanBC18• 13 years ago

is it possible for you to give constructive criticism for a project without calling people "incompetent"?

Cryptocat had many such bits of constructive criticism. They chose to ignore it. They continued to promote their broken product as secure.

zainny8• 13 years ago

You're making statements like that in a very matter of fact way. Can you please give references?

It seems to me like the developers have been earnestly trying to build and improve on Cryptocat and shore up any weaknesses only to be constantly shit on your typical internet crypto experts.

plg3• 13 years ago

Can we please separate criticism of (1) the technical internals of Cryptocat from (2) the core idea behind Cryptocat and, especially, (3) Nadim himself, personally?

My own take on this is that Nadim ought to be encouraged, and we ought to help him engage additional people who are experienced crypto experts to help implement the Cryptocat internals.

If you think the core idea behind Cryptocat is crap, then fine, make a technical argument. If you think the idea is good, then let's encourage and help Nadim make it better.

If you want to criticize Nadim's judgment from afar (I assume you are not on the core Cryptocat team) then that's your choice, but trust me, it does not help him, or you, or anyone. We all have our flaws and we all make bad decisions. I for one would bet that Nadim is absolutely interested in making Cryptocat better, not sweeping problems under the rug. Let's help make that happen and let's do it without the personal attacks.

JulianMorrison• 13 years ago

It's a matter of consequences. Badly built crypto endangers the people who can least afford it (ROT13 is probably enough to secure your comms, but you aren't in Syria).

GhotiFish• 13 years ago

I've being using double ROT13 for most of my transmissions, but I'm paranoid.

antocv• 13 years ago

I agree there are more jerks in the crypto community than elsewhere, but in this instance it is justified, crypto is serious and if you are gonna claim to be secure and all that - peoples lives can hang on it - then make sure you get the basics right.

I mean come on, Im not a crypto-programmer, but this, Cryptocat.random()*123456789 !?

anonymous• 13 years ago

Actually it's 1234567890. Which is even worse.

Cryptocat is written by people who don't fully understand how their program works. They don't fully understand how the platform on which their program is built works. They may be smart, but they need to sit down and learn things.

magikarp2• 13 years ago

That line isn't used in anything sensitive.

andor• 13 years ago

Crypto software that doesn't work potentially puts people at risk.

If a car mechanic only used half the wheel nuts to fasten the rims on your car, would you stay calm and give constructive criticism?

zainny8• 13 years ago

That's a silly argument. There is a great deal of software out there in the world that operates in incredibly important roles. The software running your car, your electricity grid, your bank, your nearest nuclear power plant. Does everyone get free license to be an asshole?

Crypto does not occupy some special branch of importance above and beyond a great deal of software many of us create in our jobs.

I used to work on software in the defence industry on things that could put people at risk. I can't recall any of my colleagues behaving the way people in the crypto community do.

ddeck• 13 years ago

I would suggest that the author's description of the developer(s) as "incompetent" is somewhat more reasonable than your (implied) description of him/her as a "complete and utter jerk".

Perhaps the author should have narrowed the description to incompetence in crypto and not generalized to "everyone involved", but I don't think it's entirely unreasonable given the apparent magnitude of the problems and the history of the product.

aviraldg• 13 years ago

Releasing an untested crypto product to the general public, and calling it "secure", is incompetent, period.

kybernetyk2• 13 years ago

Because, well, while a bug in your task-planer rails app is not cool it most likely won't endanger people's lives. While with crypto many people around the world depend on it with their lives.

Sometimes you just have to hit the thing with a bat to get attention.

tomchristie• 13 years ago

Nonsense - the article comes across more weakly by taking a personal tone.

windexh8er4• 13 years ago

While I can't say I've ever looked at the source wouldn't most be able to imply that, even if CryptoCat has issues it's likely better, and easier to use, than other competing projects in this space based on its popularity?

I get there are many others ways to skin this... However the author is at least trying and providing. As a prior comment stated, there are a lot of very good people in the security/crypto/dev realm in this very thread that have provided some awesomely D-bagish feedback.

jerguismi4• 13 years ago

These "serious cryptographers" really never seem to deliver usable solutions themselves - and therefore the average users use software like cryptocat, or they don't use software at all. Cryptocat managed to bring cryptography to the masses, and usually no "serious cryptographers" have managed with the same thing.

jlgreco4• 13 years ago

This is better off not done than done improperly.

"I managed to produce shit while you refused to produce shit!" is not something to be proud of.

Nursie5• 13 years ago

And look what happened. People thought they had a secure channel but they didn't.

DanBC18• 13 years ago

These "serious cryptographers" really never seem to deliver usable solutions

When people say a crypto product is "broken" they have several different meanings.

Ignoring one-time-pads every crypto system can be, in theory, broken by brute force. The time taken to do the brute forcing might be billions of years, but in theory it's possible. This is the edge of what we currently know about math.

Anything that can be cracked quicker than brute forcing is regarded as broken, even if that attack is still not feasible. A crypto-system that takes 100 billion billion years to brute force, but 10 billion billion years with some other attack is still regarded as broken. At that point people would tend to stop working on that algorithm and move onto something else, or they'd try to improve that crack and see if it can be combined to make something feasible. Don't forget that the bad guys keep their secrets secret. You will not know if they can break your product.

This can be frustrating for people developing software. "But wait, no-one can actually use that flaw to break the crypto, so it's still secure, right?" Well, not really.

And then that algorithm, the math, has to be turned into code. This is hard because you need to know what the language is doing, what the compiler is doing, what the hardware is doing. Any flaws in the algorithm could be magnified by implementation as software.

Just as an example of people keeping secrets: Diffie and Hellman invented a practical key exchange in 1976; it had been independently invented -and kept secret- in 1974 by Ellis, Cocks, and Williamson at GCHQ. GCHQ made this public in 1997. Even though key exchange was in use by very many people all over the world it was kept secret for about 25 years.

Clifford Cocks invented RSA a few years before Rivest Shamir and Adelman did. (Not only did he do it before them, but because he wasn't in the building he did it in his head. (He wasn't allowed to write anything down.) He had to go to sleep and hope that he still remembered it in the morning.) And, again, even though RSA was in use daily by very many people GCHQ still kept it secret until 1997, about 25 years.

Cryptocat managed to bring cryptography to the masses

No, it really didn't. CryptoCat gave people a false sense of security. CryptoCat gave people the illusion of secrecy. Cryptocat didn't give people a usable safe product.

usually no "serious cryptographers" have managed with the same thing.

The cryptocat developers would do far more good by using their knowledge to make existing tested products easier to use.

You appear to be ignoring PGP / GPG; SSL, etc, which are used by many people.

brl• 13 years ago

One of the main reasons that Cryptocat is able to celebrate their high usability is because they didn't even attempt to tackle the most difficult usability problems in a system for secure communication. There is no such thing in Cryptocat as persistently stored private identity keys, so every time you use Cryptocat new identity keys are generated which you are then expected to manually verify in some out-of-band way (i.e. make a phone call to every other person in a Cryptocat chat room and swap hex encoded fingerprints). If you don't manually verify the keys of every other person you talk to every single time you use Cryptocat then you might judge Cryptocat to be 'usable' and maybe even more usable than other similar software, but the usability trade off is that you and even other people you communicate with who have otherwise verified keys correctly will be vulnerable to having your conversations intercepted and decrypted by an active attacker.

Nursie5• 13 years ago

> Cryptocat managed to bring cryptography to the masses

Not really! Obfuscation perhaps.

jrockway• 13 years ago

Some people build things, other people break things. The people that break things don't understand what it's like to build something, so tend to come across as jerks to people that build things for a living.

tptacek29• 13 years ago

This builders/breakers thing drives me nuts.

I've done both throughout my career. I've lead and shipped very large projects, and I've spent years breaking. To be a good breaker, you have to be a good builder; you need to be able to intuit what someone building the target was trying to do, then think a step ahead of them and predict their mistakes. To do the job professionally, you need to be capable of doing that in a wide variety of environments, too. Most "builders" are Rails devs, or Java devs, or C devs. Good breakers have to be all of those.

There are a lot of "breakers" out there who repeat a cookbook of well-known techniques to find lots of instances of the same bug. But if you look at the very best in the field, to a one, they're all top-caliber builders as well.

papsosouid• 13 years ago

What sort of reaction would you feel is appropriate when someone builds a bridge incorrectly, and it collapses? "Oh hey, that's too bad, good try though!"? When someone does something horrible wrong and demonstrates that they are incompetent, that needs to be said. Everyone needs to know "this person is incompetent, do not use their work".

escaped_hn• 13 years ago

Because this is more true in crypto than anywhere else.

"There are horrible people who, instead of solving a problem, tangle it up and make it harder to solve for anyone who wants to deal with it. Whoever does not know how to hit the nail on the head should be asked not to hit it at all." - Friedrich Nietzsche

dobbsbob7• 13 years ago

Years of linux kernel, theo de raadt/bsd, and grsec mailing list total rage and various IRC hacker/dev channel slamming of idiocy has hardened my skin and actually makes me thankful they are clear, concise and direct with their criticism instead of phony hand holding and passive aggressiveness. It's a rite of passage to get your ass handed to you by other devs. Some people just don't get it, you have to pummel them with a blast of anger on the mailing list or they'll continue to waste everybody's time with their idiocy.

It's not the end of the world if somebody calls your insecure program a pile of shit and you a nerf herding waste of skin for inflicting said shit upon the world. That's like standard behaviour since the days of Stallman at MIT labs

npsimons• 13 years ago

This. Every time someone gets flamed, you get the same crowd of people going "what an asshole". Except, oh wait, the person got flamed for breaking userspace and not fessing up to it, or providing a false sense of security to people whose lives depend upon it. And in each case, these weren't newbies - they had been warned before and should have known better. It's not just ignorance, it's willful, practically malicious ignorance.

Wake up. This isn't some social media photo-sharing app. This is the literal definition of mission critical software. Being an asshole is the cost to pay to either a) convince incompetent people to stop wasting everyone else's time or b) convince them to become competent.

You know why I don't write and release crypto software? Because I know I'm not qualified to.

ceol5• 13 years ago

This is a really gross attitude, and it's even grosser that you dress it up like some macho rite-of-passage. Call it what it is: A bunch of bitter nerds taking their pent-up anger out on random newbies. It's the fraternity hazing of the tech world, it's bullshit, and it needs to stop. It doesn't need other bitter nerds treating it like it's normal.

Instead of expecting newbies to know they're going to be met with a storm of putrid shit should they speak a syllable out of line, how about we expect our moderators and leaders have some degree of social skill?

unethical_ban2• 13 years ago

No, I think people should be treated roughly in the same way they'd expect to be treated in meatspace. I know I don't always configure a server correctly the first time, but if my lead called me a fucking dipshit and a waste of time, I'd go find another job real damned quick.

There's a certain level of banter and sarcasm allowed between friends and known colleagues, but strangers don't have that luxury, or shouldn't.

Dylan168074• 13 years ago

is it possible for you to give constructive criticism for a project without calling people "incompetent"?

You're too focused on the fact that it's an insult. Even though it's rude, there are circumstances where literal incompetence should be pointed out, like software that can be life-or-death. This commit right here https://github.com/cryptocat/cryptocat/commit/7fe56f0ad6a1b4... is either someone coding without paying attention / severely sleep deprived / drunk, or it's someone who is incompetent. And the first option is only a polite way of saying they were 'temporarily incompetent at coding while working on this project'. And that provides no solace to someone who gets hurt.

In short, it is a fact that the cryptography system here was handled in an incompetent way, beyond that of normal implementation errors. Blatantly stating this fact is an effective way of getting people away from the danger.

wtbob• 13 years ago

Question for those in this space: is it possible for you to give constructive criticism for a project without calling people "incompetent"?

Sometimes 'you're incompetent at X' is constructive criticism.

Someone who doesn't know how to accelerate a car is an incompetent driver. That doesn't make him a bad person; it doesn't make him worthless (as an example, neither Newton nor Plato knew how to accelerate a car); it does, however, make him incompetent at driving.

One should understand one's weaknesses. I know lots about some things, a bit about others and nothing about yet others. As an example, I know absolutely nothing about assembly line engineering; I am an incompetent assembly line engineer—and thus I do not produce assembly-line-engineering products.

boi_v2• 13 years ago

I wish people would get involved with projects like Cryptocat instead of pointing the finger with some kind of superiority that will never construct anything, at least this is what I would do if I were a Cryptographer, but why bother? It is better to work for a bank and use others mistakes to make some self-promotion and maybe feel better with myself. You missed a excellent opportunity to make some good.

dionyziz• 13 years ago

You're right. However, the guy actually did write a patch for Cryptocat, so you have to give him that.

_djo_• 13 years ago

Which was subsequently modified to make it less secure before being added to the project. That tends to dampen one's enthusiasm to contribute.

jlgreco4• 13 years ago

If I were to write a book that pretended to teach laymen how to perform major surgery in their own kitchen, would it be reasonable for real surgeons to tell me to knock it the fuck off, or should they "get involved" and attempt to provide me with constructive criticism?

StavrosK3• 13 years ago

Your analogy means that people shouldn't expect to have secure group chatting capability. It would be more like (groan) saying "I want to perform surgery in my kitchen so I'll just read some books while I'm opening the person up, but real surgeons are telling me to knock it the fuck off and read all the books before trying it".

It's legitimate and commendable to try to write your own cryptosystem, but winging it is not going to end well.

kimlelly• 13 years ago

Give RetroShare a try: http://retroshare.sourceforge.net/

It's:

1. Decentralized (real p2p, no central servers)

2. Encrypted communication

3. Easier to set up than encrypted email: Install -> Exchange "certificates" -> Done.

InternalRun• 13 years ago

You need to stop spamming this.

makomk3• 13 years ago

4. Not developed by cryptographers.

davidw6• 13 years ago

The bug that lasted 347 days was the confusion between a string and an array of integers.

Maybe they are Erlang programmers :-)

rwg• 13 years ago

Every programmer should be forced to implement a non-trivial algorithm that involves lots of bit twiddling in a few languages that don't have integers ("all you need are double-precision IEEE 754 floats...and love!"), don't have unsigned integers, have undefined or implementation-specific integer sizes, and/or don't have a "convenient" string type.

tptacek29• 13 years ago

Watch out, he's just trying to get you to implement ECDLP in Applescript and DOS BAT files.

Dylan168074• 13 years ago

Honestly I think you need to make that challenge harder. Lua, for example, has built-in 32-bit bitwise operations despite having no integer types. I did a prototype implementation of SHA3 and it was a walk in the park, I wouldn't expect that to change with a larger algorithm.

noonespecial• 13 years ago

Cryptography is different than regular software. It requires even more than full transparency or even "full" competency. It requires radical humility. Both from the creators and the critics. Once the dialog stops, sides are chosen and people dig in, the project fails regardless of how well or poorly it had been doing.

leke• 13 years ago

Steve's pages are very easy on the eyes.

EliRivers• 13 years ago

Also I learned that it means nothing when I hear "it is open source and peer reviewed".

I get his point, but I take exactly the other conclusion from this; perhaps ironically, because Steve Thomas has ripped it to pieces and gone to town on the code, as long as the flaws he found are fixed, I now have greater faith in it because it's open source and peer reviewed - Steve Thomas' own peer review is a big part of that.

Perhaps we should take open source and peer reviewed as meaning it can be peer reviewed; it's still on us to check who's done those reviews and, if needs be, do it ourselves and give something back.

ParadisoShlee• 13 years ago

Nadim Kobeissi spends most of his spare time fighting with people who know better. This is no surprise. I remember the 50 long twitter reply chains with a number of crypto developers calling him out for bad design choices.

davidw6• 13 years ago

For all the people ranting about what an incompetent this guy is, why does no one complain that stuff like GPG is so complicated that

1) Ordinary people probably can't use it.

2) It probably would be pretty easy to talk ordinary people into sending you their private keys/passphrases/etc... in the guise of 'helping' them, because it's so complicated.

No one seems to talk about horrible complexity as a big security vulnerability.

Also, I agree that there is something not quite right in the security community that often makes them talk with their Comic Book Guy voices.

DanBC18• 13 years ago

eh, I've said that many times. I've even said it on HN.

zainny8• 13 years ago

But why would anyone even bother trying to fix the situation? Any attempt to will just result in the entire crypto community community calling you "worthless" and "unqualified".

This is the entire problem. Funnily enough, I imagine the original implementers of the major crypto libraries we use today and take for granted would probably equally be called "idiots" and "losers" if judged by today's internet crypto heroes.

The crypto community is flat out toxic. You ain't gonna see progress from anywhere until the situation changes.

tptacek29• 13 years ago

I hear this all the time but I think it's a little verkakte. Here's why:

First, GPG isn't that hard to use. When people say this, I assume they're referring to the command-line tools. But nobody advocating GPG for "ordinary people" thinks they should be using the command line tools. Here's the day-to-day UX for GPG in Mail.app: (1) ask for acquaintance's key, (2) double click it in the email message when it arrives, (3) optionally call acquaintance the first time you use the key to verify it, (4) send acquaintance mail. Depending on your settings, you may need a step (5), "push encryption button in mail composer window".

Second, to the extent that GPG is fussy, it's fussy because it's trying to solve a difficult problem. Wanting the problem to be easier doesn't make it easier. We would all be better off if all mail was opportunistically encrypted (OE was the dream of the late '90s, where you wouldn't even need to ask, and software would just figure out when it was possible to encrypt traffic). But GPG is doing more than OE does, because GPG is guaranteed end-to-end, even in conversations with multiple people. OE-style encryption is not that far from what we already have today with certificate-pinned DHE TLS to Gmail.

We could definitely use better UX for PGP (the fact that GPGMail is the best we have right now is telling).

But that's not what tools like this are; they're not a better UX for a proven system. They're not even the same kind of system. Cryptocat provides weaker guarantees than GPG does. It's simpler to use because it's a simpler, less secure system.

As to Comic Book Guy voice: yes, that's something that happens in infosec. You should be able to see why: it's a field populated by nerds that is uniquely adversarial. Bruce Schneier hasn't taken that tone with Cryptocat, but he's taken it with other people. If you go looking for patronizing, pedantic, dismissive tone in infosec, you're sure to find it. But let's not lose sight of the fact that the people taking that tone are (a) in this case right and (b) taking the time to communicate that rightness on their own dime.

Nobody paid Steve Thomas or Adam Langley to find bugs in Cryptocat.

davidw6• 13 years ago

I don't really have a dog in this fight, I'm not defending cryptocat, but pointing out that the "dealing with people" part is difficult, too, and that in some ways, crypto software hasn't done a particularly good job at it, especially in the past. Presumably, they have improved at it over time thanks to the suggestions, comments, and help of others. I agree that it's a difficult thing to make simple for 'ordinary people'.

I think "adversarial nerds" hits the nail on the head. I understand it, but I don't have to like it.

javajosh• 13 years ago

Out of curiosity, since you mention Mail.app, do you have a link to any good guides on hardening OSX? Or is it pretty good out-of-the box?

tptacek29• 13 years ago

The hardest part of this to read for me isn't the vulnerability, but rather:

     2011 Passwords: BPKDF2-HMAC-SHA1 with 1000 iterations
     2011 Passwords: BPKDF2-HMAC-SHA1 with 600 iterations
     2011 768 bit RSA
     2011 512 bit RSA
     2011 600 bit RSA
     2011 1280 bit RSA
     2011 1024 bit RSA
     2011 1048 bit RSA
     2011 1536/1152 bit RSA (Chrome/other)
     2011 1536/1024 bit RSA (Chrome/other)
     2011 "3072 bit" D-H	
     2011 "3072 bit" D-H	
     2011 "4096 bit" D-H	
     2012 ECC Curve25519

(edited for clarity)

Major red flag. The difference between symmetric-keyed password-based encryption, RSA, Diffie-Hellman and ECC (presuming ECDH?) isn't minor; it isn't a feature-level distinction. These are radically different designs. I'm not sure I've ever seen a system as popular as this so quickly take a tour of so much of cryptography. How could anyone have any kind of grip on the safety of a system that fundamentally changes its crypto constructions so often?

A lesson here: if you have to implement cryptography --- and you and your users would be much better off if you didn't, and rather relied on a standard implementation like PGP --- do one thing and stick with it. Think of it like being a little kid lost in a shopping mall. Don't make it harder to get found.

jiggy20114• 13 years ago

What about NACL? It seems more flexible that PGP but still provides a fairly high level of abstraction. Not sure what is a good library for doing PBKDF2 or similar though.

tptacek29• 13 years ago

I like Nacl. I also like Keyczar. I would be very worried about a project that oscillated from PGP to Nacl to Keyczar, though.

drostie• 13 years ago

Probably the best KDF you'll get right now is scrypt[1]. NaCl did not see common adoption because until a relatively recent distribution called Sodium[2], it was not portable. And I mean really, not portable. Like, just to give an example, suppose you want to use NaCl in Node.js, which is pretty good about accepting C/C++ modules. You have two options today: one doesn't work on a 64-bit system[3] and one isn't C, it's JS which was transpiled with Emscripten[4]. I mean, don't get me wrong: the fact that we can now do this in pure JS via Emscripten is amazing, but yeah, NaCl was not universally buildable and therefore was not reliably deployable, and nobody really wanted to fix it until Sodium came along.

[1] https://www.tarsnap.com/scrypt.html

[2] https://github.com/jedisct1/libsodium

[3] https://github.com/thejh/node-nacl

[4] https://github.com/tonyg/js-nacl

amouat5• 13 years ago

Crytpocat have now posted a reply:

https://blog.crypto.cat/2013/07/new-critical-vulnerability-i...

phryk• 13 years ago

https://blog.crypto.cat/2013/07/new-critical-vulnerability-i... There seems to be a response to this on the cryptocat dev blog. Since I have no clue about crypto, I can't make any assessments though; Still might be interesting for some of you guys.

plg3• 13 years ago

Nadim has a good idea here in Cryptocat. The implementation has some problems, clearly. Is anyone surprised (including Nadim)? Clearly Nadim is learning as he goes. Let's dispense with the personal attacks and instead, if we think Cryptocat is a good idea, let's help make it as secure as we can. Can we get experienced crypto experts on board? Nadim ought to be interested in that.

DanBC18• 13 years ago

Cryptocat have rejected the advice from experienced crypto experts.

Cryptocat have been given a lot of advice and they argue against it; they tell experienced crypto experts that they are wrong and that the flaws are not really flaws.

plg3• 13 years ago

If this is true, then it is disappointing.

dobbsbob7• 13 years ago

Shouldnt this be called DecryptoDog? I've never trusted any in browser/java nonsense crypto since FireGPG was exposed for dozens of problems and leaks.

parennoob• 13 years ago

BTW, everyone using the "But lives depend upon this, the CryptoCat author put lives at risk!" argument to excuse Steve Thomas's attacking tone in this article is more or less being a hypocrite.

What about the fact that Steve Thomas, by releasing a tool that makes it extremely easy to decrypt the conversations encoded by CryptoCat at specific times, has done exactly the same thing? Disclosing a vulnerability in this public manner and providing a decryption tool on a platter has probably done more damage to the hypothetical journalists who were hypothetically using CryptoCat.

I don't think bad crypto should be forgiven, but it would be easier and probably less arrogant to just submit a diff / pull request publicly that fixes all of the problems that the author observed, and then have people comment upon it. If the author rejects it, these "you are incompetent" comments can go there.

Arrogant takedowns like this "the author clearly has no effing idea about crypto" make it more difficult for newbies like me to understand and try to work on crypto. What chance do I have if any piece of software I write is going to be destroyed by withering comments like "you're a moron" without mathematically explaining what the problem is and laying out the fixes clearly and positively?

corresation• 13 years ago

by releasing a tool that makes it extremely easy to decrypt the conversations encoded by CryptoCat at specific times, has done exactly the same thing?

Assuming that cryptocat is used to avoid the monitoring of entire nations, you can be absolutely certain that those with the motivations have long ago cracked this. That is exactly why security professionals get so passionate about this, because they know that bad crypto is literally much worse than no crypto at all -- at least in the latter case you have no illusions.

Cryptocat has been under significant criticism for a long time. For instance-

https://news.ycombinator.com/item?id=5194713

-and for very good reason. After the farcical story about being investigated by CSIS (which seems laughable, because if there's one thing that government security agencies love, it's bad crypto), this project seems to be held aloft by nothing more than people saying "But he's young and passionate, so give him a chance" -- that isn't credible reasoning for crypto.

DanBC18• 13 years ago

that fixes all of the problems

Yet again: Cryptocat is broken. It is so broken that there is no possibility of making it work.

mtgx2• 13 years ago

Are there any implications for the WebCrypto API after this? I think he used Javascript crypto at first, but not sure after he turned it into a "Chrome app" (presumably based on Native Client - or is it still Javascript?).

networked2• 13 years ago

Rolling your own crypto is incredibly perilous. Now, the Cryptocat team could discard their own code, compile GnuPG with emscripten [1] and adopt the existing UI/UX to using that but who's to say GnuPG is still going to work correctly on that new platform?

The only "easy" (if insane) solution I can think of for building GPG on a known platform and still having it run in the browser is to use something like JSLinux [2] and run GnuPG inside a hidden VM communicating with it over an emulated serial interface. Then again, I'm sure that could introduce all sorts of interesting issues related to timing and randomness.

Cryptography is damn hard.

Edit: I'm aware that they've used CryptoJS but, much like calling OpenSSL directly, I would still count that as "rolling your own".

[1] See, e.g., http://manuels.github.io/unix-toolbox.js-gnupg/.

[2] http://bellard.org/jslinux/

amouat5• 13 years ago

But they didn't roll their own crypto as far as I can tell. They used CryptoJS [1]. They just failed to use it correctly.

EDIT: Here's the code https://github.com/cryptocat/cryptocat/blob/master/src/core/...

[1] https://code.google.com/p/crypto-js/

amouat5• 13 years ago

Whilst there may still be plenty of scope for error, I think there is a large difference between using CryptoJS and "rolling your own".

I wonder how "correct" CryptoJS itself is though.

networked2• 13 years ago

Whilst there may still be plenty of scope for error, I think there is a large difference between using CryptoJS and "rolling your own".

I agree to some extent but as the article we're commenting on proves, the scope for error is enough for you to render your encryption useless against an attacker armed with just a modern desktop PC.

wyck• 13 years ago

Does anyone remember this.. https://news.ycombinator.com/item?id=5194489

The story where he thought his computer was backdoored by a government agency and provides no evidence other than some weird paranoid hunches.

His original blog post http://log.nadim.cc/?p=110 has been removed, but you can find it here: https://gist.github.com/chrisbutcher/4748293/

mykhal• 13 years ago

i think that someone, who is teaching others that they are writing crap crypto, should express himself less vaguely than like: "... depending on your browser you might get these two lines of extra data ..." (in "public key")

coldcode• 13 years ago

If everyone here who complains about the folks behind Cryptocat being dumb is such much smarter, how about some of you build something like this so we can all see compare. Commenting in HN doesn't prove you know better, ship something and we can all be sure.

DanBC18• 13 years ago

I genuinely don't know if you're trolling or not.

Some of the people criticising cryptocat are respected, knowledgeable, experienced researchers with shipped product used by many people everyday.

Other people criticising cryptocat know enough about crypto to know that they should not be doing it. That's not a negative, that's a strong positive point.

kragen5• 13 years ago

I was really hoping Nadim would be successful with CryptoCat, but at least in my eyes, this bug is the failure of the project — especially because his response is, "Cryptocat is not any different from any of the other notable privacy, encryption and security projects, in which vulnerabilities get pointed out on a regular basis and are fixed. Bugs will continue to happen in Cryptocat, and they will continue to happen in other projects as well. This is how open source security works." <http://blog.crypto.cat/2013/07/new-critical-vulnerability-in...

No. This is how open-source "security" fails. GnuPG has not had a security bug since 2008, and I don't think it's ever had a security bug that left your encrypted messages open to interception. You can't start with insecure cryptographic software and bugfix it until it's secure. You'll just bugfix it until only the bad guys know where the new holes are. How long has the Russian equivalent of the NSA (or, if you're Russian, the NSA) known about Lucky Thirteen, for example? How long did they know about the Million Message Attack?

(That, and the array of "15-bit" single-digit integers.)

mgraczyk• 13 years ago

I would just like to say that it makes me very happy to see even modestly technical discussions about cryptology make it so high up on HN.

Lately it has seemed like all the highly ranked articles have been about the PEOPLE or COMPANIES doing crypto, and not about the cryptology itself.

Crypto is interesting not because people are doing it, breaking it, and improving it every day. Crypto is interesting because of HOW people are breaking it and improving it.

blt• 13 years ago

There should be no benefit of the doubt or warm encouragement for these developers. The bug with the array of decimal digits shows minimal programming competence: the author either does not understand how numbers and strings work in a computer, or doesn't read API documentation. Nadim seems like a naive person without a computer science background who is attracted to cryptography as an activist, but has no knowledge beyond a 3-page tutorial. It is extremely arrogant and irresponsible for a developer with such little domain expertise to promote this product as secure.

dakimov• 13 years ago

It is totally fine! Compare this to Android: http://bluebox.com/corporate-blog/bluebox-uncovers-android-m...

Security, privacy, copyright — these are three problems the humankind is as dumb as a monkey with.

hnolable• 13 years ago

Does anyone know if there are any issues with the javascript OTR library they use (https://github.com/arlolra/otr)? Or are all the issues only with their custom multi party chat encryption system?

arthulia• 13 years ago

Both comments are wrong since "Cryptocat.randomString(64, 0, 0, 1, 0)" generates a string that is 64 decimal digits which is 212.6 bits or 26.6 bytes.

How can you have .6 bytes or bits?

bmh100• 13 years ago

A bit is a 0 or a 1. Two bits is 00, 01, 10, or 11. Each bit doubles the amount of information. This means that information representing information as bits products powers of 2. To get the number of bits (the power of 2 to represent the number), one takes the log, base 2, of the number. If I took the example of 2 bits and limited it to 00, 01, 10, there would be 1.6 bits. Log2(3) = 1.6.

stefanix• 13 years ago

Author complains "I learned that it means nothing when I hear it is open source and peer reviewed." Yet his article wonderfully illustrates the opposite.

jaekwon• 13 years ago

What alternatives are there for group chatting?

mxcm• 13 years ago

It would almost be too comical if cryptocat was actually sponsored (developed)? in proxy by some secret service. In general, people that use cryptocat are probably using it to discuss more intellectual thoughts, such thoughts might be useful to record and analyze. It is interesting that as the relative adoption of the service grew, the encryption mechanism became weaker..

DecryptoCat

Related Stories