Secure messaging project, Cryptocat, apologizes over bug

The founder of an eavesdropping-resistant instant messaging application called Cryptocat has apologized over a now-fixed bug that made some types of messages more vulnerable to snooping.

Cryptocat, which runs inside a web browser, is an open-source application intended to provide users with a high degree of security by using encryption to scramble messages. But Cryptocat warns that users should still be very cautious with communications and not to trust their life with the application.

The vulnerability, found by Steve Thomas, affected group chats and not private conversations, said Nadim Kobeissi, in an interview from Germany Friday. The encryption keys used to encode those conversations were too short, which in theory made it easier for an attacker to decrypt and read conversations.

The error was the result of an oversight spotted by Thomas, Kobeissi said. The encrypted conversations were still carried over SSL (Secure Sockets Layers), another overlay of encryption. But if an attacker broke the SSL encryption and had the underlying encrypted chats, "it would be significantly easier to crack" using brute-force techniques, he said.

The bug was fixed in Cryptocat versions 2.0 and up about a month ago after Thomas notified the project. The vulnerability persisted for about seven months between September 2012 and April.

Although Cryptocat noted the patch in its changelog, Kobeissi wrote a detailed blog post on Thursday explaining the issue after Thomas published a sharp critique.

"This is a really difficult situation," Kobeissi said. "I am not a person who will gloss over this kind of bug for absolutely no reason just to maintain the image of the project."

The bug was completely unacceptable, but it is common for errors to be revealed in open-source projects, he said. Kobeissi said he gave Thomas a US$250 reward out of his own pocket even though Cryptocat has no formal bug bounty program.

"I wanted to be on the record that he was paid for his effort," Kobeissi said.

Cryptocat has seen surging interest since the U.S. National Security Agency's surveillance program was detailed by whistleblower Edward Snowden. Kobeissi said Cryptocat saw 65,000 new users in just a month since the revelations were published.