OLDER VERSION OF CRYPTOCAT DOWNLOAD SOFTWARE
OLDER VERSION OF CRYPTOCAT DOWNLOAD CODE

OLDER VERSION OF CRYPTOCAT DOWNLOAD SOFTWARE

Don't allow 'security' software to perform a person-in-the-middle attack on your connection.Keep your browser up to date and heed security notices (expired or invalid certificate warning, for example).Whether you're using the web app or downloading a native client, verify the certificate of the server you're connected to.

OLDER VERSION OF CRYPTOCAT DOWNLOAD CODE

As you mentioned, using the apps is a more secure option, since we're able to digitally sign the code.

There are also things you (and other users) can do to to protect yourself when using the service:

Continue to explore new ways to protect (and users) against attackers.

Offer large monetary incentives to researchers] to help identify weaknesses in our server infrastructure that might expose us to the type of threat you're concerned about.

Using HSTS to prevent downgrade to (insecure) HTTP.

Not supporting weak cypher suites since those could be used for downgrade attacks.

There are a few things we have in place to mitigate these sorts of threats though: But obviously the stakes are much higher when we're talking about what is likely some of our most sensitive data (or at least the keys to it) than they would be for chat or most other web apps. This seems surprising on the surface, but it's really no different than running anything else malicious on your machine. Ultimately an attacker who is able to modify the JavaScript client that is sent from the web server to the userвЂ™s device will be able to capture whatever is entered by the user into their malicious (web) app. Though I don't see any questions, you raise some good points. Sync Type: Not Definitely an interesting topic. It would be nice if you guys could shed some light onto this problem. So I'm a little bit skeptical on how secure this process actually is. However, the initial account creation process is (always?) done in a browser - and not in the desktop app. Usually this may not be a problem because a security cautious person could solely rely on the 1Password desktop apps (which are probably properly signed and thus trustworthy). If an attacker could compromise the web server(s), he/she could change the JavaScript code to silently grab all the secret keys and master passwords and post them to some hacker's server. I'm suspecting that this is also true for the JavaScript code served via. So if an attacker could compromise the web server that's serving the JavaScript files for the web chat, he/she could change the JavaScript code so that it always sends a copy of all decrypted data to a hacker's server. From that project I've learned that you cannot have an absolute air-tight end-to-end encryption with browsers because there is no way (that I know of) of cryptographically signing JavaScript code. I'm not a security expert per se but I know the basic stuff pretty well, I guess.ДЄt my job, I was involved in writing an end-to-end encrypted web chat. So, I'm a (senior) software developer myself.

Older version of cryptocat download