hellais / cryptocat Goto Github PK

Cryptocat lets you instantly set up secure conversations. It's an open source encrypted, private alternative to other services such as Facebook chat.

• A client-side 4096-bit Diffie-Hellman-Merkle public key agreement engine.
• A client-side AES-256 implementation is used to encrypt data.
• HMAC message integrity verification.
• The identity of chatters can be confirmed via key fingerprints, à la OTR.
• A seeded, cryptographically secure random number generator that relies on browser elements, DOM, JavaScript variable state, and more to produce entropy. The resulting entropy is hashed to produce the final seed, which is then fed back to the CSPRNG.
• Compatible with all modern browsers, and includes a mobile website that is fully compatible with iPhone, Android and BlackBerry.
• Cryptocat Chrome, a Chrome app that loads all code locally, and is secure from being served compromised code.
• Chats are securely deleted after one hour of inactivity.
• A sleek design with time-stamping, optional audio notifications, fluid-window mode, and mobile support.
• Translations available for French and Catalan.

• Noncommercial — You may not use this work for commercial purposes.
• Attribution — You must attribute the work to the Cryptocat project (but not in any way that suggests that they endorse you or your use of the work).
• Share Alike — If you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Additionally: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

• Cryptocat provides strongly encrypted, secure communications. However, it is not a replacement to GPG. Think responsibly if you are in extreme, life-threatening situations.

• Paranoid users may want to use Cryptocat Chrome, a Chrome app that loads all code locally, and is secure from being served compromised code.

• The code for secure deletion of idle chats after one hour is not included in the Cryptocat git repository. On the production server, it's actually a cron job that checks the modification time of chats and wipes them securely. Those wanting to set up similar functionality should consider writing something similar.

Cryptocat is developed by Nadim Kobeissi. It uses parts of the crypto-js library and the Bitcons iconset. Furthermore, Cryptocat is indebted to Paul Brodeur, David Mirza, Hasan Saleh, Morgan Sutherland and Tina Salameh for their suggestions and beta testing.