<p>The founder of an eavesdropping-resistant instant messaging application called Cryptocat has apologized over a now-fixed bug that made some types of messages more vulnerable to snooping.</p><p>Cryptocat, which runs inside a web browser, is an open-source application intended to provide users with a high degree of security by using encryption to scramble messages. But Cryptocat warns that users should still be very cautious with communications and not to trust their life with the application.</p><p>The vulnerability, found by Steve Thomas, affected group chats and not private conversations, said Nadim Kobeissi, in an interview from Germany Friday. The encryption keys used to encode those conversations were too short, which in theory made it easier for an attacker to decrypt and read conversations.</p><p>The error was the result of an oversight spotted by Thomas, Kobeissi said. The encrypted conversations were still carried over SSL (Secure Sockets Layers), another overlay of encryption. But if an attacker broke the SSL encryption and had the underlying encrypted chats, "it would be significantly easier to crack" using brute-force techniques, he said.</p><p><a href="http://www.pcworld.com/article/2043700/secure-messaging-project-cryptocat-apologizes-over-bug.html">Keep reading...</a></p><p>Read also:</p><p><a href="http://www.scmagazine.com.au/News/349150,cryptocat-hole-made-conversations-crackable.aspx">Cryptocat hole made conversations crackable</a> (SC Magazine Australia)</p><p><a href="http://www.h-online.com/news/item/Cryptocat-s-false-sense-of-security-with-crackable-chats-1911793.html">Cryptocat's false sense of security with crackable chats</a> (The H)</p><p>Explore: <a href="http://news.google.com/news/more?ncl=d6yufwBT-2la6wM9cE3uqHbFoB1oM&ned=us">8 additional articles.</a></p>