How safe do you want your instant messaging to be from eavesdropping?

It sounds like an easy question. Who doesn’t want their online communications to be totally secure? But it’s actually more complicated than that.

The Cryptocat site

A debate has been raging in the computer security world of late over just these questions. The argument has centered on a tiny secure chat program called Cryptocat and whether it’s safe for use by dissidents in repressive regimes.

News reports touted Cryptocat as “deceptively simple for a Web app that can save lives,” but computer researchers and even Cryptocat’s creator cautioned that it was an experiment that wasn’t ready to be used in life-and-death situations.

The end result? This week college student Nadim Kobeissi, who created the program, updated it to make it safer – but harder to use. Originally, Cryptocat was dead simple: You could just go to a website, type in the name of your chat room and hit enter. Other people you wanted to chat with could enter the same name and all have their communications encrypted in secret code. Now, people can only create chat rooms if they use a Web browser “add on” – safer, and still easier than some other tools, but not as easy as before.

The controversy is a reminder that online security software is still too difficult for most people – and that tools that are user-friendly are often of dubious value when it comes to keeping people safe.

You can imagine it this way: The more locks you add to a building, the harder it is to get in, even if you have all the right identification and keys. It’s a similar story with computer programs.

Most people might not realize it, but software exists that can encode your emails, instant messages and so forth so that only people who have the right “key” can read it. These programs, generally called encryption software, have been around for years, but hardly anyone uses them.

“The tools we have now are basically unusable,” said Moxie Marlinspike, a prominent computer researcher best known for making smartphone security tools. “And this is the most important problem we should be trying to solve.” In fact, people have been pointing this problem out for a while, but nobody has really fixed it.

This usability challenge was part of the impulse behind Cryptocat, an experimental program that won an award in April at The Wall Street Journal’s Data Transparency “codeathon.”

“I believe that you do not gain security unless you balance between security and accessibility,” says Mr. Kobeissi. If nobody uses your secure tool, what’s the point?

Unfortunately, the easiest tools have security holes that might not be acceptable for people in dangerous situations. The biggest one, said Mr. Marlinspike, is that the Web isn’t all that safe. Sure, for most people, it’s fine; there’s no need to stop using e-commerce or webmail, particularly if you aren’t a dissident fighting a brutal regime. But over the past couple of years security researchers have seen a bunch of attacks in which hackers fooled people into thinking they were on a secure site, when really their information was being taken.

And even if a website is secure, something else on your computer might not be. All the encryption in the world doesn’t matter if the computer you’re using has malware such as a key logger that transmits what you type even before it is encoded. To get around those you need far more computer-security education than most people are able to get.

It’s easy to go down the rabbit hole and conclude that security is a losing battle that shouldn’t even be waged. But that doesn’t seem right, either.

Nobody in the computer security world argues that people should use programs that transmit messages insecurely, as some (but not all) popular tools do in their default settings.

And not everyone who wants some kind of security is facing the threat of attack from a powerful government. Plenty of people simply don’t trust Internet companies that might use their information to sell them ads, for example; others are facing threats from people like domestic abusers but not from government hackers.

“Some users have more stringent needs than others, depending on the capabilities of their respective adversaries,” said Meredith L. Patterson, a computer scientist who has worked on Cryptocat and other security projects.

Mr. Kobeissi told Digits that he would not suggest that people in true danger rely on the Cryptocat site but that he had hoped it would still be useful for people in other situations.

Experimental programs like Cryptocat often try to bridge the divide by warning people that their tools aren’t 100% secure and that people shouldn’t count on them for safety.

But study after study has shown that people ignore warnings online. (If you’ve ever clicked “OK” despite a big red screen telling you it’s dangerous, or downloaded a program despite being warned that it could be unsafe, you see what we mean, here.)

“This isn’t something that’s fully resolved, and how we deal with this question is unknown,” Mr. Marlinspike said.

Mr. Kobeissi and others are working to solve these problems, but real solutions could be years away.

So, how safe do you want your communications to be? At least for now, it depends on how much you’re willing to do to make it safe.


For the latest news and analysis,

