News for hackers. Stuff that matters.
Re:CryptoCat iOS Application Penetration Test [pdf] by daira on Wednesday April 02, 2014 @10:19PM (#7520508)
This issue (or one with very similar effect) was also found by the Least Authority audit: https://github.com/cryptocat/cryptocat/issues/607

(The 'issue E' that it references is https://github.com/cryptocat/cryptocat/issues/606 .)

Re:CryptoCat iOS Application Penetration Test [pdf] by daira on Thursday April 03, 2014 @12:29AM (#7520960)
Actually I strongly suggest reading these in conjunction with iSec's issues 12 through 16, because each team spotted some details that the other missed.
Re:CryptoCat iOS Application Penetration Test [pdf] by tptacek on Thursday April 03, 2014 @07:48AM (#7522166)
Are you sure that's not because the different teams had different scopes? The iSEC audit was specifically tied to the iOS application.
Re:CryptoCat iOS Application Penetration Test [pdf] by daira on Friday April 04, 2014 @05:36PM (#7534551)
The scopes had a great deal of overlap; although we (Least Authority) didn't consider the iOS client at all, the rest of iSec's audit has essentially the same scope as ours. The point I was trying to highlight is how easy it is to miss things, and therefore that having independent concurrent audits is actually a really good idea. It would probably be even better if the teams worked mostly independently but were able to exchange draft versions of their reports (before the mitigations necessary for a public release).