So I recently found this tool called hack.chat. It's a disposable, browser-based IM system. If I were to use this at a friends house, public network, or at work, it is possible for someone on the network to capture messages being sent and received to reveal the conversation?

When you look at the URL it does have HTTPS, so does that mean the messages are encrypted?



You may not understand https, so I'd like to explain it a little bit.

What Happens With HTTPS?

Since it uses HTTPS, you generally don't have to worry about packet sniffing if it's properly implemented. With or without HTTPS, the program is not safe from packet sniffing (few things are).

Is that a problem? No. Why? Because with properly implemented crypto, when a malicious individual attempts to sniff your packets, the conversation will look like this:

  • Kalina sends: I love you!
  • Simon sees: I love you!
  • Rory McCune sees: abdLepdsdrf093423kl4rfdslDpr934szdl3790= (gibberish)

But What Happens If There's No HTTPS?

Without properly-implemented crypto, Rory will be able to discover what's being said. The conversation will look like this:

So, while it will not prevent packet sniffing when using properly-implemented HTTPS, it will prevent the attacker from understanding what you're talking about when they sniff the connection. Therefore, https should, generally speaking, protect your Buffalos from unauthorized Rorys.

Does that make sense? Check the github for this project. Keep in mind that client is all that's listed. I am unaware if they use a server end, but it doesn't look like it. Personally, I would be suspicious of such a program unless I had time to go through the entire code base.


Mark's answer is correct regarding the HTTPS and packet capture. To answer your second question: While the traffic is encrypted, that does not guarantee that the messages themselves are encrypted. It may be possible for someone else to recover and read your messages off the chat server. This is a much less likely vector, but it may be possible for the chat service administrators or law enforcement to read your messages, if they have a desire to do so. You'd have to see what the site says about encryption, and even then you'd just have to take their word for it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.