web

What happens if a user changes client machines? You seem to suggest storing their hashed password in the browser, but if they change machines they won't have that hashed password around. How will you go from plaintext password to hashed password without having the salt used with PBKDF2? You say user passwords are never sent over the wire (not even the hash)[1], but then say users have an object containing their hashed password (is the documentation here out of date?) [1] - https://github.com/cryptic-io/web

One of cryptic's features is that the front-end is completely open-source. You can see the source for the current prototype here: https://github.com/cryptic-io/web We'll be releasing tools, like a browser-extension, that will help confirm that the code you've received on the site is the same as that in the repository. And since the whole frontend is open-source and is only html/js/css, you can host it on your own box if necessary. To address your points 1 and 4: Since all data is encrypted BEFORE leaving your browser (this was NOT the case with lavabit) even if our servers were compromised your data would still be secure.

Yes! It's using the excellent Stanford Javascript Crypto Library. Source here: https://github.com/cryptic-io/web

Thanks! It's been open sourced since conception, here's the repo: https://github.com/cryptic-io/web. We choose a website because it has the smallest barrier of entry. We are planning on releasing a browser extension that would verify the code on the website against the open source repo to prevent tampering. We are planning on making a native app in the future as well.