Recato private chat: how to check
In the private chat, what you write is encrypted on your phone or in your browser and only read inside a verified secure enclave. Recato's server only passes encrypted bytes along — and, for the web searches you confirm, the search phrase. If the screen's code fails, the server also gets a notice with only the type of the error and where it happened in the code, so we can fix it, with nothing from the chat. Saved chats are encrypted with a key only you have.
All of this depends on the screen's code being the published one. In the app and in the extension, that code comes installed with them. On this page, it comes from Recato's server on every visit. So there are three ways to check it.
1. In the Android app
The private chat screen comes inside the app and only changes with a new version in the store. Its files are in the app under assets/privada/ and have the published fingerprints.
2. With the «Recato — Private chat» extension
In Chrome, Edge and Firefox, the private chat opens from the copy of the screen that comes inside the extension: the code does not come from the server. And if you open this page with the extension, it checks it: the icon shows a green ✓ if the page is the published one, and a red warning covers the page if it is not.
3. By hand
Download each file of this page and compare its SHA-256 fingerprint with the published one, for example:
curl -s https://privada.recato.ai/privada.js | shasum -a 256
The page (index.html) carries the fingerprints of privada.js and estilo.css, and the browser refuses others; privada.js carries the fingerprint of the enclave module (privatemode.wasm) and refuses another.
Fingerprints of version 1.0.4
| File | SHA-256 |
|---|---|
index.html | 1784abec359654a777dd3aa6b2168a2665d1f55242ab163dafc0a3cf4e9d83b6 |
estilo.css | ba13a21ce607b36b2b468f142a505088daef1259958f137db9cfd4c79155ac57 |
privada.js | 16b850b9c0d9d7ca5934c4e1b93fe7b57886109201a7e69247e81c93aeb5afbc |
privatemode.wasm | 86aa4b0101d07afd44c3ed99ed27d43caecc6e2d0a2fa0d576a1463d944e5f1d |
Every version is published at https://raw.githubusercontent.com/Forsnaps/recato-private-chat/main/manifestos.json, a public place that is the same for everyone, with the code of this part at https://github.com/Forsnaps/recato-private-chat. Anyone can repeat the build from that code and get exactly the same files. The licences of the code, ours and third parties', are in licencas.txt.
Limits
- Without the extension or the app, this page cannot prove by itself that it is the published one.
- The extension detects a different page; it cannot stop it from arriving.
- Another extension installed in your browser can read what is on the page.