Cryptocat connects to Facebook as an XMPP client over its outbound BOSH relay. No code from Facebook is loaded or executed within Cryptocat, and the login procedure happens in a sandboxed window, Kobeissi wrote.
Cryptocat version 2.2 is available for Chrome, Safari and Opera. An update to Firefox is due to be released later this week.
Sign up for CIO Asia eNewsletters.