Please, really don't use it with people in bad regimes like that. From looking at http://www.matasano.com/articles/javascript-cryptography/ - a link I'd urge you to read too - an automated injection of a JavaScript script would be all that's required to defeat CryptoCat entirely.