so we've had a solution to the credential sniffing for 10+ years: our services support AUTH via something very similar to CRAM-MD5.
with that out of the way: you've missed the main point, and that is that it's really really hard (I would use the word impossible but I'm not 100% certain) to secure multiuser chat.
the sheer number of places that could be compromised is so high, that offering a 'secure connection' (which users associate with actually secure online commerce) is dangerously misleading.
we understand the threat model very well, and we recommend that you shouldn't trust us to secure your communications, and suggest something like fish instead.
with that out of the way: you've missed the main point, and that is that it's really really hard (I would use the word impossible but I'm not 100% certain) to secure multiuser chat.
the sheer number of places that could be compromised is so high, that offering a 'secure connection' (which users associate with actually secure online commerce) is dangerously misleading.
we understand the threat model very well, and we recommend that you shouldn't trust us to secure your communications, and suggest something like fish instead.