Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Telegram bot with filters to read Hacker News

storebot.me

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Show HN: Telegram bot with filters to read Hacker News

#21

Post by sz4kerto »

embik wrote: post #16
sz4kerto wrote: post #13

Earlier quoted context omitted.

So you trust a person's word (believing that telling the truth is in his interest) more than an open client? I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. > Someone actually cracking WhatsApp would be a serious issue for OpenWhisperSystems. Why can't you imagine that e.g. Moxie has been blackmailed/etc.…

> I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. Please read the link I provided before[0], it features links to a bunch of people saying Telegram is not secure[1][2][3][4]. It's not just Moxie. I actually have not seen any expert saying that Telegram is secure, but I'm interested in such thing. As the T…

Hey, sorry, you may have misunderstood me -- I'm not saying that it's only Moxie who's considering Telegram insecure. I meant that Telegram is considered insecure by many experts; but when it comes to the security of Whatsapp we can only rely on the claims of Moxie and Facebook, without the chance for open review.

> With a closed client that allegedly implements a secure encryption method (we also know it's good because it's open as well) there's a chance it doesn't work the way it's supposed to work, but there's also the chance it's working as intended.

However, from the other side: Telegram is not _trivially_ breakable (there's a 2^64 attack, which is not 'trivial'), but Whatsapp might very well be simply MITM-ed by Facebook. So you could also look at this from a different perspective and say "A powerful adversary could probably break Telegram messages, but maybe all Whatsapp messages are immediately decodeable by Facebook".

Also note: you have provided 5 links, but [0] simply refers to [1] and [2], [1] says that "We stress that this is a theoretical attack on the definition of security and we do not see any way of turning the attack into a full plaintext-recovery attack", [2] claims that there could be attacks (but does not provide one), [3] is a real attack, [4] is not about an attack.

So while I see that there are valid concerns re. Telegram's security, the links you have provided are a nice example of the Internet echo chamber.

Re: Show HN: Telegram bot with filters to read Hacker News

#22

Post by embik »

sz4kerto wrote: post #21
embik wrote: post #16

Earlier quoted context omitted.

> I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. Please read the link I provided before[0], it features links to a bunch of people saying Telegram is not secure[1][2][3][4]. It's not just Moxie. I actually have not seen any expert saying that Telegram is secure, but I'm interested in such thing. As the T…

Hey, sorry, you may have misunderstood me -- I'm not saying that it's only Moxie who's considering Telegram insecure. I meant that Telegram is considered insecure by many experts; but when it comes to the security of Whatsapp we can only rely on the claims of Moxie and Facebook, without the chance for open review. > With a closed client that allegedly implements a secure encryption method (we also know it's good beca…

Uhm, yes, you're absolutely right, I have missunderstood you and I absolutely agree with what you're saying. An open client with a secure encryption is always preferred, but I doubt we will see Telegram become that one because they have been ignorant to people pointing out flaws before.

> but Whatsapp might very well be simply MITM-ed by Facebook

As long as you're not inspecting the binaries you use for Telegram (or build the applications by yourself) however, you can't guarantee it's not MITM-ed by someone either. Maybe you do, but most users certainly do not. When downloading the Telegram app from Google Play, there is not much difference to the WhatsApp app. You're basically trusting small groups that they provide the "real" binary to you. Not much of a difference to trusting Moxie's words, is it?

Link 0 was to remind you of the link I posted before and the other links might not provide specific (or effective) attacks, but they point out flaws in Telegram's protocol (1,2,3) and the way they test / value the strength of their encryption (4). More flaws are very much plausible for a homebrew crypto solution.

Re: Show HN: Telegram bot with filters to read Hacker News

#23

Post by runn1ng »

lambdadmitry wrote: post #12
runn1ng wrote: post #5

Earlier quoted context omitted.

Well, it's about the same level of security as other messengers like Facebook Messenger/Skype/..., it has a great robot API, is continuously updated on all platforms, is adding features fast, it has a great GUI, it "just works" everywhere. Yeah, it's possible to have security like Signal, but then synchronization between devices is PITA and the rate of new features is slow. It was not done by VK. It was done by Pavel…

>It was not done by VK. It was done by Pavel Durov after he escaped from Russia. It's Durov's bullshit. Telegram is developed one floor beneath the VK office in Saint-Petersburg, Russia. Moreover, Durov himself often visits the office. Sources: [1] [2] So yeah, between this and "MTProto is secure" I'm not sure if one can trust any other claim about Telegram's security (like "your chat logs are secure on our servers")…

Interesting, thanks for that info.

I wondered who is financing Telegram since it's really moving fast and it has no apparent source of revenue; it makes sense that it's even coming from Russian government, since they want alternatives to US-owned services.

Re: Show HN: Telegram bot with filters to read Hacker News

#24

Post by pfg »

skrowl wrote: post #18
sz4kerto wrote: post #7

Earlier quoted context omitted.

BTW, if we treat any claims about privacy and security with extreme skepticism (rightfully), then why do we trust Moxie and Facebook without being able to verify their claims? (I'm not saying that Moxie et al. are untrustworthy.)

The skepticism is right. The person leading the charge for "but but Telegram rolled their own crypto, so you shouldn't use it" is actually one of the developers of Signal. Not a single working proof of concept attack on telegram has been released and no one even claimed to have decrypted a single message. I'm not saying Telegram is impervious to ever being cracked, but it's certainly not cracked yet or at all proven…

Being able to decrypt messages should certainly not be the benchmark you use when evaluating crypto, especially when it comes to rather new protocols. History has shown that severe theoretical issues that cryptographers have been warning against for years (see: CBC and padding oracle attacks) will almost always lead to practical attacks eventually.

Telegram has a number of those weaknesses, and many of its implementation details don't paint a good picture in terms of security either[1].

[1]: https://twitter.com/matthew_d_green/status/72646884513381171...

Re: Show HN: Telegram bot with filters to read Hacker News

#25

Post by playworker »

runn1ng wrote: post #23
lambdadmitry wrote: post #12

Earlier quoted context omitted.

>It was not done by VK. It was done by Pavel Durov after he escaped from Russia. It's Durov's bullshit. Telegram is developed one floor beneath the VK office in Saint-Petersburg, Russia. Moreover, Durov himself often visits the office. Sources: [1] [2] So yeah, between this and "MTProto is secure" I'm not sure if one can trust any other claim about Telegram's security (like "your chat logs are secure on our servers")…

Interesting, thanks for that info. I wondered who is financing Telegram since it's really moving fast and it has no apparent source of revenue; it makes sense that it's even coming from Russian government, since they want alternatives to US-owned services.

https://telegram.org/faq#q-how-are-you-going-to-make-money-o...

Re: Show HN: Telegram bot with filters to read Hacker News

#26

Post by lucb1e »

embik wrote: post #11
lucb1e wrote: post #9

Earlier quoted context omitted.

Especially when we have open source alternatives like all Telegram clients that implement MTProto (Telegram's end to end encryption protocol).

MTProto isn't considered secure[0], so I'd rather trust someone (Moxie) who actually developed open source encryption[1] that is considered secure. I'm not blindly following Moxie here but I'd argue that it's in his own interest to only verify correct claims - reputation is your CV in cryptography. Someone actually cracking WhatsApp would be a serious issue for OpenWhisperSystems. [0] https://security.stackexchange.c…

Re: [0]: You are linking a question, not an answer. I downvoted the top answer months ago because it has the same logical traps as the argument you bring forward. "Someone invented it themselves [as if moxie didn't] and it doesn't follow some best practices." All the while not being able to mention a single real issue.

Re: Show HN: Telegram bot with filters to read Hacker News

#27

Post by lucb1e »

embik wrote: post #16
sz4kerto wrote: post #13

Earlier quoted context omitted.

So you trust a person's word (believing that telling the truth is in his interest) more than an open client? I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. > Someone actually cracking WhatsApp would be a serious issue for OpenWhisperSystems. Why can't you imagine that e.g. Moxie has been blackmailed/etc.…

> I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. Please read the link I provided before[0], it features links to a bunch of people saying Telegram is not secure[1][2][3][4]. It's not just Moxie. I actually have not seen any expert saying that Telegram is secure, but I'm interested in such thing. As the T…

Re [3]: I was not aware of that one. If it costs upwards of $300k it's beyond what I'd consider a personal risk, but it's very much something they should be looking to fix!

Re: Show HN: Telegram bot with filters to read Hacker News

#28

Post by reitanqild »

hiq wrote: post #20
sz4kerto wrote: post #7

Earlier quoted context omitted.

BTW, if we treat any claims about privacy and security with extreme skepticism (rightfully), then why do we trust Moxie and Facebook without being able to verify their claims? (I'm not saying that Moxie et al. are untrustworthy.)

About e2e encryption in WhatsApp and the fact that it is closed-source software, see this thread for tptacek's views on the topic: https://news.ycombinator.com/item?id=11432047 In short, "sources do not guarantee anything, and it's better to inspect the binary directly". About Telegram, there have already been a few papers and so many articles pointing out its obvious security flaws that it is not even worth discussi…

> Any search engine will return enough results for you to decide whether you should trust Telegram or not.

I think this is a fallacy: if you live your life by "nothing but the safest option" rule you are missing out in a number of ways.

I do not use chat programs for anything that is likely to cause me serious trouble, only for sharing photos with my family, chat with my wife etc.

Telegram is more open source than Whatsapp, isn't owned by Facebook, delivers features faster, has a better desktop client, has a an api and encourages useful bots.

I do use serious crypto when I need it. Where I live I luckily don't need it for photos shared with my family.

Re: Show HN: Telegram bot with filters to read Hacker News

#29

Post by reitanqild »

embik wrote: post #16
sz4kerto wrote: post #13

Earlier quoted context omitted.

So you trust a person's word (believing that telling the truth is in his interest) more than an open client? I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. > Someone actually cracking WhatsApp would be a serious issue for OpenWhisperSystems. Why can't you imagine that e.g. Moxie has been blackmailed/etc.…

> I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. Please read the link I provided before[0], it features links to a bunch of people saying Telegram is not secure[1][2][3][4]. It's not just Moxie. I actually have not seen any expert saying that Telegram is secure, but I'm interested in such thing. As the T…

> Please read the link I provided before[0], it features links to a bunch of people saying Telegram is not secure[1][2][3][4]. It's not just Moxie. I actually have not seen any expert saying that Telegram is secure, but I'm interested in such thing.

I don't like Telegram claiming that it us unbreakable in the early days.

That said: I don't care for the things I use Telegram for. Most people seem to post their thoughts to Facebook or Twitter anyway, compared to that Telegram is a better option in my case.

For serious stuff we use seriohs crypto anyway, don't we?

Re: Show HN: Telegram bot with filters to read Hacker News

#30

Post by tptacek »

skrowl wrote: post #18
sz4kerto wrote: post #7

Earlier quoted context omitted.

BTW, if we treat any claims about privacy and security with extreme skepticism (rightfully), then why do we trust Moxie and Facebook without being able to verify their claims? (I'm not saying that Moxie et al. are untrustworthy.)

The skepticism is right. The person leading the charge for "but but Telegram rolled their own crypto, so you shouldn't use it" is actually one of the developers of Signal. Not a single working proof of concept attack on telegram has been released and no one even claimed to have decrypted a single message. I'm not saying Telegram is impervious to ever being cracked, but it's certainly not cracked yet or at all proven…

Can you cite anyone working professionally in cryptography, whose reputation we might be aware of, who has said anything positive about Telegram's crypto? It's not just Moxie Marlinspike criticizing Telegram. Look what Matthew Green has had to say.
Post reply on HN