Telegram founder: US intelligence tried to bribe us to weaken encryption • Hacker News Board

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#61

Post by kome » Thu, Jun 15, 2017, 4:05 PM UTC

ghughes wrote: post #11

otalp wrote: post #5

>"It would be naive to think you can run an independent/secure cryptoapp based in the US." This seems to be a shot at WhatsApp and Signal, implying that they have loopholes that allow the FBI to snoop in. I'm not sure how true that is. This might be an attempt to deflect from the fact that Telegram uses a home-baked encryption protocol which might be insecure, while WhatsApp uses the OWS protocol.

Bingo. The CEO of Telegram likes to spread conspiracy theories that are good for business. In a recent tweet he claimed that Signal is "funded by the US government", [1] citing a ridiculous hit piece on OWS and Moxie. [2] [1] https://twitter.com/durov/status/872891017418113024 [2] https://surveillancevalley.com/blog/government-backed-privac...

Good for business but what business? As far i know he is running telegram using his own money, and he has no businesses plan and he doesn't want one.

Only the telegram server is closed source (for now), telegram client and protocol are open source.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#62

Post by mullen » Thu, Jun 15, 2017, 4:05 PM UTC

logicallee wrote: post #26

The problem I have as an end user is that I want the infrastructure protecting me to be invisible. Let's return to this after the following paragraphs. I will make some pretty far-reaching conclusions. I think we can all agree that if some totally below-the-radar crypto anarchist who happens to have a few million dollars from bitcoins figured out that they actually have enough access via the dark web to bribe a few R…

Ted Kaczynski, is that you? When did they give you Internet access? Wait, I thought you hated the Internet?

> I think we can all agree that if some totally below-the-radar crypto anarchist who happens to have a few million dollars from bitcoins figured out that they actually have enough access via the dark web to bribe a few Russian generals and long story short detonate a nuclear bomb a few miles outside New York City, just for shits and giggles, then they should be stopped at some point along the way.

Seriously, listen to yourself. Chop up that sentence and analysis it and hear how silly you sound.

Why didn't you thrown Jason Borne or James Bond in there while you were at it?

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#63

Post by Dolores12 » Thu, Jun 15, 2017, 4:09 PM UTC

retox wrote: post #9

otalp wrote: post #5

>"It would be naive to think you can run an independent/secure cryptoapp based in the US." This seems to be a shot at WhatsApp and Signal, implying that they have loopholes that allow the FBI to snoop in. I'm not sure how true that is. This might be an attempt to deflect from the fact that Telegram uses a home-baked encryption protocol which might be insecure, while WhatsApp uses the OWS protocol.

If I'm not mistaken Telegram has already been proven insecure once in the past. WhatsApp is a zuck property now, you can consider it insecure.

when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#64

Post by geofft » Thu, Jun 15, 2017, 4:11 PM UTC

robert_foss wrote: post #10

This is pretty alarming stuff. Especially considering how that competitors like Signal are US based. Signal is owned by twitter which by no means is a small player, so it isn't likely to fly under anyones radar.

It's not a stretch to believe that people working on Signal have been offered bribes.

But it's definitely a stretch to believe that they've accepted them, or that it's worked. The protocol and the source code are public and well-reviewed (Telegram has a much less well-reviewed algorithm and does code drops on GitHub); it'd be a challenge to successfully fit a back door in Signal.

The thread that @durov was replying to was portraying being hired away from a public crypto project as a "bribe". Certainly that's a thing you could successfully do, but it also doesn't weaken Signal's encryption as long as there are still people working on it.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#65

Post by mtgx » Thu, Jun 15, 2017, 4:11 PM UTC

otalp wrote: post #5

>"It would be naive to think you can run an independent/secure cryptoapp based in the US." This seems to be a shot at WhatsApp and Signal, implying that they have loopholes that allow the FBI to snoop in. I'm not sure how true that is. This might be an attempt to deflect from the fact that Telegram uses a home-baked encryption protocol which might be insecure, while WhatsApp uses the OWS protocol.

I agree that it's somewhat a deflection, too, and I wish the Telegram team wasn't so stubborn about at least studying the Signal protocol and perhaps making its own version, if it doesn't trust it by default. I don't know if their "math Ph.Ds" would know how to do that, though.

That said, I think it's pretty clear that WhatsApp does have a way to allow the FBI to snoop on users:

https://www.theguardian.com/technology/2017/jan/13/whatsapp-...

I know it's controversial and many don't believe WhatsApp would actually use it like that, but I don't buy it. Either they already use that "feature" as a legal intercept or they're about to do it at least in the UK, where Snoopers' Charter passed and the law is vague enough to force them to do something like that. It may happen in Australia, too, if the new anti-crypto bill passes.

I still trust Signal for now, but I'm not sure whether or not their server-based solution will be so backdoor-proof against future bills, and I think they should be prioritizing decentralizing Signal somehow.

EDIT: Sigh, Germany, too:

http://fortune.com/2017/06/14/germany-fingerprint-children-s...

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#66

Post by geofft » Thu, Jun 15, 2017, 4:17 PM UTC

logicallee wrote: post #26

The problem I have as an end user is that I want the infrastructure protecting me to be invisible. Let's return to this after the following paragraphs. I will make some pretty far-reaching conclusions. I think we can all agree that if some totally below-the-radar crypto anarchist who happens to have a few million dollars from bitcoins figured out that they actually have enough access via the dark web to bribe a few R…

> I think we can all agree that if some totally below-the-radar crypto anarchist who happens to have a few million dollars from bitcoins figured out that they actually have enough access via the dark web to bribe a few Russian generals and long story short detonate a nuclear bomb a few miles outside New York City, just for shits and giggles, then they should be stopped at some point along the way.

I agree with this, and nuclear disarmament seems to be the best way to stop it.

Any approach involving changes to electronic communications seems unlikely to be effective: people have been trying to bribe Russian generals for centuries, well before the internet.

> Let me ask point-blank: are you okay with me being able to spend two weeks on the dark-web researching how to make and detonate a bomb using totally innocent chemical purchases, and then your spouse, parents, relatives, or you, being an innocent victim of my exploding the results, or would you want me to be stopped at some point after I started doing that?

How is this different from you spending one day reading the 1971 Anarchist Cookbook? In almost a half century since it's been released, we don't seem to have had an epidemic of homemade bombs, so I don't seem to have an evidence-based reason to object to people being able to read that book. Is the dark web different?

Also, I live in America. You could just literally go buy a gun at Wal-Mart, and you have the legal, constitutional right to do everything you do up to the second where you point it (intentionally or not) at me or one of my loved ones and fire: you cannot be stopped. Shouldn't I be worried about that instead?

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#67

Post by zAy0LfpBZLC8mAC » Thu, Jun 15, 2017, 4:24 PM UTC

logicallee wrote: post #26

The problem I have as an end user is that I want the infrastructure protecting me to be invisible. Let's return to this after the following paragraphs. I will make some pretty far-reaching conclusions. I think we can all agree that if some totally below-the-radar crypto anarchist who happens to have a few million dollars from bitcoins figured out that they actually have enough access via the dark web to bribe a few R…

> are you okay with me being able to spend two weeks on the dark-web researching how to make and detonate a bomb using totally innocent chemical purchases, and then your spouse, parents, relatives, or you, being an innocent victim of my exploding the results, or would you want me to be stopped at some point after I started doing that?

Yes, of course. Just as I am okay with people being able to spend ten minutes to take a knife from the kitchen and kill me. People are able to do all kinds of bad stuff, doesn't mean they actually do. The only alternative to a world where people are able to do bad stuff is totalitarianism, which is itself bad stuff (if only because I don't get to say what is considered good and what is considered bad), so not actually a solution either.

Also, what you seem to think is just a logical impossibility. Either your communication can be read by third parties or it can not. You cannot build crypto that only leaks nuclear bomb plans, but keeps your medical information uncrackable.

And you might be interested in some of Cory Doctorow's talks (or blog articles or maybe even books) on the general topic of "the war against general-purpose computing", like maybe one of these:

https://www.youtube.com/watch?v=gbYXBJOFgeI

https://www.youtube.com/watch?v=HUEvRyemKSg

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#68

Post by api » Thu, Jun 15, 2017, 4:37 PM UTC

daxorid wrote: post #30

killjoywashere wrote: post #25

Hmmmm.... A Russian peddling undocumented crypto warez implies US crypto is untrustworthy despite the obvious open source code. Don't suppose this would be one of Putin's patriotic citizen artists spreading fake news do you? Edit: thanks to all the replies. I am smarter now.

> A Russian Russophobia seems to be the only acceptable form of Xenophobia these days. And a wildly popular one, at that.

Putinophobia is more accurate, and it's somewhat justifiable albeit probably a bit overblown.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#69

Post by tptacek » Thu, Jun 15, 2017, 4:38 PM UTC

strictnein wrote: post #35

Cryptography experts like Matthew Green were having fun with some of his claims on Twitter a couple of days ago. I would read whatever Durov claims with a large amount of skepticism. ex: https://twitter.com/matthew_d_green/status/87369621172278476...

If there are any professional cryptographic engineers that take this seriously, I'd be interested in hearing from them. From what I can tell, the response to this has been pretty much unanimous.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#70

Post by narrowrail » Thu, Jun 15, 2017, 4:39 PM UTC

Dolores12 wrote: post #63

retox wrote: post #9

Earlier quoted context omitted.

If I'm not mistaken Telegram has already been proven insecure once in the past. WhatsApp is a zuck property now, you can consider it insecure.

when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?

Many prominent and respected HNers have laid out the case for why Telegram has security issues. If you use the search function at the bottom, you will easily find these issues raised. I don't personally possess the knowledge to determine the soundness of Telegram's crypto, but there have been enough red flags raised on HN over the years to merit skepticism.