Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram founder: US intelligence tried to bribe us to weaken encryption

news.fastcompany.com

Post reply on HN
Print view View original

71–80 of 220 posts

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#71

Post by _nx010_ »

killjoywashere wrote: post #25

Hmmmm.... A Russian peddling undocumented crypto warez implies US crypto is untrustworthy despite the obvious open source code. Don't suppose this would be one of Putin's patriotic citizen artists spreading fake news do you? Edit: thanks to all the replies. I am smarter now.

Durov is the founder and ex-CEO of Russia's (and Europe's) largest social network site, Vkontakte. He is one of the few tech billionaires from Russia.

A few years ago, Kremlin tried getting their hands on Vkontakte (to be able to more easily monitor/censor), but Durov kept rebuffing them. Eventually, they intimidated him into selling his majority stake to one of their pet oligarchs. As you can imagine, Durov is pretty bitter about his company being taken away from him (and generally bitter about security services trying to mess with people's rights). After cashing out, he's moved to the EU and become a consistent critic of the Russian government.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#72

Post by permanentdecaf »

otalp wrote: post #5

>"It would be naive to think you can run an independent/secure cryptoapp based in the US." This seems to be a shot at WhatsApp and Signal, implying that they have loopholes that allow the FBI to snoop in. I'm not sure how true that is. This might be an attempt to deflect from the fact that Telegram uses a home-baked encryption protocol which might be insecure, while WhatsApp uses the OWS protocol.

Pavel Durov wants everyone to think security is about trust in people. Most companies in that business do the same, because it's easier than building something that doesn't require trust in people. The way Pavel Durov and others like him present "trust" is (ironically) shady corporate structures[1], shell companies, or use of the word "Switzerland."

They want people to think like that because they've built businesses that require it. Telegram stores the messages you send/receive unencrypted on their servers. That's not good, unless you've been trained to think that "privacy" is just about choosing the company, government, or legal jurisdiction that gets total access to your data.

Security professionals know that's not how we should think about security (never trust people!), because Durov is leaving a lot out: there aren't safe jurisdictions, servers get hacked, and centralized databases will get compromised. Logic, though, is probably no match for conspiracy theories.

1: https://www.washingtonpost.com/news/the-intersect/wp/2015/11...

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#73

Post by notheguyouthink »

Dolores12 wrote: post #63
retox wrote: post #9

Earlier quoted context omitted.

If I'm not mistaken Telegram has already been proven insecure once in the past. WhatsApp is a zuck property now, you can consider it insecure.

when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?

I think he's spreading a lie.. based on what I've seen, at least.

It's a not yet proven secure protocol, is the worst you can say against it I believe. I'm not a security guy mind you, I'm just parroting what I keep seeing. Rightfully so, lack of deep audit is a very valid reason to worry. Yet, worry and untrusted is vastly different than actively exploitable / broken.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#76

Post by Dolores12 »

narrowrail wrote: post #70
Dolores12 wrote: post #63

Earlier quoted context omitted.

when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?

Many prominent and respected HNers have laid out the case for why Telegram has security issues. If you use the search function at the bottom, you will easily find these issues raised. I don't personally possess the knowledge to determine the soundness of Telegram's crypto, but there have been enough red flags raised on HN over the years to merit skepticism.

Is that how you prove something - by reading comments on HN? Oh, how about all these red flags are raised to scare people to not let them use Telegram which is really secure?

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#77

Post by bascule »

Dolores12 wrote: post #63
retox wrote: post #9

Earlier quoted context omitted.

If I'm not mistaken Telegram has already been proven insecure once in the past. WhatsApp is a zuck property now, you can consider it insecure.

when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?

Their homebrew crypto seems very shaky:

https://cs.au.dk/~jakjak/master-thesis.pdf

https://eprint.iacr.org/2015/1177.pdf

tl;dr: they tried to use SHA-1 as a MAC. This is something of a crypto 101 mistake. Had they even used HMAC they'd be in much better shape. Worse, even after this was pointed out to them and people started writing papers about potential attacks, they have stood by their shaky design, refusing to update it or even admit mistakes were made in the initial design.

But even worse than that, end-to-end encryption is off-by-default, and users must opt into it. Why?

https://telegram.org/faq#q-why-not-just-make-all-chats-secre...

"This allows Telegram to be widely adopted in broad circles, not just by activists and dissidents, so that the simple fact of using Telegram does not mark users as targets for heightened surveillance in certain countries. We are convinced that the separation of conversations into Cloud and Secret chats represents the most secure solution currently possible for a massively popular messaging application."

Putting aside the fact that if Telegram's cryptography were properly implemented, an outside observer shouldn't be able to tell whether or not end-to-end encryption is being used or not (i.e. Telegram does not provide proper separation of data-at-rest versus data-in-motion), this seems to be the "I don't need encryption because I have nothing to hide" argument, but perpetrated by what's allegedly supposed to be a secure messenger.

The real reason why Telegram doesn't enable end-to-end encryption is pretty clear: they don't have the features to provide a good end-to-end encryption experience: They don't support end-to-end encrypted group chats. They don't have encrypted backups like Signal and WhatsApp.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#79

Post by RodericDay »

narrowrail wrote: post #70
Dolores12 wrote: post #63

Earlier quoted context omitted.

when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?

Many prominent and respected HNers have laid out the case for why Telegram has security issues. If you use the search function at the bottom, you will easily find these issues raised. I don't personally possess the knowledge to determine the soundness of Telegram's crypto, but there have been enough red flags raised on HN over the years to merit skepticism.

tbh, people like tptacek and his buddies have a clear agenda and attitude of their own. I'm definitely not sated by their pronouncements alone.

Re: Telegram founder: US intelligence tried to bribe us to weaken encryption

#80

Post by groby_b »

dmix wrote: post #56
groby_b wrote: post #29

Earlier quoted context omitted.

Would you mind clarifying what your quotes and the linked wall of text have to do with the story?

Seems to be a similar story by a security guy who wrote crypto code for OpenBSD. The larger quote: > about the same time at the bazaar show in nyc i was contacted by a representative of us-ins and a ukrainian millitary attache at un. both investigating my involvement with openbsd. a few months later i was offered an interview for a position at the fbi office for cyber-warfare in nyc who as well offered to fix my immi…

Ah, thank you.
Post reply on HN