61–70 of 70 posts
So, I'm guessing Telegram is going to circumvent it in the next release. It's too popular in Russia to simply leave it at that. Signal showed how to do it.
They'd need to move their servers to google cloud platform. And then they'd still be blockable if Russia decides to block Google entirely.
Earlier quoted context omitted.
If someone had an exploit like that, there's money to be had by exploiting it in secret and/or selling it to people who do that. Why would they post it online for you for free?
Because they are a researcher that wants to show that rolling your own crypto is bad. In other words back up the orthodox opinion with a PROOF and not just groupthink.
Can I ask how can a service be blocked in a country? Is it because it has centralized servers? What if it was open source and could be hosted on any website? Then they would have to detect signatures of the protocol and block that, right? At what level, the national level? But the server would be local. So what does it mean when they say they block Tor for instance? How can you block something that is run on many dom…
1. Telegram IS centralized. 2. They collect all IPs and domains and ban them on provider level. There is a law which forces internet providers to sync the list of banned resources and prohibit access to them. Basically they ban hundreds of thousands resources already. Adding few thousands of nodes may take some time, but: 1. It is possible to do for sure within months 2. When you ban 20-30% of decentralized system it…
Earlier quoted context omitted.
Ironically this website does not open from Russia (had to use a VPN to access it). Same agency's shills in Russian Duma (parliament) are planning another law banning VPN and Anonymizer services. Censorship is coming down hard, it seems...
Also: https://www.rt.com/politics/389683-russian-public-supports-m... Over 40 percent of Russians support the verification of internet users on social networks or other internet platforms, as proposed in a bill drafted by a well-known pro-Orthodox lawmaker. I wonder if it's real or just propaganda? FWIW, In May, Russian President Vladimir Putin signed the strategy for the development of the Russian information commun…
Man, this is starting to look like Sugar Kremlin by Vladimir Sorokin.
For the amount of haters telegram had when they launched for their purported security failures, it's funny that people are looking to block it instead of silently explore its flaws
> purported security failures > people are looking to block it instead of silently explore its flaws This is not a good heuristic for determining if security failures are "purported." In point of fact, Telegram is widely lampooned by every self-respecting professional cryptographer who has written about it. There's nothing "purported" about Telegram's security failures - they are empirically demonstrable, and have be…
Telegram has some well known theoretical security flaws - its been well documented as such.
But from a practical point its more secure than most of what it replaced - SMS and Facebook Messenger. I use telegram as a cross platform iMessage - if iMessage was cross platform there wouldnt be much room for for telegram - if WhatsApp had a desktop client, same deal - if Signal was more user friendly (it also launched without a desktop client) - same deal.
In short, Telegram is good enough for the purposes that people are using it for - once MProto has been breached - then I'll be concerned - but right not all the attacks are theoretical, and not practical.
Earlier quoted context omitted.
They'd need to move their servers to google cloud platform. And then they'd still be blockable if Russia decides to block Google entirely.
Google is officially whitelisted in Russia since the incident with accidental ban.
If that happens, Russia would have no way of blocking the app other than DNS blocking which can be simply mitigated against as well.
Earlier quoted context omitted.
No problem, they'll just ban all the other messengers. Line and KakaoTalk are already banned. There's nothing a dictatorship hates more than communications that cannot be eavesdropped on.
The perpetrators of the recent terrorist attack in Saint Petersburg Metro were using Telegram.
Earlier quoted context omitted.
> purported security failures > people are looking to block it instead of silently explore its flaws This is not a good heuristic for determining if security failures are "purported." In point of fact, Telegram is widely lampooned by every self-respecting professional cryptographer who has written about it. There's nothing "purported" about Telegram's security failures - they are empirically demonstrable, and have be…
Ok, valid argument: telegram servers DO receive and store plaintext version of every conversation done (except private chats), while, as a reference, whatsapp don't do this, applying end-to-end encryption by default. So, basically, hack telegram servers -> you have all the convos. Bribe some employers, locate and grab their servers -> see above. Also, how would you know they're not connected with some 3-letter agency…
- Using some kind of crypto with multiple keys
- These keys are located in multiple independent datacenters in independent jurisdictions
According to what I read this was supposed prevent leaking of user data just by bribing/coercing/etc or suing any Telegram employee or datacenter provider.
As I've mentioned before I don't use Telegram for security, I use it because
1. Facebook failed its Whatsapp acquisition so badly
2. It is way more user friendly
Also keep in mind that when I left WhatsApp for Telegram WhatsApp still didn't have e2e.
Earlier quoted context omitted.
GSM is not secure and OTP via SMS is not secure - this is a vulnerability of many many systems, including banks and Bitcoin vendors. This has nothing to with Telegram's crypto.
If Telegram claims to be secure but relies on unsecure technologies that makes it easy to circumvent its security isn't that still Telegram's fault? Just because others are also vulnerable to the same failings doesn't absolve Telegram of responsibility. Don't claim to be a secure platform if your security is easily circumvented.
Also by default Telegram sends confirmation messages to previously verified clients instead of by sms.
For the amount of haters telegram had when they launched for their purported security failures, it's funny that people are looking to block it instead of silently explore its flaws
> purported security failures > people are looking to block it instead of silently explore its flaws This is not a good heuristic for determining if security failures are "purported." In point of fact, Telegram is widely lampooned by every self-respecting professional cryptographer who has written about it. There's nothing "purported" about Telegram's security failures - they are empirically demonstrable, and have be…
There's not a single actual practical vulnerability in the second paper. http://telegra.ph/mtproto-security-01-17
And the first one is outdated.