‘I will show you how safe Telegram is’ • Hacker News Board

Re: ‘I will show you how safe Telegram is’

#51

Post by tough » Thu, Feb 16, 2023, 2:29 PM UTC

xdennis wrote: post #31

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

> My takeaway is that for truly private chat one should write his own software That's the only way to make sure you're using software you trust, but rolling your own crypto implementations is often not so secure (because of the many pitfalls).

Narcs did this and alas the FBI ended up turning the guy who wrote their software to turn on them all.. so hard for a criminal mastermind to also be a good programmer I think

Re: ‘I will show you how safe Telegram is’

#52

Post by pritambaral » Thu, Feb 16, 2023, 2:29 PM UTC

lxgr wrote: post #22

handsclean wrote: post #18

Earlier quoted context omitted.

In Telegram the first is available opt-in, an equivalent to the second is available opt-in (key change = shows up as a different chat), and the third is equally true.

We know from experience that most users never change defaults. For that reason alone, Telegram‘s "secure chat" is anything but.

> For that reason alone, Telegram‘s "secure chat" is anything but.

I didn't think that particular Telegram feature was affected in any way by any option, only that they needed to be started explicitly but were always secure no matter what.

So I immediately went looking through my settings and found an option that leaks tracking info by default, even in Secure Chats.

Signal, by default, routes all calls through their server. The option of using P2P connections for better latency and call quality is opt-in.

Telegram? See [1]. I found no evidence that Secure Chat calls are any different from regular calls.

1: https://www.bleepingcomputer.com/news/security/telegram-leak...

Re: ‘I will show you how safe Telegram is’

#53

Post by kragen » Thu, Feb 16, 2023, 2:29 PM UTC

layer8 wrote: post #44

acc_297 wrote: post #35

Earlier quoted context omitted.

If you and your group chat friends can meet up in person once to input an agreed upon a ~1Gb one-time-pad then you can exchange uncrackable text messages for years on any insecure channel I’ve long felt that this is the ideal solution for anything super super secret

Everyone in that group also has to manage to keep that 1 GB secret.

also how do you ensure the messages haven't been corrupted in transit

Re: ‘I will show you how safe Telegram is’

#54

Post by tapoxi » Thu, Feb 16, 2023, 2:29 PM UTC

ShowalkKama wrote: post #26

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

telegram isn't e2e encrypted (unless you use secret chats which nobody does (and those do not support more than 2 participants))

Not only that but they've made suspicious ties with the Kremlin that resulted in it being unblocked in Russia and have a mysterious source of funding after TON collapsed.

Re: ‘I will show you how safe Telegram is’

#55

Post by foul » Thu, Feb 16, 2023, 2:29 PM UTC

b4je7d7wb wrote: post #21

throwaway13337 wrote: post #13

Isn't this a weakness in all SMS based verification? If you can reroute SMS auth codes, it's game over. It's too bad that most 2FA rely on this method (or use it as a fallback). I don't see how it is directly related to telegram, though.

How can you not see how bad security practise of Telegram is not directly related to Telegram? Do not let sms 2fa slide for anyone.

Since some months, it's more a users' bad sec practice: Telegram offers on sale virtual numbers[1] with a crypto dumbery, you can buy a virtual number for 40-something $ and then log in with their wallet. Should be safer than having the SMS code rerouted but I can't say how much safer that way would be.

[1]: https://fragment.com/numbers?sort=price_asc&filter=sale

Re: ‘I will show you how safe Telegram is’

#56

Post by chinathrow » Thu, Feb 16, 2023, 2:30 PM UTC

lxgr wrote: post #20

throwaway13337 wrote: post #13

Isn't this a weakness in all SMS based verification? If you can reroute SMS auth codes, it's game over. It's too bad that most 2FA rely on this method (or use it as a fallback). I don't see how it is directly related to telegram, though.

The only thing worse than SMS-2FA is SMS-1FA, which I believe is Telegram‘s default.

Well, what is WhatsApps default then?

Re: ‘I will show you how safe Telegram is’

#57

Post by baynoob » Thu, Feb 16, 2023, 2:30 PM UTC

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

I don't think anyone can whatsapp chat. Somehow, whats app is the most reliable end-to-end encrypted messaging service today and many just don't know.

Re: ‘I will show you how safe Telegram is’

#58

Post by entropyneur » Thu, Feb 16, 2023, 2:30 PM UTC

chinathrow wrote: post #49

entropyneur wrote: post #43

Earlier quoted context omitted.

Actually really hacked. What you said also happens of course, but hacks are routine as well. Happened to 2 people I know personally. They do it by intercepting the sms code at the cell operator level.

I do not use Telegram: what SMS code?

The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to do it. Worse there are 2 things called "password" there: the "cloud password" which is the 2FA password and the "password code" (that's what it's called in Russian, maybe the English interface uses a better name) which is merely a pin code for locking the Telegram app on your device. So some less tech-savvy people after hearing they need to set up a password set the latter and falsely assume they are now safe.

Re: ‘I will show you how safe Telegram is’

#59

Post by benhurmarcel » Thu, Feb 16, 2023, 2:31 PM UTC

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

> Signal might be safe, but I think it's a honeypot.

Telegram smells a lot more like a honeypot than Signal

Re: ‘I will show you how safe Telegram is’

#60

Post by acc_297 » Thu, Feb 16, 2023, 2:31 PM UTC

layer8 wrote: post #44

acc_297 wrote: post #35

Earlier quoted context omitted.

If you and your group chat friends can meet up in person once to input an agreed upon a ~1Gb one-time-pad then you can exchange uncrackable text messages for years on any insecure channel I’ve long felt that this is the ideal solution for anything super super secret

Everyone in that group also has to manage to keep that 1 GB secret.

I mean if a Roman general could…