‘I will show you how safe Telegram is’

Post by acc_297 » Thu, Feb 16, 2023, 3:19 PM UTC

kragen wrote: post #66

layer8 wrote: post #62

Earlier quoted context omitted.

You can never ensure that your communication channel isn’t corrupted. But with a one time pad you’ll just receive unreadable garbage then. You‘re also free to sign messages before encryption.

if an adversary xors their guess of part of your message (a crib) and what they want it to say with the one-time-pad ciphertext, they can make it say what they want if the guess is right; this is a general vulnerability with unauthenticated stream ciphers if they guess wrong, there's a little unreadable garbage in the message, but in many scenarios they only have to guess right once so you need some kind of message a…

Post by nicce » Thu, Feb 16, 2023, 3:23 PM UTC

lxgr wrote: post #73

miroljub wrote: post #64

Earlier quoted context omitted.

WhatsApp is closed source. For what it's worth, the protocol itself might be impenetrable, but the client itself has access to your decrypted messages and can still decide to send them back to Facebook without your knowledge. The system that depends on a good will and "trust me bro" is not secure by default, even if Meta/Facebook were the most trustworthy company in the world under the most honest legislation.

Open vs. closed source is a completely moot point in the context of iOS and Android if your threat model includes vendor/supply chain attacks.

Post by lostmsu » Thu, Feb 16, 2023, 3:29 PM UTC

acc_297 wrote: post #35

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

If you and your group chat friends can meet up in person once to input an agreed upon a ~1Gb one-time-pad then you can exchange uncrackable text messages for years on any insecure channel I’ve long felt that this is the ideal solution for anything super super secret

Post by seanw444 » Thu, Feb 16, 2023, 3:36 PM UTC

benhurmarcel wrote: post #59

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

> Signal might be safe, but I think it's a honeypot. Telegram smells a lot more like a honeypot than Signal

Post by jhasse » Thu, Feb 16, 2023, 3:38 PM UTC

ersii wrote: post #28

pretext-1 wrote: post #16

Earlier quoted context omitted.

Yes it is. It’s worse for Telegram though because it gives the attacker access to the chat history too. Telegram does however send a message to all devices when a new device is logging in, so at least you would know. Signal does not do that but your contacts will get a message that your security code changed if they have the option for that enabled, but people generally ignore this message. Both services offer to set…

Signal provides a Registration Lock that is available in the settings for preventing this from happening to some degree, it's however opt-in and you need to set and remember a PIN.