Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

81–90 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#81

Post by qskousen »

tamimio wrote: post #68
sharpshadow wrote: post #15

Only the secret chat is e2e encrypted. All the other chat options are not. I think calls are also not encrypted since they appear in the normal chat history not in the e2e chat. Obviously if your phone is compromised your e2ee chat is not safe.

> Obviously if your phone is compromised your e2ee chat is not safe. Pretty much, a lot of people think that seeing E2EE means everything is safe, which I believe gives a false sense of security. You can have your phone compromised (especially when I know your phone number, Signal I’m looking at you) or be subject to other means of attacks, exposing everything. I would rather know that this app is not secure so I don…

Stealing someone's phone number wouldn't give you any Signal data, as all the messages have perfect forward secrecy, though, right? And all contacts would see an alert that your security number had changed. Not completely foolproof, and I would like Signal to use something other than phone numbers for accounts, but it's pretty good.

Re: Is Telegram really an encrypted messaging app?

#83

Post by innagadadavida »

I am amazed at the low quality comments here. Encryption really doesn’t matter as much as the trust of the app here. Any malicious app author can 100% secure encrypt everything in wire and yet leak 100% of your data to some state actor. Anything you type into the chat box is only encrypted by the app after you type and probably storing it in the clear in some local SQLite db. It gives them a whole bunch of options to mess with that plain text data. Even if the app source code is published as you don’t know if they backdoored it before they submitted to App Store.

Re: Is Telegram really an encrypted messaging app?

#84

Post by lukeschlather »

EGreg wrote: post #47
StrLght wrote: post #25

Earlier quoted context omitted.

Problem with this claim is that it's hardly verifiable. Telegram's backend is closed source, and the only thing you can be sure of is that their backend sees every message in plaintext.

[flagged]

Crypto is really hard. You have to trust that whoever implemented the crypto is smart and diligent, and you have to trust that whoever operates the crypto is smart and diligent, and you have to trust both of those parties.

Centralization means that it's very easy to trust that whoever implements and operates the crypto is smart. Do I trust them? I don't know. I trust myself, but I don't think I am independently capable of operating or implementing crypto - if I want to make assertions like "this is end-to-end-encrypted" and ensure those assertions remain true, I will need a several million dollar a year budget, at a minimum. "Decentralized" means you've got tons of endpoints that need securing, and they can share crypto implementations, but the operations are duplicated. Which means it's more expensive, and you're trusting more operators, especially if you want resiliency.

Yes, something like Signal or Whatsapp means you've got a single point of failure, but something like Matrix, you've got many points of failure and depending on how it's configured every point of failure can allow a different party to break the confidentiality of the system.

Decentralization is great for resiliency but it actively works against reliable and confidential message delivery.

Re: Is Telegram really an encrypted messaging app?

#85

Post by lxgr »

EGreg wrote: post #47
StrLght wrote: post #25

Earlier quoted context omitted.

Problem with this claim is that it's hardly verifiable. Telegram's backend is closed source, and the only thing you can be sure of is that their backend sees every message in plaintext.

[flagged]

> Many people on HN silently downvote anything that has to do with crypto and decentralization.

I primarily downvote them because I haven't seen anything come out of that space that seems like it's remotely capable of actually achieving decentralization (for which I also see a dire need in today's structure of the Internet and the applications running on it).

95% of the time, these things are built as a Potemkin village of technical decentralization backed up by complete administrative centralization, with the path to actual decentralization "very high on our public roadmap available here, we promise!!!"

Re: Is Telegram really an encrypted messaging app?

#86

Post by TheChaplain »

tazu wrote: post #57

Am I the only one who uses Telegram mainly for p2p e2ee audio calls? It's great for that.

I use it for friends, family and partner, videocalls and normal chat.

Sure, it may not be on the same level as Signal when it comes to security but it simply is leagues above others in terms of usability, stability and bells&whistles. It's like comparing a Ford Zephyr with a Volvo EX30.

Re: Is Telegram really an encrypted messaging app?

#87

Post by yarg »

lxgr wrote: post #54
331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

Yes: End-to-end encryption is technically quite difficult, but politically and legally feasible (at least currently, at least in most countries). Simply not cooperating with law enforcement is technically moderately difficult, but politically and legally impossible. Between a difficult and an impossible option, the rational decision is to pick the difficult one.

Is there a nice solution for multiparty (n >= 3) end-to-end encryption?

Re: Is Telegram really an encrypted messaging app?

#88

Post by rvnx »

Avamander wrote: post #28
AnotherGoodName wrote: post #6

If telegrams encryption is so bad why is Pavel Durov under arrest? The arrest cites that he was not cooperating with authorities to crack down on various drug illegal activities on telegram. None of the other social networks have their ceos arrested. Is it simply that telegram is the only one without backdoors for five eyes? It seems to me the secret chat feature actually works too well?

> Is it simply that telegram is the only one without backdoors for five eyes? Do you honestly think that any backdoor would be used for such mundane crimes? Even more so, it being in any way acknowledged that there might be a backdoor? On that topic, it's highly likely Telegram is cooperating with Russian LE. Services and people that don't get thrown out quickly in Russia. > The arrest cites that he was not cooperati…

https://www.zdnet.com/article/russia-unbans-telegram/

and even eventually ended to become a major propaganda tool for the Russian army.

Re: Is Telegram really an encrypted messaging app?

#90

Post by rvnx »

kome wrote: post #59
StrLght wrote: post #16

Earlier quoted context omitted.

I'd suggest waiting for more details from French officials, they have already said that they'll address it tomorrow. So far claims from the media sound like Durov's being prosecuted due to very little moderation on the platform, not because of E2EE. Even so, most messages sent on Telegram are plaintext, they're encrypted only in transport layer, but Telegram's servers see them in full. Secret chats (the only E2EE cha…

> Even so, most messages sent on Telegram are plaintext, they're encrypted only in transport layer, but Telegram's servers see them in full. you contradict yourself in the same sentence

He means that the messages are only encrypted during transport, like with HTTPS.

Your browser sends a clear message over an encrypted pipe, and the server on the other side, sees this clear message.

Post reply on HN