Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

181–190 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#181

Post by maqp »

lolinder wrote: post #157
alerighi wrote: post #118

Earlier quoted context omitted.

Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud. This of course has security implications, but also allows you to have a big number of chats without wasting your device memory like WhatsApp does, or having to delete old conversations, and allows you to access your chats from any device. By the way you can also set a password to log in from another…

> It's the only messaging app where messages are stored on the cloud. Besides Slack and Discord and Teams and whatever the heck Google has these days and iMessage and... I think you mean it's the only messaging app that purports to have a focus on security where messages are stored in the cloud, which is true, but also sus. There's a reason why none of the others are doing it that way, and Telegram isn't really claim…

>it's just claiming that you can trust them more than you can trust the major messaging apps.

All the cool kids in the block eliminated the need to trust the provider decades ago. PGP: 33 years ago, OTR 20 years ago, Signal 14 years ago.

Re: Is Telegram really an encrypted messaging app?

#182

Post by macintux »

codetrotter wrote: post #180
walterbell wrote: post #168

Earlier quoted context omitted.

iCLoud can be disabled by MDM profile installed by Apple Configurator at setup.

Can I enroll my personal iPhone in MDM myself? And if I can have MDM with just my personal phone, do I need to buy some kind of subscription for it from Apple? Or pay some third-party? I thought MDM was only for enterprise businesses and schools and universities, but I may very well be mistaken about that.

Apple supplies a free application for managing MDM.

https://support.apple.com/guide/apple-configurator-mac/welco...

Re: Is Telegram really an encrypted messaging app?

#183

Post by thisisabore »

bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

That's it. The article could be just that. You log back in and all your messages are there without you having to provide a secret or allow access to some specific backup? Your data just lives on the server. The only thing preventing anyone from accessing it is the goodwill of the people running the server.

Re: Is Telegram really an encrypted messaging app?

#184

Post by fredgrott »

Simple question denotes whether its encrypted.....

Does cloud server store the message and key.....

If answer is yes, ITS NOT FULLY ENCRYPTED!

Sounds contrary right?

If key and message is on server any LEO org can get it....for it to be fully encrypted cloud server should never store the keys....

So how many services claiming encryption have this flaw? All....

Why do you think Telegram has shell companies to avoid gov subpeonas?

Because it knows that its encryption is faulty to real world LEO and laws as it stores the keys on the cloud which means its can be subpoenaed for those keys and messages.

Re: Is Telegram really an encrypted messaging app?

#185

Post by ThePowerOfFuet »

fsflover wrote: post #21
331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

> Telegram can be forced to give up data That's all you need to know. Matrix and Signal can't be forced in any way.

The admins of Matrix instances sure can be forced to give up data. The metadata is not encrypted, and many rooms are not either.

Re: Is Telegram really an encrypted messaging app?

#186

Post by thisisabore »

maqp wrote: post #176
alerighi wrote: post #118

Earlier quoted context omitted.

Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud. This of course has security implications, but also allows you to have a big number of chats without wasting your device memory like WhatsApp does, or having to delete old conversations, and allows you to access your chats from any device. By the way you can also set a password to log in from another…

This is such a misrepresentation. Telegram could at-will feed the cloud-2FA password to password hashing function like Argon2 to derive a client-side encryption key. Everything could be backed up to the cloud in encrypted state only you can access. Do they do that? No. So it's not as much as trade-off, as it is half-assed security design.

I'll have you know they had maths PhDs design their security, sir. Eight of them!

Yeah, it's a bit of a joke.

Re: Is Telegram really an encrypted messaging app?

#187

Post by maqp »

tptacek wrote: post #129
baxtr wrote: post #116

Earlier quoted context omitted.

Would love to see a side-by-side comparison of iMessage, Signal, WhatsApp and Telegram on this.

You already know how Signal is going to come out here, because this is something people complain incessantly about (the inconvenience of not getting transcripts when enrolling new devices).

It's a bit unfortunate there isn't a mechanism to establish a key between your desktop and smart phone client that would allow message history to be synced over an E2EE connection. It's doable, but perhaps it's an intentional safety feature one can't export the messages too easily.

Re: Is Telegram really an encrypted messaging app?

#188

Post by walterbell »

codetrotter wrote: post #180
walterbell wrote: post #168

Earlier quoted context omitted.

iCLoud can be disabled by MDM profile installed by Apple Configurator at setup.

Can I enroll my personal iPhone in MDM myself? And if I can have MDM with just my personal phone, do I need to buy some kind of subscription for it from Apple? Or pay some third-party? I thought MDM was only for enterprise businesses and schools and universities, but I may very well be mistaken about that.

MDM profiles are just XML files. They can be created with any text editor and distributed to the phone by email or web server. Apple provides the free "Apple Configurator" app in the MacOS app store. There are also websites and/or OSS tools to generate profiles, e.g. https://github.com/ProfileCreator/ProfileCreator.

Re: Is Telegram really an encrypted messaging app?

#190

Post by 0x_rs »

alerighi wrote: post #123
tamimio wrote: post #68

Earlier quoted context omitted.

> Obviously if your phone is compromised your e2ee chat is not safe. Pretty much, a lot of people think that seeing E2EE means everything is safe, which I believe gives a false sense of security. You can have your phone compromised (especially when I know your phone number, Signal I’m looking at you) or be subject to other means of attacks, exposing everything. I would rather know that this app is not secure so I don…

Not only that. If they want to intercept e2e chats it's possible with a MITM attack, that if you control the server it's not a difficult thing to do. Of course the users if they check the keys they see they are different, but practically no one does that. And I think WhatsApp probably does it, otherwise why the authorities never complied that WhatsApp did not let them see the conversations?

WhatsApp has defaulted to aggressively storing allegedly "E2EE" conversations without any form of encryption in Google Drive (freely) for years. And it would seem they are also currently in possession of the keys to decrypt them when you restore such backups from another device without the key stored on it (that lately cannot be extracted without exploits or root access anyway). Facebook/Meta has often expressed their love for the practice of client-side scanning or parallelly sending data to their servers, but it doesn't seem the case for WhatsApp yet, so what measures they take to remain compliant with the ever-increasing surveillance practices remains to speculation. For a somewhat educated user that knows to opt-out of online backups every time it's prompted by the application, I'd say it's probably safer than normal Telegram chats, but very far from flawless.
Post reply on HN