Is Telegram really an encrypted messaging app? • Hacker News Board

Re: Is Telegram really an encrypted messaging app?

#221

Post by qwertox » Sun, Aug 25, 2024, 9:46 PM UTC

sroerick wrote: post #209

wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE

Why? I think Google suggests that you send the payload encrypted through the notification. Google then only knows which app to send the message to, they don't know from whom the message originates (only "a Telegram server") nor what the content is.

Also, you could just send a notification instructing the app to fetch a new message from your server.

From the docs:

Encryption for data messages

The Android Transport Layer (see FCM architecture) uses point-to-point encryption. Depending on your needs, you may decide to add end-to-end encryption to data messages. FCM does not provide an end-to-end solution. However, there are external solutions available such as Capillary or DTLS.

https://firebase.google.com/docs/cloud-messaging/concept-opt...

Re: Is Telegram really an encrypted messaging app?

#222

Post by mubu » Sun, Aug 25, 2024, 9:46 PM UTC

alephnerd wrote: post #208

wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

> Does Telegram let them see it: I don't think so. That seems to be the core issue style Durov being arrested The UAE requires decryption keys as part of their Telco regulations. If Telegram can operate in the UAE without VPN (and it can), then at the very least the UAE MoI has access. They (and their shadow firms like G42 and G42's shadow firms) were always a major buyer for offensive capabilities at GITEX. On that…

Sorry, but as someone who's completely out of the loop with these things. What's DEFCON/Blackhat or GITEX about and why shouldn't you bring your personal phone?

I'm genuinely interested.

Re: Is Telegram really an encrypted messaging app?

#223

Post by maqp » Sun, Aug 25, 2024, 9:48 PM UTC

thisisabore wrote: post #186

maqp wrote: post #176

Earlier quoted context omitted.

This is such a misrepresentation. Telegram could at-will feed the cloud-2FA password to password hashing function like Argon2 to derive a client-side encryption key. Everything could be backed up to the cloud in encrypted state only you can access. Do they do that? No. So it's not as much as trade-off, as it is half-assed security design.

I'll have you know they had maths PhDs design their security, sir. Eight of them! Yeah, it's a bit of a joke.

Yeah, put a geometrician* to do the job of a cryptographer. This is what you get.

* I'm being serious, Nikolai Durov's PhD dissertation title was "New Approach to Arakelov Geometry"

https://bonndoc.ulb.uni-bonn.de/xmlui/handle/20.500.11811/31...

https://arxiv.org/pdf/0704.2030

Re: Is Telegram really an encrypted messaging app?

#224

Post by A4ET8a8uTh0 » Sun, Aug 25, 2024, 9:48 PM UTC

dijit wrote: post #196

maqp wrote: post #181

Earlier quoted context omitted.

>it's just claiming that you can trust them more than you can trust the major messaging apps. All the cool kids in the block eliminated the need to trust the provider decades ago. PGP: 33 years ago, OTR 20 years ago, Signal 14 years ago.

You have to trust the provider with signal; they are fiercely anti-third party clients, control the network and have released version of the code that are not tracked by sources- in extreme cases we’re aware of years old code being in there (mobile coin for example). Signal evangelicalism needs to halt, you mean the Whisper protocol.

I don't completely agree. I am perfectly fine with there being multiple options for various use cases. Signal has its place. So does Telegram for that matter. Even Whatsapp..

That said, what I would love to see ( and likely won't at this point ) is the world where pidgin could exist again, because everyone is using some form of sensible standards that could be used.. right now it is mostly proprietary secret mess of things.

And don't get me started on convincing anyone in group to moving from one ecosystem to another. Fuck, I just want email for chat that is not owned by one org.. Is it really so much to ask ( it is rhetorical, I know the hurdles are there and only some deal with human nature )?

Re: Is Telegram really an encrypted messaging app?

#225

Post by jltsiren » Sun, Aug 25, 2024, 9:49 PM UTC

mr_mitm wrote: post #131

lxgr wrote: post #94

Earlier quoted context omitted.

It indirectly has a lot to do with encryption, in that if Telegram was actually encrypted, they'd probably have no grounds on holding him in the first place. (At least at the moment, in most countries) it's not illegal to not ship a backdoor in your end-to-end-encrypted software upon government request, but in most it is illegal to not share data you're holding in a form accessible to you when you receive a warrant f…

Anyone can join these channels. How would encryption change anything?

If anyone can access the data, it's not encrypted in any meaningful sense.

If you have access to some data, the government can require you to share it with them. But if you can't access the data due to encryption, the government can't force you to create a backdoor to access it. At least not outside truly extraordinary situations.

Re: Is Telegram really an encrypted messaging app?

#226

Post by ahmedbaracat » Sun, Aug 25, 2024, 9:51 PM UTC

ziofill wrote: post #65

> One of the biggest privacy problems in messaging is the availability of loads of meta-data — essentially data about who uses the service, who they talk to, and when they do that talking. […] the same problem exists with virtually every other social media network and private messenger. Is this true for Signal too? I thought it wasn’t.

I would recommend reading these resources:

The Internet Is Broken: https://secushare.org/broken-internet

The Hitchhiker’s Guide to Online Anonymity: https://anonymousplanet.org/guide.html

Pointers to more resources: https://discuss.grapheneos.org/d/15005-books-or-sources-on-p...

Re: Is Telegram really an encrypted messaging app?

#227

Post by maqp » Sun, Aug 25, 2024, 9:52 PM UTC

331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

>To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions.

This is utter bullshit I debunked back in 2021.

https://security.stackexchange.com/questions/238562/how-does...

Re: Is Telegram really an encrypted messaging app?

#228

Post by jijji » Sun, Aug 25, 2024, 9:54 PM UTC

mubu wrote: post #222

alephnerd wrote: post #208

Earlier quoted context omitted.

> Does Telegram let them see it: I don't think so. That seems to be the core issue style Durov being arrested The UAE requires decryption keys as part of their Telco regulations. If Telegram can operate in the UAE without VPN (and it can), then at the very least the UAE MoI has access. They (and their shadow firms like G42 and G42's shadow firms) were always a major buyer for offensive capabilities at GITEX. On that…

Sorry, but as someone who's completely out of the loop with these things. What's DEFCON/Blackhat or GITEX about and why shouldn't you bring your personal phone? I'm genuinely interested.

defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked

Re: Is Telegram really an encrypted messaging app?

#229

Post by tpoacher » Sun, Aug 25, 2024, 9:55 PM UTC

icepat wrote: post #141

tamimio wrote: post #9

It’s not encrypted by default, and even if it were encrypted, you should never trust any connected device with anything important. That being said, Telegram is hands down the best communication platform right now. It is feature-rich, with features implemented years ago that are only now being added to other platforms. It has normal chatting/video calls, groups, channels, and unlimited storage in theory, all for free.…

What's in Telegram that you don't see in Signal? Honest question, I only use Signal rather than Telegram.

This is one of those questions where it's hard to answer but it's obvious once you use it.

What's the difference between a fiat and a ferrari? What's the difference between CentOS and Linux Mint? What's the difference between a macdonalds and a michelin burger?

I have friends and groups on both platforms. On Signal, I'm basically just sending messages (and only unimportant one, like, when are we meeting. Sending media mostly sucks so I generally only have very dry chats on Signal).

Whereas on Telegram, I'm having fun. In fact it's so versatile, that my wife and I use it as a collaborative note-taking system, archiver, cvs, live shopping list, news app (currently browsing hackernews from telegram), etc. We basically have our whole life organised via Telegram. I lose count of all the features I use effortlessly on a daily basis, and only realise it when I find myself on another app. This is despite the fact that both Signal and whatsapp have since tried to copy some of these features, because they do so badly. A simple example that comes to mind: editing messages. It took years for whatsapp to be able to edit a message (I still remember the old asterisk etiquette to indicate you were issuing a correction to a previous message). Now you can, but it's horrible ux; I think you long press and then there's a button next to copy which opens a menu where you find a pencil which means edit, or sth like that. In telegram I don't even remember how you do it, because it's so intuitive that I don't have to.

Perhaps that's why I find the whole "Telegram encryption" discussion baffling to be honest. For me, it's just one of Telegram's many extra features you can use. You don't have to use it, but it's there if you want to. I don't feel like Telegram has ever tried to mislead its users that it's raison d'etre is for it to be a secret platform only useful if you're a terrorist (like the UK government seems to want to portray it recently).

I get the point about "encryption by default", but this doesn't come for free, there are usability sacrifices that come with it, and not everyone cares for it. Insisting that not having encryption by default marrs the whole app sounds similar to me saying not having a particular set of emojis set as the default marrs the whole app. It feels disingenuous somehow.

Re: Is Telegram really an encrypted messaging app?

#230

Post by EGreg » Sun, Aug 25, 2024, 9:57 PM UTC

kasey_junk wrote: post #204

EGreg wrote: post #117

Earlier quoted context omitted.

The reproducible build of Telegram lets you evaluate the code doing end-to-end encryption. Once you satisfy yourself it's doing this kind of encryption without implementation-level backdoors, then you don't need to worry about servers reading it (except for #5 above). I didn't claim it encrypted "group chats". I said "things". If you want me to be specific, the "things" are individual 1-1 end-to-end encrypted chats.

Reproducible builds are not required to evaluate the encryption algorithm used in Telegram. Software auditors use deployed binaries as a matter of course. They’d do so even if reproducible builds are on offer because the code and the binary aren’t promised to be the same even with reproducible builds and validating that they are can be more problematic than the normal case of auditing binaries.

Can you show me any audits of Telegram binaries or similar software?