Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

311–320 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#311

Post by empath75 »

wkat4242 wrote: post #164
bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

Will they let _US_ law enforcement see it? No. Will they let Russian? Of course.

Re: Is Telegram really an encrypted messaging app?

#312

Post by innagadadavida »

Aachen wrote: post #289
innagadadavida wrote: post #83

I am amazed at the low quality comments here. Encryption really doesn’t matter as much as the trust of the app here. Any malicious app author can 100% secure encrypt everything in wire and yet leak 100% of your data to some state actor. Anything you type into the chat box is only encrypted by the app after you type and probably storing it in the clear in some local SQLite db. It gives them a whole bunch of options to…

> malicious app author can 100% secure encrypt everything in wire and yet leak 100% of your data Um, surely you understand the difference between piping random-looking bytes uselessly to whoever and having a readable copy of all data readily available to whoever hacks the system or applies for a sysadmin role? Or are you making the assumption that people use a closed-source client and the server can push malicious co…

> You need to trust the community in general to uncover issues

My point is that this community could just be your friendly CIA operatives running the show with a veneer of open source. Also this “community” has no liability unlike the closed platform companies.

Re: Is Telegram really an encrypted messaging app?

#314

Post by kopirgan »

This article discusses a well known point about telegram. But only to techies. Vast majority of users are misled by journalists many of whom have degrees in social "science", political "science" etc. It doesn't say you need encryption that's for each person to decide perhaps for each conversation. It's need to be an educated choice.

Though it's old hat better to recycle this often so many know.

Re: Is Telegram really an encrypted messaging app?

#315

Post by empath75 »

AnotherGoodName wrote: post #6

If telegrams encryption is so bad why is Pavel Durov under arrest? The arrest cites that he was not cooperating with authorities to crack down on various drug illegal activities on telegram. None of the other social networks have their ceos arrested. Is it simply that telegram is the only one without backdoors for five eyes? It seems to me the secret chat feature actually works too well?

Do you think he doesn't cooperate with Russian authorities?

Re: Is Telegram really an encrypted messaging app?

#316

Post by mjevans »

bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

Offhand, this sounds like a terribly insecure workflow but...

Client creates a Public Private key pair used for E2EE.

Client uses the 'account password (raw)' as part of the creation of a symmetric encryption key, and uses that to encrypt and store the SECRET key on the service's cloud.

NewClient signs in, downloads the encrypted SECRETKeyBlob and decodes using the reconstructed symmetric key based on the sign in password. Old messages can then be decoded.

-- The part that's insecure. -- If the password ever changes the SAME SECRET then needs to be stored to the cloud again, encrypted by the new key. Some padding with random data might help with this but this still sounds like a huge security loophole.

-- Worse Insecurity -- A customer's device could be shipped a compromised client which uploads the SECRET keys to requesting third parties upon sign-in. Those third parties could be large corporations or governments.

I do not see how anyone expects to use a mobile device for any serious security domain. At best average consumers can have a reasonable hope that it's safe from crooks who care about the average citizen.

Re: Is Telegram really an encrypted messaging app?

#317

Post by therein »

maqp wrote: post #306
skeledrew wrote: post #298

Earlier quoted context omitted.

Telegram currently has very intuitive and snappy search, even in very active groups with years of content. That's because the heavy lifting is done by the server. Think that'd still be possible if there was no way for the server to process the data?

Yeah, try searching anything older than a year, the amazing snappy search grinds to halt. Meanwhile I'm storing years worth of stuff on Signal with no issues, and it searches ridiculously fast offline with no seconds long pause for buffering.

Yeah Telegram search is not in a state where anyone should be proud of it.

Re: Is Telegram really an encrypted messaging app?

#318

Post by skeledrew »

maqp wrote: post #306
skeledrew wrote: post #298

Earlier quoted context omitted.

Telegram currently has very intuitive and snappy search, even in very active groups with years of content. That's because the heavy lifting is done by the server. Think that'd still be possible if there was no way for the server to process the data?

Yeah, try searching anything older than a year, the amazing snappy search grinds to halt. Meanwhile I'm storing years worth of stuff on Signal with no issues, and it searches ridiculously fast offline with no seconds long pause for buffering.

So interesting. I just did a search for mentions of someone I know in multiple Telegram groups and channels, and got all the results, going back 5 years, instantly. And these groups and channels have millions of messages. All media is also perpetually available (unless deliberately deleted), and take a couple seconds to load. I don't see any other platform having that kind of convenience.

Re: Is Telegram really an encrypted messaging app?

#319

Post by lukan »

SonOfLilit wrote: post #127
pandog wrote: post #122

Earlier quoted context omitted.

I think a high definition photo taken on a recent phone takes up an awful lot more device memory than a "big number of chats"

Yeah, but Whatsapp chats tend to be full of those... and videos.

Whatsapp automatically resizes them (in standard settings)

But it still gets big.

Re: Is Telegram really an encrypted messaging app?

#320

Post by steelbrain »

empath75 wrote: post #311
wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

Will they let _US_ law enforcement see it? No. Will they let Russian? Of course.

Source?
Post reply on HN