Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

331–340 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#331

Post by foresto »

bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

Unless you can prove (e.g. using your old device or a recovered signing key) that the new device is yours. In that case, if the service supports it, the new device could automatically ask your contacts to re-send the old messages using the new device's public key.

Re: Is Telegram really an encrypted messaging app?

#332

Post by mandmandam »

rafram wrote: post #327
vasco wrote: post #321

Earlier quoted context omitted.

Why not the "founder locked up" test? If the founder claims secure encryption, yet they are not in jail, that means there's no secure encryption because they negotiated their freedom in exchange for secret backdoors.

That isn’t applicable here. Telegram isn’t encrypted and yet they refused to comply with subpoenas. Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. Maybe in the future, creators of encrypted messaging apps will get locked up. I certainly hope not. But this case doesn’t indicate anything one way or another.

> Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t.

I dunno man, kinda seems like you ought to either have a right to privacy or not. Surely there's other ways to make a case, without extraordinarily abusable legal strong-arming.

Why should a wealthy person be able to legally afford encrypted communication on a secure device, when 90+% of people can't because they're poor and tech illiterate?

Does our historically unequal society need more information and rights asymmetry between rich and poor? Between privileged and marginalized?

Re: Is Telegram really an encrypted messaging app?

#333

Post by rafram »

mandmandam wrote: post #332
rafram wrote: post #327

Earlier quoted context omitted.

That isn’t applicable here. Telegram isn’t encrypted and yet they refused to comply with subpoenas. Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. Maybe in the future, creators of encrypted messaging apps will get locked up. I certainly hope not. But this case doesn’t indicate anything one way or another.

> Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. I dunno man, kinda seems like you ought to either have a right to privacy or not. Surely there's other ways to make a case, without extraordinarily abusable legal strong-arming. Why should a wealthy person be able to legally afford encrypted communication on a secure device, when 90+…

Downloading Signal is just as easy as downloading Telegram.

Re: Is Telegram really an encrypted messaging app?

#334

Post by mandmandam »

rafram wrote: post #333
mandmandam wrote: post #332

Earlier quoted context omitted.

> Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. I dunno man, kinda seems like you ought to either have a right to privacy or not. Surely there's other ways to make a case, without extraordinarily abusable legal strong-arming. Why should a wealthy person be able to legally afford encrypted communication on a secure device, when 90+…

Downloading Signal is just as easy as downloading Telegram.

As I said, tech illiterate - or as likely, legally illiterate.

It's unreasonable to expect most people to intuit the distinction you describe.

However, you don't see wealthy people communicating on insecure devices, because they have people to take care of that stuff.

Re: Is Telegram really an encrypted messaging app?

#335

Post by foresto »

upofadown wrote: post #161
codethief wrote: post #38

Thanks for the blog post, now I finally have a good resource I can point people to next time they claim Telegramm is secure. > I am not specifically calling out Telegram for this, since the same problem [with metadata] exists with virtually every other social media network and private messenger. Notably, Signal offers a feature called Sealed Sender[0]. While it doesn't solve the metadata problem entirely, it does at…

Sealed sender doesn't really solve the metadata problem at all: * https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1... Generally you need something like TOR to hide who is talking to who.

Related presentation from Network and Distributed System Security Symposium:

https://www.youtube.com/watch?v=HoN6FLC5Hss

Re: Is Telegram really an encrypted messaging app?

#336

Post by [deleted] »

qwertox wrote: post #221
sroerick wrote: post #209

Earlier quoted context omitted.

Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE

Why? I think Google suggests that you send the payload encrypted through the notification. Google then only knows which app to send the message to, they don't know from whom the message originates (only "a Telegram server") nor what the content is. Also, you could just send a notification instructing the app to fetch a new message from your server. From the docs: Encryption for data messages The Android Transport Lay…

[deleted]

Re: Is Telegram really an encrypted messaging app?

#337

Post by maqp »

rhelz wrote: post #233
waynecochran wrote: post #66

Earlier quoted context omitted.

Would you use an image for this? Is there a clever way to do this with text?

You could use an image. But you could use text as well. E.g. you could agree on a code phrase to be said when some "dirty deed done dirt cheap" has been completed. Or you could encode a binary string by alternating British English spellings with American English Spellings: e.g. "color" means 0, "colour" means 1; "gray" means 0, "grey" means 1, etc etc. and then just use those alternate spellings in a normal conversat…

The problem with codes is you have to remember them. And then you'll need a massive lookup-table. People don't want to have chats based on limited vocabulary.

This is why we have modern encryption. It converts the most beautiful poem in the world to complete noise and back with no loss of meaning. It allows sending images, books, videos -- culture, without spycraft that requires hours of learning. It's also more secure, given that humans aren't nearly as good at coming up with randomness and a computer's hardware RNG.

Re: Is Telegram really an encrypted messaging app?

#338

Post by wruza »

thisisabore wrote: post #183
bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

That's it. The article could be just that. You log back in and all your messages are there without you having to provide a secret or allow access to some specific backup? Your data just lives on the server. The only thing preventing anyone from accessing it is the goodwill of the people running the server.

Not true. Secret chats only live on a device where you started it. Regular people may not use them (their problem), but these are common for business-critical chats in my circles.

Re: Is Telegram really an encrypted messaging app?

#339

Post by SpicyLemonZest »

mandmandam wrote: post #334
rafram wrote: post #333

Earlier quoted context omitted.

Downloading Signal is just as easy as downloading Telegram.

As I said, tech illiterate - or as likely, legally illiterate. It's unreasonable to expect most people to intuit the distinction you describe. However, you don't see wealthy people communicating on insecure devices, because they have people to take care of that stuff.

I'm really not sure what you're referring to. You see lots of wealthy people communicate on insecure devices, and it's quite common for law enforcement to demand and obtain the contents of their communications. "Look at these terrible messages we subpoenaed" is a staple of white collar criminal prosecutions.

Re: Is Telegram really an encrypted messaging app?

#340

Post by mrln »

tamimio wrote: post #178
jxi wrote: post #154

Earlier quoted context omitted.

Signal has probably the worst UX of any messaging app. It also used to require sharing phone numbers to add contacts, which imo is already a privacy violation. Telegram is fast, responsive, gets frequent updates, has great group chat, tons of animated emojis, works flawlessly on all desktop and mobile platforms, has great support for media, bots, and a great API, allows edits and deleting messages for all users, and…

> allows edits and deleting messages for all users And it has those little features like masked text and what not, features wise, telegram is just the best. I didn’t use Signal for a long time, you can’t edit the messages there!?

Yes, you can.
Post reply on HN