Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

361–370 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#361

Post by maqp »

tamimio wrote: post #45
331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

That’s Telegram's CEO saying how he and his employees were “persuaded and pressured” by US FBI agents to integrate open-source libraries into Telegram (1).. There are a lot of questions to ask, like if the open-source libraries are indeed compromised, among other things. I take it as this arrest was the final straw to pressure him to give up and hand over some “needed” data, as all the accusations I read are laughabl…

Or he's trained in the art of lying

"At St. Petersburg State University, Mr. Durov studied linguistics. In lieu of military service, he trained in propaganda, studying Sun Tzu, Genghis Khan and Napoleon, and he learned to make posters aimed at influencing foreign soldiers."

https://www.nytimes.com/2014/12/03/technology/once-celebrate...

You really think the FBI would casually go to Durov and start telling him which libraries to deploy in his software.

This "They're trying to influence me that means its working" 5D-chess is the most stupid way to assess security of anything.

There's nothing to backdoor because it's already backdoored:

Code does not lie about what it does. And Telegram clients' code doesn't lie it doesn't end-to-end encrypt data it outputs to Telegram's servers. That's the backdoor. It's there. Right in front of you. With a big flashing neon light says backdoor. It's so obvious I can't even write a paper about it because no journal or conference wouldn't accept me stating the fucking obvious.

Re: Is Telegram really an encrypted messaging app?

#363

Post by maqp »

sam_lowry_ wrote: post #345
maqp wrote: post #234

Earlier quoted context omitted.

You could also ask about whether they think it's private. And if they say yes, ask them what it means. Does it mean only sender and intended recipients can read the message, or is it fine if the service has someone check the content. Would they agree on the notion "it's OK my nudes I send to my SO are up for grabs for anyone who hacks Telegram's servers", or do they think should Telegram plug this gaping hole. Also,…

>And if they say yes, ask them what it means I just did it to gather anecdotal evidence and the answer was, the founder is in jail to protect their privacy.

So they take theatrics over logical evaluation of the situation. Cool. Tell them Durov could have locked himself out of their data and spared himself the trip to behind bars.

Re: Is Telegram really an encrypted messaging app?

#364

Post by wruza »

maqp wrote: post #244
tpoacher wrote: post #195

Earlier quoted context omitted.

yes. in that if you want it it's there, but nobody's forcing it on you if you just want a burger.

Oh, I must have missed this. Please tell me how to enable secret chats for groups. And my desktop chats. Also I'd like to turn on the setting for defaulting to secret chats whenever I open a new one. Oh? I can't. Sounds like it's not there if I want it, after all. Good thing they didn't force it to me though /s

You can’t have secret chats for groups.

For desktop secret chats you may use Unigram client (although it’s hard for me to justify a potentially non-mobile secret chat).

The rest is trivial and isn’t that hard unless you contact hundreds of new people a day. In that case, I’d already thought of using ahk automation or a full-blown telethon bot.

Re: Is Telegram really an encrypted messaging app?

#365

Post by lolinder »

dijit wrote: post #196
maqp wrote: post #181

Earlier quoted context omitted.

>it's just claiming that you can trust them more than you can trust the major messaging apps. All the cool kids in the block eliminated the need to trust the provider decades ago. PGP: 33 years ago, OTR 20 years ago, Signal 14 years ago.

You have to trust the provider with signal; they are fiercely anti-third party clients, control the network and have released version of the code that are not tracked by sources- in extreme cases we’re aware of years old code being in there (mobile coin for example). Signal evangelicalism needs to halt, you mean the Whisper protocol.

You have to trust the platform with the metadata, but the actual E2E encryption of the messages is something you can personally verify if you cared to.

Re: Is Telegram really an encrypted messaging app?

#366

Post by wruza »

kitkat_new wrote: post #2

The worst thing is that almost every non-techie who uses Telegram thinks Telegram in general is e2ee.

I’d guess (not gonna test it but it feels reasonable) that “almost every non-techie” has a very vague idea of what e2ee even is, so it’s not clear where the worst part comes from. Pretty sure the best ideas they have about security are from hacker movies best case on average.

Re: Is Telegram really an encrypted messaging app?

#367

Post by kasey_junk »

EGreg wrote: post #230
kasey_junk wrote: post #204

Earlier quoted context omitted.

Reproducible builds are not required to evaluate the encryption algorithm used in Telegram. Software auditors use deployed binaries as a matter of course. They’d do so even if reproducible builds are on offer because the code and the binary aren’t promised to be the same even with reproducible builds and validating that they are can be more problematic than the normal case of auditing binaries.

Can you show me any audits of Telegram binaries or similar software?

https://www.sciencedirect.com/science/article/abs/pii/S26662...

Re: Is Telegram really an encrypted messaging app?

#368

Post by est »

maqp wrote: post #231
mfiro wrote: post #175

In my opinion, Telegram is more of a social network than a messenger. There are many useful channels and in many countries, it plays an important role in sharing information. If we look at it from this point of view, e2ee does not seem very important. We should also not forget that, in the time when all social media (Reddit, X, Instagram etc.) close their APIs, Telegram is one of the only networks that still has a fr…

That's the dangerous part. It's a messaging app that took in the function of a social media platform. It did so without robust security features like end-to-end encryption yet it advertised itself as heavily encrypted. Like Green stated in his blog post, users expect that to mean only recipient can read what you say, i.e. end-to-end encryption. Telegram would be fine if it advertised itself as a public square of the…

> a social media platform. It did so without robust security features like end-to-end encryption

Most social media platforms doesn't support e2ee.

Some chat apps do support e2ee but also requires a god damn phone number to login (yeah so does telegram), this makes "encryption" useless because authorities just ask the teleco to hand out the login SMS code.

Re: Is Telegram really an encrypted messaging app?

#369

Post by robmccoll »

bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

How to do that on initial account creation:

- locally create a recovery key and use it to wrap any other essential keys

- Split that or wrap that with two or more keys.

- N - 1 goes to the cloud to be used as MFA tokens on recovery.

- For the other, derive keys from normalized responses to recovery questions, use Shamir's secret sharing to pick a number of required correct responses and encrypt the Nth key.

You can recover an account without knowing your original password or having your original device.

Re: Is Telegram really an encrypted messaging app?

#370

Post by Timber-6539 »

SXX wrote: post #290
Timber-6539 wrote: post #145

Reads like a hit piece on Telegram from a crypto expert who couldn't be bothered to explain in more than one paragraph why the app he is calling not an encrypted app (according to how he personally thinks everyone refers to when talking about encryption) actually uses some encryption technology that he's not exactly sure of but suspects is insecure.

TLDR: 99.95% of messages on Telegram stored as plain text on their servers and only encrypted between client and telegram server. End-to-end encryption only working for 1on1 chats, not available half of their clients and have terrible UX.

All this is just wrong. I wonder why HN likes throwing up wrong information about Telegram as fact. Is taking up 5 mins to proof these claims that hard?

> 99.95% of messages on Telegram stored as plain text on their servers and only encrypted between client and telegram server.

Wrong and OP doesn't even mention plain text. The non-E2EE client-server data is stored encrypted sparsed out in various servers to different countries. https://telegram.org/privacy#3-3-1-cloud-chats

> End-to-end encryption only working for 1on1 chats, not available half of their clients and have terrible UX.

Wrong again. I actually recently checked this for myself their official clients on Android and Linux desktop have support for MTProto 2.0. Feel free to check if other OS don't support this feature. The only clients I know where this is not enabled are the web clients.

Post reply on HN