Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

501–510 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#501

Post by alephnerd »

Account_Removed wrote: post #232
jijji wrote: post #228

Earlier quoted context omitted.

defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked

[dead]

On a separate note, Zerodium is dead now. They're in the middle of an active fire sale, but the Zero Day market's bottom fell out now that countries are increasingly moving exploit development in-house or to vendors that can do both zero day acquisition AND exploit deployment (which Zerodium cannot do as an American company).

Also, u/reissbaker's answer is correct.

Re: Is Telegram really an encrypted messaging app?

#502

Post by MattJ100 »

nrr wrote: post #492
zaik wrote: post #428

Earlier quoted context omitted.

> The answer to both of those is, as it turns out, "no" This is not true, it depends on the client. Conversations has OMEMO enabled per default.

I don't see any practical difference between "it depends" and "no" here.

This is like saying we shouldn't use TCP/IP because it's not encrypted. How it actually works is that encryption is enforced by the application - indeed the only place you can reasonably enforce it. See for example the gradual phasing out of HTTP in browsers by various means.

What this means in practice is that you shouldn't focus on whether XMPP (or Matrix, or whatever) protocols are encrypted, but whether the applications enforce it. Just as there are many web browsers to choose from, there are many messaging apps. Use (and recommend) apps that enforce encryption if that's what you want.

Re: Is Telegram really an encrypted messaging app?

#503

Post by SXX »

Timber-6539 wrote: post #370
SXX wrote: post #290

Earlier quoted context omitted.

TLDR: 99.95% of messages on Telegram stored as plain text on their servers and only encrypted between client and telegram server. End-to-end encryption only working for 1on1 chats, not available half of their clients and have terrible UX.

All this is just wrong. I wonder why HN likes throwing up wrong information about Telegram as fact. Is taking up 5 mins to proof these claims that hard? > 99.95% of messages on Telegram stored as plain text on their servers and only encrypted between client and telegram server. Wrong and OP doesn't even mention plain text. The non-E2EE client-server data is stored encrypted sparsed out in various servers to different…

> The non-E2EE client-server data is stored encrypted sparsed out in various servers to different countries.

Yet all this data available to any person connecting to Telegram API endpoints. It's really doesn't matter how they distributed storage look like underneath if there is point where everything available as plain text.

Also this is just "trust me bro" encryption. You cant check any of it.

> Wrong again. I actually recently checked this for myself their official clients on Android and Linux desktop have support for MTProto 2.0.

E2EE in telegram is burdensome to use. It's just fact for anyone who actually used it daily.

Also many desktop versions only gained E2EE capabilities relatively recently.

Re: Is Telegram really an encrypted messaging app?

#504

Post by maqp »

guappa wrote: post #448
maqp wrote: post #381

Earlier quoted context omitted.

Sounds like I should stick to Signal that got this right from the get-go.

apt install signal Error: Unable to find the package signal

$ sudo apt install telegram

Reading package lists... Done

Building dependency tree... Done

Reading state information... Done

E: Unable to locate package telegram

Also

$ sudo apt install signal-desktop-beta

[sudo] password for :

Reading package lists... Done

Building dependency tree... Done

Reading state information... Done

signal-desktop-beta is already the newest version (7.22.0~beta.1).

0 upgraded, 0 newly installed, 0 to remove and 5 not upgraded.

So, yeah.

Re: Is Telegram really an encrypted messaging app?

#505

Post by SXX »

codedokode wrote: post #399
SXX wrote: post #307

Earlier quoted context omitted.

PCs and phones been fast enough to have snappy search on text data for years now. Is "grep" not snappy enough for you?

Grep is inefficient search engine, because it needs to scan through whole content (and Telegram uses search indexes). Also, grep cannot deal with words forms and inflections (you type "foot" and you also want to find "feet"). Inflections are not very important in English, but you need to deal with them in other languages where the word can have many forms.

I'm not trying to claim Telegram uses grep or whatever. My point is even very active chats on telegram generate somewhat small amount of text data and I dont believe that searching through it require massive complex search engine with super-fast backend.

I basically participate in hundreds of chats and message history doesn't take 10 of GBs. And I also know that search in history of such chats isn't so snappy on older Android phone.

Re: Is Telegram really an encrypted messaging app?

#506

Post by nrr »

MattJ100 wrote: post #502
nrr wrote: post #492

Earlier quoted context omitted.

I don't see any practical difference between "it depends" and "no" here.

This is like saying we shouldn't use TCP/IP because it's not encrypted. How it actually works is that encryption is enforced by the application - indeed the only place you can reasonably enforce it. See for example the gradual phasing out of HTTP in browsers by various means. What this means in practice is that you shouldn't focus on whether XMPP (or Matrix, or whatever) protocols are encrypted, but whether the appli…

I'm not sure I agree, particularly given that there's some incentive for us to get our relatives using these messenger protocols and clients. The Web made it work because everyone came together and gathered consensus (well, modulo some details) that enforcing HTTPS is, ultimately, a good idea given the context.

So far, I'm not seeing that same consensus from the XSF and client vendors. If the capital investment can be made to encourage that same culture, the comparison can perhaps be a little closer.

Re: Is Telegram really an encrypted messaging app?

#507

Post by zaik »

nrr wrote: post #506
MattJ100 wrote: post #502

Earlier quoted context omitted.

This is like saying we shouldn't use TCP/IP because it's not encrypted. How it actually works is that encryption is enforced by the application - indeed the only place you can reasonably enforce it. See for example the gradual phasing out of HTTP in browsers by various means. What this means in practice is that you shouldn't focus on whether XMPP (or Matrix, or whatever) protocols are encrypted, but whether the appli…

I'm not sure I agree, particularly given that there's some incentive for us to get our relatives using these messenger protocols and clients. The Web made it work because everyone came together and gathered consensus (well, modulo some details) that enforcing HTTPS is, ultimately, a good idea given the context. So far, I'm not seeing that same consensus from the XSF and client vendors. If the capital investment can b…

The consensus comes from the people using the clients, not from the standards bodies. It's the same for HTTPs, where the users (in this case the server admins) decided it would be a good idea to use encryption.

There are even apps like Quicksy which have a more familiar onboarding experience using the mobile phone number as the username, while still being federated with other standard compliant servers. There is little reason to use walled garden apps like Signal these days.

Re: Is Telegram really an encrypted messaging app?

#508

Post by raxxorraxor »

schmichael wrote: post #417
wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

> Does Telegram let them see it: I don't think so. This is exceptionally naive. Even if he was arrested for not sharing with the French, what about for other countries? Was he arrested for not ever sharing or not sharing enough? Even if he, personally, has never shared, that doesn’t say anything about his employees who have the same access to these systems. Your data is not private with Telegram. You are trusting Tel…

You cannot be sure and yet Telegram often gets mentioned for being the only platform where states do not have easy access to user information or the ability to censor certain messages/content.

So from a broad perspective, they probably behave better than comparable services.

I think Telegram should not be trusted, but I also do not trust the alternatives, that readily share information with states. A special focus for me is that my own jurisdiction does not have access to my social media content. Other countries are secondary at first.

Re: Is Telegram really an encrypted messaging app?

#509

Post by kitkat_new »

foresto wrote: post #341
kitkat_new wrote: post #130

Earlier quoted context omitted.

this is pretty much what Matrix does, if I understand correctly. Additionally the key is regularly updated to provide some degree of perfect forward secrecy and avoid encrypting for people who left the group chat

> this is pretty much what Matrix does, if I understand correctly. I think it has senders encrypt messages with each room member's public key, rather than a single shared key. (At least, that's what the behavior I've seen suggests to me.) Here's the spec, in case you want to comb through it: https://spec.matrix.org/v1.11/client-server-api/#end-to-end-...

> When creating a Megolm session in a room, clients must share the corresponding session key using Olm with the intended recipients, so that they can decrypt future messages encrypted using this session. An m.room_key event is used to do this. Clients must also handle m.room_key events sent by other devices in order to decrypt their messages.

https://spec.matrix.org/v1.11/client-server-api/#mmegolmv1ae...

OLM is the public key encryption scheme, similar to the Signal Protocol. It is used to exchange room_key messages, but not the room messages itself.

MEGOLM as linked in the specification: https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/me...

Re: Is Telegram really an encrypted messaging app?

#510

Post by cja »

cja wrote: post #442
cja wrote: post #29

Earlier quoted context omitted.

Telegram is the comms system for the Russian military.

Please could whoever downvoted this explain why? There's plenty of evidence of this. Access to Telegram would be like cracking Enigma

BBC review of reaction of Russian newspapers https://x.com/BBCSteveR/status/1827956452373438648
Post reply on HN