Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mysteries of Telegram Data Centers (2022)

dev.moe

Post reply on HN
Print view View original

41–50 of 166 posts

Re: Mysteries of Telegram Data Centers (2022)

#41

Post by maqp »

dakolli wrote: post #38
hkpack wrote: post #31

Earlier quoted context omitted.

What does heavily encrypted even mean? Fully encrypted? Slightly encrypted? Encrypted enough to call it “heavily encrypted” but not enough to be protected from whoever is interested?

telegram is the safest encrypted messaging app. Period, full stop.

>telegram is the safest encrypted messaging app. Period, full stop.

Yes, let's see

* Not end-to-end encrypted by default

* No end-to-end encrypted groups

* No end-to-end encryption on any desktop client by the vendor, forcing cross-platform users to drop secret chats. This includes 81% of working age people who sit on their computer during work day, and 100% of college students and IT workers.

* No post-quantum key exchange

* No future secrecy

* No per-message forward secrecy

* Bullshit claims about distributed keys https://security.stackexchange.com/questions/238562/how-does...

* Lacks ALL metadata protection from server like phone number, IP-address and thus geolocation, contact list, group memberships, quantity and schedule of communication, data types. In fact --

* Secret chats leak additional metadata about intent to hide content from TG as the vendor.

Also,

History of poor encryption implementation

* 2013: A cracking contest https://news.ycombinator.com/item?id=6932648

* 2013: Telegram, AKA "Stand back, we have Math PhDs!" http://unhandledexpression.com:8081/crypto/general/security/...

* 2015: IND-CCA issues https://eprint.iacr.org/2015/1177.pdf,

* 2015 64-bit complexity MITM attack https://web.archive.org/web/20160425091011/http://www.alexra...

* 2021 Valsorda "The Most Backdoor-Looking Bug I've Ever Seen" https://words.filippo.io/telegram-ecdh/,

* 2021 https://mtpsym.github.io/ and https://mtpsym.github.io/paper.pdf

Some analysis:

* 2025 Matthew Green analysis https://blog.cryptographyengineering.com/2024/08/25/telegram...

* 2025 "Telegram is indistinguishable from an FSB honeypot" https://rys.io/en/179.html

Also,

They employ volunteering sockpuppets https://tsf.telegram.org/

Durov who supposedly lives in exile has visited Russia over 50 times https://eutoday.net/pavel-durovs-secret-visits-to-russia/

I can't scream "drop & run" loud enough.

Re: Mysteries of Telegram Data Centers (2022)

#42

Post by Anon1096 »

tobinfekkes wrote: post #32
Anon1096 wrote: post #29

Earlier quoted context omitted.

By traffic load east coast datacenters dwarfs these.

The parent comment wasn't regarding traffic loads; it was regarding latency.

Your experienced latency will be heavily influenced by which DC you hit, in which case we care about the relative traffic loads because you aren't just hitting your closest one all the time.

Re: Mysteries of Telegram Data Centers (2022)

#43

Post by dakolli »

maqp wrote: post #41
dakolli wrote: post #38

Earlier quoted context omitted.

telegram is the safest encrypted messaging app. Period, full stop.

>telegram is the safest encrypted messaging app. Period, full stop. Yes, let's see * Not end-to-end encrypted by default * No end-to-end encrypted groups * No end-to-end encryption on any desktop client by the vendor, forcing cross-platform users to drop secret chats. This includes 81% of working age people who sit on their computer during work day, and 100% of college students and IT workers. * No post-quantum key e…

Telegram has nothing to do with Russia, other than having a Russian founder, and the Ukrainian military has literally relied upon it in the past, along with many Ukrainian civic services. You people are just racist towards Russians and need help.

Based on the analysis of packet captures above, I believe it is clear that anyone who has sufficient visibility into Telegram’s traffic would be able to identify and track traffic of specific user devices. Including when perfect forward secrecy protocol feature is in use.

This would also allow, through some additional analysis based on timing and packet sizes, to potentially identify who is communicating with whom using Telegram.

I love how the author of your honeypot blog post has nothing concrete other than potential attack vectors and is like "Well this is obviously a Russian honeypot" with no evidence what so ever other than a claim that there are plain text device identifiers, which is something the FSB would do. [insert clown emoji]. You can do similar attacks on signal and whatsapp.. Why is it that the Russian one bothers you so much?

Re: Mysteries of Telegram Data Centers (2022)

#44

Post by maqp »

dakolli wrote: post #43
maqp wrote: post #41

Earlier quoted context omitted.

>telegram is the safest encrypted messaging app. Period, full stop. Yes, let's see * Not end-to-end encrypted by default * No end-to-end encrypted groups * No end-to-end encryption on any desktop client by the vendor, forcing cross-platform users to drop secret chats. This includes 81% of working age people who sit on their computer during work day, and 100% of college students and IT workers. * No post-quantum key e…

Telegram has nothing to do with Russia, other than having a Russian founder, and the Ukrainian military has literally relied upon it in the past, along with many Ukrainian civic services. You people are just racist towards Russians and need help. Based on the analysis of packet captures above, I believe it is clear that anyone who has sufficient visibility into Telegram’s traffic would be able to identify and track t…

>Ukrainian military has literally relied upon it in the past

Well they realized their mistake and banned Telegram's use on state issued devices in 2024 https://www.bbc.com/news/articles/c78dwepw95do

I'm not going to speak for the author of that article. But I agree with his conclusion. Telegram is indistinguishable from a honeypot.

In the world of infosec, stuff isn't secure until someone proves you wrong (which you reject assuming racism). Stuff is secure when you prove it's secure.

Practically every major secure messaging app vendor has proven they can not be a honeypot, by end-to-end encrypting their communications, offering open source clients with public key fingerprints to verify that end-to-end encryption is working correctly.

Telegram hasn't done that. Telegram's lack of end-to-end encryption, paired with zero effort for metadata protection (not even stuff like sealed sender) shows they don't give a damn about actual security.

But what they do is also what an FSB op would do.

* It would advertise "heavily encrypted" and bash WhatsApp day after day convincing average Janes and Joes about it being really really secure, and confuse readers who take a closer look, with claims of all chats using MTProto but also calling both client-server and end-to-end encryption protocols MTProto.

* It would construct a narrative that the face of the app is a rebel dissident in exile.

* It would be banned temporarily or poorly

* It's role would be obfuscated by releasing an obviously backdoored app like Max, to make Telegram seem safe compared to it. Like Russian intelligence really believed they could use Max to monitor Russian dissidents. FSB isn't dumb. Russian military deception is world famous. https://en.wikipedia.org/wiki/Russian_military_deception

The backdoor sits in the fact nothing is end-to-end encrypted, groups can't be E2EE, but troll army can still defend it, claiming it does have 1:1 E2EE if you want. Yes, it does, if you really want the highest friction UX possible. People try and drop secret chats when they want to be able to alt-tab into the conversation instead of digging into their phones 100 times a day. This backdoor is ingenious because the users can only blame themselves when their 1:1 messages end up to the server.

A good messaging app creator knows this, so they make E2EE default so that users don't encounter such friction. E.g. Signal allows you to have E2EE 1:1 and group chats between all of your devices. That's what proper privacy by design looks like. Would Telegram do that, they would've proven they stand for their users, and I'd actually recommend them.

Data is a toxic asset. Even if Telegram isn't a honeypot, it's a massive data collecting apparatus, that has all that data sit on its servers, from which the hacking team of any major intelligence agency can access it en mass. That's the life of 1B users worldwide. So ultimately, it doesn't even matter if Telegram is a honeypot, it's equally usable to https://en.wikipedia.org/wiki/Fancy_Bear or NSA TAO or whoever.

Also, https://dfrlab.org/2018/02/15/putinatwar-how-russia-weaponiz... shows Russian troll army is using russophobia as a narrative online.

This isn't about hating on Russians. This is about Durov not passing the minimum bar of what modern secure communication is about.

You've so far claimed telegram is the best with nothing to back that claim, ignored every counter argument, attacked argument of someone other than me, and you're now replaying Russian government shill tactics to try to rally people behind you for emotional reasons, when I'm explicitly giving technical critique.

Re: Mysteries of Telegram Data Centers (2022)

#47

Post by psychoslave »

dakolli wrote: post #43
maqp wrote: post #41

Earlier quoted context omitted.

>telegram is the safest encrypted messaging app. Period, full stop. Yes, let's see * Not end-to-end encrypted by default * No end-to-end encrypted groups * No end-to-end encryption on any desktop client by the vendor, forcing cross-platform users to drop secret chats. This includes 81% of working age people who sit on their computer during work day, and 100% of college students and IT workers. * No post-quantum key e…

Telegram has nothing to do with Russia, other than having a Russian founder, and the Ukrainian military has literally relied upon it in the past, along with many Ukrainian civic services. You people are just racist towards Russians and need help. Based on the analysis of packet captures above, I believe it is clear that anyone who has sufficient visibility into Telegram’s traffic would be able to identify and track t…

>You people are just racist towards Russians and need help.

That doesn’t exclude the statements about Telegram to be correct though. That is, if some hater against whatever group say 1+1=2 or water is wet, what’s the conclusion?

>You can do similar attacks on signal and whatsapp.

Well yes. Don’t trust devices, they are not humans, they don’t qualify. They can at most have some degree of reliance for some purpose. But assuming that all devices out there are powned by some external parties is a rather sound security baseline approach.

>Why is it that the Russian one bothers you so much?

One don’t need to bother more on any specific oligarchy really, they all use their fellow humans like disposable pawns.

Re: Mysteries of Telegram Data Centers (2022)

#48

Post by dewey »

overallduka wrote: post #22
hhh wrote: post #6

something smells suspicious about this kind of data routing

The Lex Fridman podcast episode with Pavel Durov is worth listening to. Their servers are built to be very secure — of course, it would be different for others, and they use some clever tricks

That has "military grade encryption" vibes.
Post reply on HN