31–40 of 56 posts
Well that escalated quickly. Still, nowhere near as bad as Whatsapp I'm assuming?
Just use RedPhone. Moxie knows what he's doing and it's auditable + good technology. Whatsapp is a joke, but lower friction matters much more for their market.
Earlier quoted context omitted.
The issue is that they claim their system is secure. Peoples lives can literally depend on encryption actually doing what it says on the tin; this software does not. It's the epitome of home grown encryption.
I hear you. Agreed. Surely every decent crypto system started off home-grown?
If they presented it as an attempt and asked for critique, then this would have been a fine thing to publish. They would have got chewed out by a professional, fixed it or removed it, and everyone would go away learning something new.
The issues comes when they don't accept critique, and make claims that don't stack up in actuality. Doing that is how people get hurt.
Typical NIH syndrome. They hired some smart people who are not cryptographic experts and now their cryptography is broken. Which is pretty much the story for anyone who has ever created a custom cryptographic system (and the story of SSL for the first few years).
Read the comments under TFA. Nothing was broken. The author was quick to write the article without understanding protocol first.
It looks like a bunch of convoluted code that doesn't actually accomplish anything.
Why is
sha1_a = SHA1 (msg_key + substr (auth_key, x, 32));
sha1_b = SHA1 (substr (auth_key, 32+x, 16) + msg_key + substr (auth_key, 48+x, 16));
sha1_с = SHA1 (substr (auth_key, 64+x, 32) + msg_key);
sha1_d = SHA1 (msg_key + substr (auth_key, 96+x, 32));
aes_key = substr (sha1_a, 0, 8) + substr (sha1_b, 8, 12) + substr (sha1_c, 4, 12);
aes_iv = substr (sha1_a, 8, 12) + substr (sha1_b, 0, 8) + substr (sha1_c, 16, 4) + substr (sha1_d, 0, 8);
sha1_a = SHA1 (msg_key + auth_key);
sha1_b = SHA1 (sha1_a);
sha1_с = SHA1 (sha1_b);
sha1_d = SHA1 (sha1_C);
aes_key = SHA1(sha1_a+sha1_b+sha1_c);
aes_iv = SHA1(aes_key+sha1_d);
aes_key = RANDOM
aes_iv = RANDOM
To me it looks like repeatedly sending the same message, or a message whose hash varied by a few bits, would leak part of the auth key, basically the person probably doesn't know what they are doing and are just adding extra 'stuff' to assure themselves it's secure.
Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…
Trying to profit off the whole NSAgate thing this way deserves derision. Provide robust and proven service and don't try to pass off Maths Ph. Ds as cryptographers.
This just screams sleazy start-up, because what they're doing, is indeed, sleazy.
They could have made something like: the client generates a key pair, encrypts the public key with the server’s public key, sends it to the server with a nonce, and the server sends back the nonce encrypted with the client’s public key. Simple and easy. Just out of curiosity, is it really that easy if you're using verified components? I would naively assume (and hope) so, but then everyone tells me that crypto is fra…
You need cert pinning or a fool proof trust system to verify the server key.
Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…
The issue is that they claim their system is secure. Peoples lives can literally depend on encryption actually doing what it says on the tin; this software does not. It's the epitome of home grown encryption.
> The rest looks like matters of taste as opposed to objective reasoning. Can you name an actual attack?
The response to that is, "I shouldn't have to!" Anything that replaces a proven secure component with something that we haven't (yet) found an attack on is grounds for suspicion at the very least.
SHA-1 isn't a MAC. It's not that hard to make it so (HMAC), but Telegram hasn't.
> Again, we do not use MAC-then-encrypt. Our scheme is closer to MAC-and-encrypt with some essential modifications.
Out of the three options: MAC then encrypt, encrypt then MAC, and MAC and encrypt, only encrypt then MAC is secure (http://cseweb.ucsd.edu/~mihir/papers/oem.pdf) I don't care if they've made "essential modifications", they're replacing a component that is provably secure, with one that may or may not be secure.
Earlier quoted context omitted.
Because Telegram is acting careless, and ignoring actual criticism, while touting claims that do not appear to be true? It's close to lying and scamming users. If Telegram was a messaging proposal, I'm sure the attitude would be a more straightforward one (with the same end result of "you're not ready to handle this yet"). Instead, it's billed as a definitely secure system. Seriously, read the previous thread: https:…
So which efforts are leading the pack at this stage that I could recommend to my entire family who practically daily urge me to join them on Viber? Years ago I would have said Skype. Now I just don't know. I'm saddened because I thought Telegram looked pretty sweet and a serious new contender. Practically calling them liars after that much hard work is unfair.
Earlier quoted context omitted.
Because Telegram is acting careless, and ignoring actual criticism, while touting claims that do not appear to be true? It's close to lying and scamming users. If Telegram was a messaging proposal, I'm sure the attitude would be a more straightforward one (with the same end result of "you're not ready to handle this yet"). Instead, it's billed as a definitely secure system. Seriously, read the previous thread: https:…
So which efforts are leading the pack at this stage that I could recommend to my entire family who practically daily urge me to join them on Viber? Years ago I would have said Skype. Now I just don't know. I'm saddened because I thought Telegram looked pretty sweet and a serious new contender. Practically calling them liars after that much hard work is unfair.
Maybe you can try that with your folks on android?
They could have made something like: the client generates a key pair, encrypts the public key with the server’s public key, sends it to the server with a nonce, and the server sends back the nonce encrypted with the client’s public key. Simple and easy. Just out of curiosity, is it really that easy if you're using verified components? I would naively assume (and hope) so, but then everyone tells me that crypto is fra…
Not really, that is also vulnerable to man in the middle attacks. You need cert pinning or a fool proof trust system to verify the server key.