This is such a sham. Here, I'll offer $2000 to break my plaintext crypto. Every morning, in the shower, I'll say a secret word. Email me the secret word and I'll send you $2000 in BTC.
"Wet"?
$200,000 to the first person to break Telegram
51–60 of 176 posts
Re: $200,000 to the first person to break Telegram
#52> 100% FREE & NO ADS: Telegram is free and will always be free. We do not plan to sell ads or introduce subscription fees.
how you are then going to make a money ?
Re: $200,000 to the first person to break Telegram
#53Earlier quoted context omitted.
Yeah, it's probably against the rules of the competition and will get you arrested if you try. But I think if someone does break into their central server and wins the competition that way, they should still be paid out.
No, the goal of these security products is to defend against the government, not a random guy. In that context, it's extremely important that their server undergo the same level of cryptanalysis.
We already know the system is hopelessly vulnerable to server side MITM attacks, it makes no effort to defend against that attack model. It's mentioned in the comments that they might do manual key verification in the future, but that doesn't happen now. Compromise is silent.
Re: $200,000 to the first person to break Telegram
#54The problem with this test is that there are many encryption systems I would consider fundamentally broken where I could not claim this prize.
To make this a slightly fair challenge, we should at least be allowed to get the clear text of our choice also encrypted with the same key.
Re: $200,000 to the first person to break Telegram
#55> 100% FREE & NO ADS: Telegram is free and will always be free. We do not plan to sell ads or introduce subscription fees. how you are then going to make a money ?
Paid features, like stickers and etc.
Re: $200,000 to the first person to break Telegram
#56Earlier quoted context omitted.
Expanded here: https://www.schneier.com/crypto-gram-9812.html#contests
This contest isn't a great example of the kind of contests he is talking about. 1) They are giving you the source code, protocol, and a tcpdump of all traffic between the chatters. You can even send messages via the protocol to one of the participants. Its not just here is some encrypted data, decrypt it. 2) They are offering a significant amount of money.
Right, except for
2) there are no arbitrary definition of what winning means
The definition of winning in this contest creates a large class of potential vulnerabilities that would be paid $0.
Re: $200,000 to the first person to break Telegram
#57Earlier quoted context omitted.
Unfortunately, this doesn't mean that it's secure. If someone breaks it, it means it's broken, but if nobody breaks it, it doesn't mean someone else can't break it (or hasn't already).
Agreed, but the tone of the previous discussion was definitely more along the lines of "This could never work, you guys don't know what you're doing." If it proves resilient over 2.5 months of highly motivated attacks (motivated by both the money / "I-Told-You-So" factor), I think that's a fairly strong statement in their favor.
i have a day job and i'm not going to drop everything for the chance i won't make any money at all... told-you-so factor or not.
Re: $200,000 to the first person to break Telegram
#58Most of the concerns people had were Telegram's servers acting maliciously or being coerced into acting maliciously, which is obviously not covered by this contest or the protocol they have designed. It's a bit disingenuous that Telegram is broken but not in a way that this bounty could pay for.
Yeah, it's probably against the rules of the competition and will get you arrested if you try. But I think if someone does break into their central server and wins the competition that way, they should still be paid out.
I'm afraid breaking into Telegram's central server (by the way, there is no such thing) will hardly enable you to decipher end-to-end encrypted secret chats. But certainly worth trying anyway.
Re: $200,000 to the first person to break Telegram
#59Someone will probably break an employee's computer and will just access private information, good game 200k. And then they will say it's unfair and I'm not paying you. And then HN will go crazy. Mark my word HN.
Re: $200,000 to the first person to break Telegram
#60The problem with such a test is that it is a limited attack surface compared with the real app in use. There is a log of messages that are encrypted but there are no possibilities of active attacks such as man in the middle attacks and others that attack the protocol rather than the encryption.