After reading all the blogs and replies that are abuzz talking about Telegram, I realized they are the best guerrilla marketers I have seen in a while!
They might as well throw away their PhD. papers and stop calling themselves as Engineers/Cryptographers/whatever... marketing monkeys...
A Crypto Challenge For The Telegram Developers
51–60 of 136 posts
Re: A Crypto Challenge For The Telegram Developers
#52If the prize was similar to this one, I think the challenge would be taken more seriously:
http://16s.us/software/FreeOTP/freeotp_challenge.txt
* Prize
One small Slurpee or its equivalent monetary value.Re: A Crypto Challenge For The Telegram Developers
#53this is a reminder that prizes or cash for breaking crypto products is a silly PR stunt. mega did the same thing, ended up paying out some money, then their product is "secure" by the same sort of argument. same deal with cryptocat and several other cryptoturds.
i do find it amusing to hear moxie ranting about how much better textsecure is when the license on it is such shit. can't argue with the fact that it's open source, but there is no point in contributing the codebase due to the licensing.
Re: A Crypto Challenge For The Telegram Developers
#54Earlier quoted context omitted.
That's making the assumption that all phones in the US have NSA keyloggers on them, which is pretty unlikely.
While they probably don't have keyloggers on them from the start, it is with high probability child's play for them to push it to your phone over the air, and make your phone run it http://www.osnews.com/story/27416/The_second_operating_syste... "What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. in a cell tower). Nothing is checked, everyt…
Yep. And you can build your own (low-power) GSM base-station:
http://www.thinksmallcell.com/Technology/build-your-own-open...
So anyone with a little time on their hands can be that "trusted party" for everyone in radio vicinity.
Re: A Crypto Challenge For The Telegram Developers
#55I must be missing something, but isn't this easy to attack by exploiting the periodicity of the XOR function? Or is the message 32 bytes long as well?
Re: A Crypto Challenge For The Telegram Developers
#56Whats to stop Telegram tampering with the messages and just displaying random bytes in the 'output'? This would make it impossible to crack. You cant test the security of a system without 1 - full access to the system or 2 - complete trust in the people controlling the system (which we dont have)
They said if no one wins the contest they would publish the keys allowing anyone to decrypt the data, proving it was not garbage.
Ah, I missed this part. Thanks
Re: A Crypto Challenge For The Telegram Developers
#57Using an NSA backdoored RNG is pretty redundant. A cell phone cannot be secured against NSA. They'll just activate their keylogger and grab the plaintext before it has even been encrypted.
ding ding ding!
you have won the prize! expecting anything to be secure on a mobile device is a serious mistake.
in some ways, textsecure and redphone actually induce behavior that puts people at risk: no amount of encryption can make a mobile device safe.
the only possible exception to this is a device that is built from zero and has fully in-house gsm stack, etc.
Re: A Crypto Challenge For The Telegram Developers
#58Using an NSA backdoored RNG is pretty redundant. A cell phone cannot be secured against NSA. They'll just activate their keylogger and grab the plaintext before it has even been encrypted.
That gives me an idea: messaging apps shouldn't use the default OS keyboard, but write their own. In that case, NSA would need to target that messaging app specifically.
not going to buy you much if an attacker has dma, which is what a proper backdoor will give.
Re: A Crypto Challenge For The Telegram Developers
#59tl;dr: moxie uses ancient, known broken crypto primitives (Dual_EC_DRBG, RSA with 896 bits, MD2 and XOR) to construct a chat protocol which is unbreakable if framed in the same way the Telegram developers did with their challenge. "If they can’t demonstrate a break in this obviously broken protocol using the same contest framework they’ve setup, then we’ll know that their contest is bullshit." Also, a call to arms to…
I still don't get it. If an insecure protocol with an insecure implementation can send messages that others can't read, how is it insecure?
[deleted]
Re: A Crypto Challenge For The Telegram Developers
#60Using an NSA backdoored RNG is pretty redundant. A cell phone cannot be secured against NSA. They'll just activate their keylogger and grab the plaintext before it has even been encrypted.
The goal is to prevent mass snooping on our private data. It's impossible to prevent an attacker with root access from getting your data, but on the other hand, they must invoke their root access in order to get your data.
More simply: right now, the NSA is vacuuming up everyone's data across all services. Your emails, your texts, your search history, certainly your metadata; basically everything. And the only reason it was possible for the NSA to do this to us is because security has historically been an afterthought.
TextSecure is the first step toward keeping our data free from prying eyes. It prevents the NSA from having default access to our texts. If the NSA wants your data, they'll have to deliver a keylogger to your specific phone in particular. That's very different from gathering everyone's comms all the time.
Telegram, on the other hand, offers no protection whatsoever against the NSA vacuuming up everything, because the NSA can simply MITM every Telegram conversation as they're initiated, just like the NSA MITM's CAs to decrypt your https traffic.
In summary: if you care at all about a world in which the NSA can't sift through all of your data, then use and promote TextSecure, because TextSecure offers protection against governments.
Now, I've said "NSA" about ten times here, but this is true for other governments too. Other governments have impersonated CAs, coerced CAs into issuing bogus security certificates, etc, to target people they deem to be political radicals. China tries very hard to do this. I'm sure there are plenty of governments worldwide who are all working on doing exactly this.
So it's not just the NSA. It's the entire future landscape of our data privacy. If you believe you have the right to electronic privacy, then use TextSecure, and make sure everyone knows the truth: Telegram offers no such privacy.