Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram protocol defeated. Authors are going to modify crypto-algorithm

translate.google.com

Post reply on HN
Print view View original

151–160 of 223 posts

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#151

Post by girvo »

chmike wrote: post #99
yatsyk wrote: post #94

Earlier quoted context omitted.

Hate tone discussion makes me sad. Telegram is very young project and it has bugs for sure. Some guy found potential issue in protocol and developers committed to fix it soon. There is no information that any messages were revealed due to this bug but Telegram should go away and developers should do something else. Whatsapp is less secure then Telegram but I have not seed “Whatsapp RIP” messages. Not so hard to save…

Thank you yatsyk, I share your opinion. The app name is really great. I hope they fix it and come back with a stronger app. I would suggest they hire security consultats to check the security in a first stage. Review by third parties is the best method to avoid things we overlooked. The prize shoud be for after all these consultancy options have been exhausted. As a side node I see there is still a lot of room to imp…

Everyone who has been criticising Telegram would actually love for them to do what you've suggested. We want good, secure encrypted messaging. Telegram is not it, and people are worried, as their actions so far smack far too much of a project that ignores best practices...

In the crypto world, projects like Telegram have popped up over and over again. A new protocol, designed by non cryptographers, that turns out to be heavily insecure. I wish that wasn't the case, but that is why people have reacted the way that we have. This is literally life and death, so it pays to be cautious.

I hope Telegram learn from all this, and go and get audited and tested by reputable experts. Then, fix all the issues raised. Then release their apps to the public, when they are proven secure. Until that time I personally will not trust their application.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#152

Post by solyanyk »

The Telegram guys chose to view it as a proof of inherent superiority of humble Russian programmers over NSA-backed American haters (I wish I was kidding!). Here is what Pavel Durov had to say on the matter (translated from his public post on vk.com http://vk.com/wall-52630202_7858):

> This story makes me once again admire Russian programmers. For a whole week esteemed American cryptographers on HackerNews were picking on the protocol fruitlessly - mostly demanding to replace our own solution with algorithms from NSA-backed Suite B [sic!]. An yet a Russian programmer, who calls himself "a novice", could immediately recognize the weak spot in the secret chats, in the context of an article on Habrahabr.ru.

Edit: To make it clear, that is not the whole post, just the first paragraph relevant to my point

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#153

Post by varjag »

lososerg wrote: post #144
yourad_io wrote: post #49

Earlier quoted context omitted.

How much might a mighty prize be, if I may ask?

$100 000 http://vk.com/wall-52630202_7858 Эта история заставляет в очередной раз восхититься российскими программистами. Целую неделю маститые американские криптографы на HackerNews безуспешно цеплялись к протоколу — в основном, с требованием заменить наше решение на алгоритмы, которые продвигает АНБ в своем Suite B. А российский программист, называющий себя "новичком", смог в рамках статьи на Хабре с ходу определить…

Good God.. Россия - родина слонов.

As a programmer from that neck of the woods, allow me to use this opportunity to distance myself from these clowns.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#155

Post by yatsyk »

sillysaurus2 wrote: post #128
yatsyk wrote: post #122

Earlier quoted context omitted.

I’m not security expert, but I believe that: - military-grade encryption – true - world's most secure protocol – I’d consider this statement as false, I don’t know what they mean by most secure and what protocols were considered. May be messengers available at app store, better to ask them Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition…

Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition? I've written about this pretty extensively: https://www.hnsearch.com/search#request/all&q=by%3Asillysaur... It's an interesting contrast in cultures that you phrase it like "Why do you think Telegram lies more than TextSecure advocates?" .... As far as I'm aware, TextSecure advocates have…

I've not found any attempts to help them apart from this bug report.

>TextSecure's interest is in security, whereas Telegram's interest seems to be in money and power

I can't read minds or even their messenger logs so I can't comment what is their interest but I'd be interested to know why you think so

> TextSecure completely safe app

Just wrong. How could you call something "completely safe" or bug free?

>Each of these messengers is safe to passive listening >This is mistaken because Telegram has been proven vulnerable to MITM attacks

How Telegram is prone to passive listening?

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#156

Post by zobzu »

yatsyk wrote: post #94
onedev wrote: post #36

Earlier quoted context omitted.

Never forget. RIP Telegram (2013-2013). This whole thing has been interesting to follow because it seems this same thing happens every time someone make macho Crypto-claims. From seeing how confident the Telegram team was to reading all the detractors who were so ready to criticize. It's an interesting dynamic in the Crypto community.

Hate tone discussion makes me sad. Telegram is very young project and it has bugs for sure. Some guy found potential issue in protocol and developers committed to fix it soon. There is no information that any messages were revealed due to this bug but Telegram should go away and developers should do something else. Whatsapp is less secure then Telegram but I have not seed “Whatsapp RIP” messages. Not so hard to save…

you don't go tell you got the best thing in the world while its just another random thing that doesn't do what you say - its just for fame/ego/money - without getting hateful feedback.

And guess what, hate isn't always wrong.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#157

Post by danabramov »

hcarvalhoalves wrote: post #23

Demoralized twice, first for finding a flaw, second for not giving the prize.

He's getting $100 000, and note that the vulnerability he found was outside the first contest's scope.

HN seems to hate by default.

https://vk.com/wall-52630202_7858

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#158

Post by danabramov »

OoTheNigerian wrote: post #108

This is my first comment on the Telegram bruhaha. Sometimes, I get embarrassed by what I experience here on HN. The gang up, the unnecessary pride. To those saying RIP, Telegram will succeed. Without using it (I use a Blackberry), it looks to be top two of the chat apps when you combine usability/security. I will download it once I get an Android phone in January. I will not wish failure on anyone that is confident i…

>Pavel, I am hopeful that you will reward the chap even though the discovery was not within the "guidelines". it is all about the spirit of the competition.

He does reward the chap—with $100 000: https://vk.com/wall-52630202_7858

I figure it's fair.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#159

Post by [deleted] »

gohrt wrote: post #70
alanh wrote: post #54

Earlier quoted context omitted.

genwin, I’ve invented a secure system. If you can tell me what this message says, you win $200k: jo You don’t know what the message says, because it’s so short. You will never win the prize. But my system was not so secure. My cipher system was this: Take a message and type it on a US Qwerty keyboard, but shift every letter over one place. So `hi` became `jo`. Not very strong. It would easily be cracked with a messag…

FWIW, "hi" was my first guess when I saw "jo". $200k, please. :-)

[deleted]

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#160

Post by danabramov »

yatsyk wrote: post #94
onedev wrote: post #36

Earlier quoted context omitted.

Never forget. RIP Telegram (2013-2013). This whole thing has been interesting to follow because it seems this same thing happens every time someone make macho Crypto-claims. From seeing how confident the Telegram team was to reading all the detractors who were so ready to criticize. It's an interesting dynamic in the Crypto community.

Hate tone discussion makes me sad. Telegram is very young project and it has bugs for sure. Some guy found potential issue in protocol and developers committed to fix it soon. There is no information that any messages were revealed due to this bug but Telegram should go away and developers should do something else. Whatsapp is less secure then Telegram but I have not seed “Whatsapp RIP” messages. Not so hard to save…

>Terms of bug bounty are very hard to satisfy even with bad protocol but Durov seems decided to play safe with such amount of money. Guy that found problem in MTproto doesn’t win money according to conditions of the bug bounty because message is not decrypted.

The guy gets $100 000:

https://vk.com/wall-52630202_7858

You may want to check before you post.

Post reply on HN