Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram protocol defeated. Authors are going to modify crypto-algorithm

translate.google.com

Post reply on HN
Print view View original

161–170 of 223 posts

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#161

Post by jlas »

hawkharris wrote: post #40
onedev wrote: post #36

Earlier quoted context omitted.

Never forget. RIP Telegram (2013-2013). This whole thing has been interesting to follow because it seems this same thing happens every time someone make macho Crypto-claims. From seeing how confident the Telegram team was to reading all the detractors who were so ready to criticize. It's an interesting dynamic in the Crypto community.

RIP Telegram (2013-2013) would make an interesting T-shirt. No one except a few cryptography buffs might understand it, but it would be a funny way to start conversations about information security.

HN readers might also understand it.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#162

Post by makomk »

lososerg wrote: post #146
notastartup wrote: post #12

I hope this person will get the full $200,000. I definitely don't think we can ever trust Telegram's strength again. They won't be paying him the full $200,000 even though he has rendered the Telegram to be weak. Major, major backfire for Telegram stakeholders.

They gave him $100 000. And yet the flaw he pointed out doesn't help you read encrypted messages and has been already fixed/

The flaw he pointed out renders one of the main advertised features of Telegram - end-to-end encrypted chats that they can't eavesdrop on - broken to the point of total worthlessness. Telegram had the ability to undetectably MITM and spy on the supposedly secure communications, as did anyone who managed to compromise them.

They'd have achieved exactly the same level of security by having no end-to-end encryption whatsoever and just promising that they wouldn't log or look at people's messages - this flaw is seriously that bad.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#163

Post by sillysaurus2 »

yatsyk wrote: post #155
sillysaurus2 wrote: post #128

Earlier quoted context omitted.

Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition? I've written about this pretty extensively: https://www.hnsearch.com/search#request/all&q=by%3Asillysaur... It's an interesting contrast in cultures that you phrase it like "Why do you think Telegram lies more than TextSecure advocates?" .... As far as I'm aware, TextSecure advocates have…

I've not found any attempts to help them apart from this bug report. >TextSecure's interest is in security, whereas Telegram's interest seems to be in money and power I can't read minds or even their messenger logs so I can't comment what is their interest but I'd be interested to know why you think so > TextSecure completely safe app Just wrong. How could you call something "completely safe" or bug free? >Each of th…

Telegram seems to be interested in money and power because they've turned down offers from Moxie (the creator of TextSecure and a well-known cryptographer) to join forces. There's no reason to do that unless they were interested in money or power more than security.

I didn't say TextSecure is completely safe. I said Telegram has been demonstrated to be broken.

Telegram is prone to passive listening because their design doesn't prevent it. There's nothing stopping someone from MITM'ing every Telegram secret chat when it's first initiated. It's in the design.

Their contest means nothing, because due to the way the contest is designed, it's impossible to MITM or other side channel attacks like timing attacks. These are the real attack vectors, yet the format of the contest prevents anyone from employing them.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#164

Post by danabramov »

droopybuns wrote: post #25

Excruciating evidence that supports Moxie's position. Vuln rewards should exist for two purposes: 1)An act of good faith on the part of the developer that says "I am interested in securing my product and I won't prosecute direct disclosure" 2) The Dev knows exploitable vuln discovery has value, but cannot compete with black market pricing. Instead, the reward is a token of appreciation for a shared code of ethics. I…

I have no idea what you are trying to say here.

The guy is rewarded half the bounty: https://vk.com/wall-52630202_7858

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#165

Post by danabramov »

sillysaurus2 wrote: post #29
rdtsc wrote: post #27

Well nice knowing you Telegram. I don't see a good way for them to recover from this. First the bogus contest that Moxie debunked. Now this. The best option is to close shop, open a new company, new names and do something else.

The best part is that the debunker wrote this in Russian. The language barrier has probably been responsible for them getting so many users. So now everyone is very clear that Telegram is snakeoil.

>The language barrier has probably been responsible for them getting so many users.

What do you mean?

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#166

Post by danabramov »

ballard wrote: post #44
h0cked wrote: post #8

Earlier quoted context omitted.

Telegram's contest itself is meaningless regarding the security of its protocol (as others explained in details). Finding bugs such as this deserves 200k more than anything else

Offering the contest was shady and stupid enough. Not paying just proves they're chiselers that never intended to pay in the first place. This wins the runner-up award for second most botched PR disaster ever. The consolation prize is a lump of coal.

They're paying $100 000.

https://vk.com/wall-52630202_7858

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#167

Post by yatsyk »

danabramov wrote: post #160
yatsyk wrote: post #94

Earlier quoted context omitted.

Hate tone discussion makes me sad. Telegram is very young project and it has bugs for sure. Some guy found potential issue in protocol and developers committed to fix it soon. There is no information that any messages were revealed due to this bug but Telegram should go away and developers should do something else. Whatsapp is less secure then Telegram but I have not seed “Whatsapp RIP” messages. Not so hard to save…

>Terms of bug bounty are very hard to satisfy even with bad protocol but Durov seems decided to play safe with such amount of money. Guy that found problem in MTproto doesn’t win money according to conditions of the bug bounty because message is not decrypted. The guy gets $100 000: https://vk.com/wall-52630202_7858 You may want to check before you post.

At first my statement is still valid even after Durov decided to pay for bug report. This bug report has no connection with extracting plain message I've written.

Apart from that I can't check Durov's posts that from the future. My post was written before Durov's announcement.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#168

Post by danabramov »

josephlord wrote: post #131
paveldurov wrote: post #30

I'm excited by the insight and modesty of this guy. I will see to it that he gets a mighty prize. It's great to see how open software can leverage the power of the community to find weak spots and become stronger.

It is good to see that you recognise modesty as a virtue. May I suggest that you guys take a leaf out of his book and rewrite the security claims in your FAQ to reflect the fact that the protocol is new and at this point there are likely to be some bugs but that you are working hard to make it secure.

This, a thousand times.

Somebody finally expressed this thought politely.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#169

Post by im3w1l »

paveldurov wrote: post #30

I'm excited by the insight and modesty of this guy. I will see to it that he gets a mighty prize. It's great to see how open software can leverage the power of the community to find weak spots and become stronger.

This is a very respectable move.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#170

Post by thom »

pvnick wrote: post #61
thom wrote: post #60

Earlier quoted context omitted.

Are you suffering from testosterone poisoning or something?

Why would you post such an inane one-liner like that? Jimmytucson made a very good point, which is that the very intelligent Telegram authors tried really hard to make a solid product, made a huge gamble that didn't quite pay off like they wanted, and that all we see now are the smug, told-you-so vultures swooping in to pat themselves on the back for being oh so much smarter than the stupid crypto guys.

I don't think the response to catastrophic hubris should be back-slapping, crotch-grabbing praise.
Post reply on HN