Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram protocol defeated. Authors are going to modify crypto-algorithm

translate.google.com

Post reply on HN
Print view View original

191–200 of 223 posts

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#191

Post by salient »

OoTheNigerian wrote: post #133
DanBC wrote: post #115

Earlier quoted context omitted.

> To those saying RIP, Telegram will succeed. Without using it (I use a Blackberry), it looks to be top two of the chat apps when you combine usability/security. I will download it once I get an Android phone in January. But it is not secure! That's the entire point. Never mind "not secure against a well funded government agency", it's not secure against other attackers. There are lots of usable chat apps that do not…

Most people are not bashing just for the sake of bashing. Some people need good cryptography software to avoid imprisonment, or torture, or state-killing. This isn't about stopping someone's teen-angsty poetry from being discovered by a sibling, it's about protecting political dissidents from an oppressive regime. In that context pointing out that a software is broken is not mindless bashing, it is a crucial part of…

Completely disagree. It was just a week or two before Snowden came out that New York Times was praising Skype for how "secure" it is, even against government snooping. The poor souls thought Skype was still P2P, when that stopped being true many years before. The NYT journalists were also probably using Skype to talk to their sources, thinking they are secure. That's why it's so important to have such reviews of these apps - especially if they're a more "mainstream app", and there's a potential for hundreds of millions of people to use it. If we can get hundreds of millions of people to use end-to-end encrypted communication, why not do it properly, and give them half-baked secure apps to use instead?

Also all "secure apps" that aren't fully open source should be considered insecure by default. No compromises. Whatsapp, Snapchat, Hangouts, Skype, they're all insecure and you can't rely on them for keeping your communications private.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#192

Post by Morgawr »

jalada wrote: post #178
daeken wrote: post #62

Earlier quoted context omitted.

The problem is that if the authors had actually consulted crypto guys, none of this would have happened. Their lack of security shouldn't be excused.

Yeah you're right, the 'crypto guys' would've probably just said "Don't even try it because you'll kill people and even we wouldn't want to try and do it". Crypto is hard to get right, that doesn't mean anyone shouldn't even bother trying.

You're welcome "try" crypto, like everybody else is. Just don't go market your product as "the most secure" encryption ever when you don't even bother to put it to the test beforehand and get it reviewed by actual experts.

I could go and try to play around with real time systems for flying planes, it still wouldn't make sense for me to sell you the "safest" plane in the world without going through the proper steps to get such system certified beforehand.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#193

Post by DanBC »

Sprint wrote: post #137
OoTheNigerian wrote: post #133

Earlier quoted context omitted.

Most people are not bashing just for the sake of bashing. Some people need good cryptography software to avoid imprisonment, or torture, or state-killing. This isn't about stopping someone's teen-angsty poetry from being discovered by a sibling, it's about protecting political dissidents from an oppressive regime. In that context pointing out that a software is broken is not mindless bashing, it is a crucial part of…

I wholeheartedly disagree. For any user, the security we need is prevent eavesdropping & data mining by our governments. They use it to profile us, to find thoughtcrime and to secure their standing in a surveillance society. We should not let that happen.

Do you live or work in a building that has windows on the ground floor?

Who made your doors? What specification were your doors built to? Who made your door locks? What specification were they built to? Who has authority to cut keys to those locks? How do you know?

If you truly are as worried by governments as you claim why are you not fortifying your home?

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#194

Post by yatsyk »

danabramov wrote: post #185
yatsyk wrote: post #167

Earlier quoted context omitted.

At first my statement is still valid even after Durov decided to pay for bug report. This bug report has no connection with extracting plain message I've written. Apart from that I can't check Durov's posts that from the future. My post was written before Durov's announcement.

Technically you're right. I thought that “decided” wasn't the right word to use before you give him a chance to decide. In other words, I read your post as conveying the idea that Pavel actively dismissed the bug report as unworthy of rewarding, when in fact the opposite was true. Perhaps I misread your post being a non-native English speaker. Apologies for that.

Sorry if I have not been clear, I am non-native speaker too.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#195

Post by garethadams »

sillysaurus2 wrote: post #184
yatsyk wrote: post #180

Earlier quoted context omitted.

> I didn't say TextSecure is completely safe. Yes you do. "TextSecure completely safe app" was copied from your message before you or someone else edited it. I've not typed it but copied exact phrase from your message.

You copied it from your own message, not mine. http://i.imgur.com/pxMVDwA.png

The best part was when he copied it from your quoting of his message, but removed the "not" that came before it

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#196

Post by Nursie »

jimmytucson wrote: post #58
pjscott wrote: post #34

There's a lesson here. I genuinely don't mean to sound smug, but -- remember how confident the Telegram guys were? Remember how sure they were that their protocol would be able to resist the eavesdropping efforts of the NSA and whatever other nefarious interlopers may come along? Remember how they said they'd been working on it for years, and presumably expected for it to last many more years? Remember how that was,…

Did you write the encryption algorithm? Did you have the balls to put 200 grand on the table for anyone who could break it? Did you rise to the challenge and claim the cash? No, you just stood on the sideline and waited for somebody to fail so you could come down off your branch and peck at the corpse. Indeed, there is a lesson here. Don't expect anybody to pat you on the back when you put it all on black and win. Be…

I didn't write the algorithm, and neither did they, that would have been another bad move on their part. They used public, known algorithms and did it wrong.

They also didn't put 200k on the table for anyone that could break it. They put 200k on the table for anyone that could break it in a very specific way that proves nothing.

They used a combo of known bad and unproven stuff in weird ways and then claimed it was the best thing ever, which is just crazy.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#197

Post by pessimizer »

DanBC wrote: post #193
Sprint wrote: post #137

Earlier quoted context omitted.

I wholeheartedly disagree. For any user, the security we need is prevent eavesdropping & data mining by our governments. They use it to profile us, to find thoughtcrime and to secure their standing in a surveillance society. We should not let that happen.

Do you live or work in a building that has windows on the ground floor? Who made your doors? What specification were your doors built to? Who made your door locks? What specification were they built to? Who has authority to cut keys to those locks? How do you know? If you truly are as worried by governments as you claim why are you not fortifying your home?

Using good crypto is fortifying your home. People could easily learn information that could help them secretly enter my home if they could monitor my communications.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#198

Post by [deleted] »

6d0debc071 wrote: post #183
OoTheNigerian wrote: post #133

Earlier quoted context omitted.

Most people are not bashing just for the sake of bashing. Some people need good cryptography software to avoid imprisonment, or torture, or state-killing. This isn't about stopping someone's teen-angsty poetry from being discovered by a sibling, it's about protecting political dissidents from an oppressive regime. In that context pointing out that a software is broken is not mindless bashing, it is a crucial part of…

> As for me and most normal users, the security we need is not from NSA type of snooping but from mid level risks. Most users, disregarding the government for the moment, don't need encryption full stop. They don't send anything commercially sensitive that an attacker's going to be interested enough in to try to intercept their messages. The use of encryption presupposes a motivated threat, and it's not clear to me t…

[deleted]

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#199

Post by rimantas »

pvnick wrote: post #61
thom wrote: post #60

Earlier quoted context omitted.

Are you suffering from testosterone poisoning or something?

Why would you post such an inane one-liner like that? Jimmytucson made a very good point, which is that the very intelligent Telegram authors tried really hard to make a solid product, made a huge gamble that didn't quite pay off like they wanted, and that all we see now are the smug, told-you-so vultures swooping in to pat themselves on the back for being oh so much smarter than the stupid crypto guys.

No, the exact problem is that Telegram guys did not try really hard, and did not listen to crypto experts. There are no "stupid crypto guys": there are smart Telegram guys who are not crypto guys and there are smart crypto guys who told why Telegram's solution if lame. Alas, smart guys from Telegram probably considered themselves too smart to listen. That's why they should fall: security is not the field where each lame effort should be cheered and encouraged just for the sake of it.

Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm

#200

Post by h0cked »

OoTheNigerian wrote: post #108

This is my first comment on the Telegram bruhaha. Sometimes, I get embarrassed by what I experience here on HN. The gang up, the unnecessary pride. To those saying RIP, Telegram will succeed. Without using it (I use a Blackberry), it looks to be top two of the chat apps when you combine usability/security. I will download it once I get an Android phone in January. I will not wish failure on anyone that is confident i…

well, if someone causes you significant lose, will you turn down a norch? That's why we are bashing on them as they are making BS claims about how secure their protocol is.
Post reply on HN