Crowdsourcing a More Secure Future

#1

Post by techquery » Sun, Dec 22, 2013, 12:28 PM UTC

Crowdsourcing a More Secure Future
telegram.org

Re: Crowdsourcing a More Secure Future

#2

Post by growse » Sun, Dec 22, 2013, 1:03 PM UTC

Seems a little.... arbitrary....?

Don't people who run bug bounties publish their reward structure beforehand?

Re: Crowdsourcing a More Secure Future

#3

Post by jonknee » Sun, Dec 22, 2013, 1:04 PM UTC

growse wrote: post #2

Seems a little.... arbitrary....? Don't people who run bug bounties publish their reward structure beforehand?

Yes, they did. This was not the goal of the bounty, but was still a serious issue. They couldn't give away the prize for the contest and instead decided on a still quite generous $100,000.

http://telegram.org/crypto_contest

Re: Crowdsourcing a More Secure Future

#4

Post by adambenayoun » Sun, Dec 22, 2013, 1:05 PM UTC

growse wrote: post #2

Seems a little.... arbitrary....? Don't people who run bug bounties publish their reward structure beforehand?

Other people claimed that the Telegram team might find that bug to be outside of the scope of their bounty contest, so $100k is better than nothing (and to be frank I'm quite surprised they were _that_ generous).

But you're right - they should have a clear reward structure.

Re: Crowdsourcing a More Secure Future

#5

Post by jsumrall » Sun, Dec 22, 2013, 1:06 PM UTC

I thought a lot of people pointed out ways to attack the security protocol if they had physical server access.

Re: Crowdsourcing a More Secure Future

#6

Post by sillysaurus2 » Sun, Dec 22, 2013, 1:06 PM UTC

jonknee wrote: post #3

growse wrote: post #2

Seems a little.... arbitrary....? Don't people who run bug bounties publish their reward structure beforehand?

Yes, they did. This was not the goal of the bounty, but was still a serious issue. They couldn't give away the prize for the contest and instead decided on a still quite generous $100,000. http://telegram.org/crypto_contest

This was not the goal of the bounty, but was still a serious issue.

To be clear, this bug was enough to compromise the security of every Telegram secret chat session. I can't think of a more serious issue.

Re: Crowdsourcing a More Secure Future

#7

Post by [deleted] » Sun, Dec 22, 2013, 1:09 PM UTC

jonknee wrote: post #3

growse wrote: post #2

Seems a little.... arbitrary....? Don't people who run bug bounties publish their reward structure beforehand?

Yes, they did. This was not the goal of the bounty, but was still a serious issue. They couldn't give away the prize for the contest and instead decided on a still quite generous $100,000. http://telegram.org/crypto_contest

[deleted]

Re: Crowdsourcing a More Secure Future

#8

Post by lelf » Sun, Dec 22, 2013, 1:10 PM UTC

jsumrall wrote: post #5

I thought a lot of people pointed out ways to attack the security protocol if they had physical server access.

With this bug people who run server have access to your entire chat.

(Of course they won't formulate it that way in the post)

Re: Crowdsourcing a More Secure Future

#9

Post by mikegioia » Sun, Dec 22, 2013, 1:10 PM UTC

Good for Telegram. I haven't downloaded and installed their App yet, but I applaud their effort at putting out a secure chat app that everyone can use.

I've been using TextSecure for a while (as everyone on HN ruthlessly suggests) but guess how many encrypted texts I've sent? 0. That's because they have no iOS app and very few Android users.

There are two problems when it comes to creating a good, secure messaging app: strong, proven security and popularity! Hopefully Telegram either solves both or forces TextSecure to solve the latter.

Re: Crowdsourcing a More Secure Future

#10

Post by abus » Sun, Dec 22, 2013, 1:11 PM UTC

This is actually really generous considering it didn't meet the terms of the contest.

They have a long way to go before anyone here trusts them but perhaps we could be more positive and constructive?