Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The story of Telegram or “Why you shouldn’t listen to Hacker News”

paulmillr.com

Post reply on HN
Print view View original

1–10 of 20 posts

Re: The story of Telegram or “Why you shouldn’t listen to Hacker News”

#2

Post by ghshephard »

I don't have flesh in this game one way or another, but when I read the article, it seemed to be a pretty damning indictment on Telegram, probably not what the author was trying to communicate.

I think the gap in understanding here, is that when it comes to security, cryptography in particular, it's not the case that the critic has to demonstrate where something is broken , the responsibility is on the part of the developer to prove that, in every possible manner, the system is secure.

The telegram people, on the surface, don't appear to be familiar with the crypto-community best practices, and, as a result, are unlikely to have made a product that would survive any real scrutiny, and highly unlikely to survive any actual attack on their protocol, should any adversary desire to do so.

Re: The story of Telegram or “Why you shouldn’t listen to Hacker News”

#3

Post by sparkie »

ghshephard wrote: post #2

I don't have flesh in this game one way or another, but when I read the article, it seemed to be a pretty damning indictment on Telegram, probably not what the author was trying to communicate. I think the gap in understanding here, is that when it comes to security, cryptography in particular, it's not the case that the critic has to demonstrate where something is broken , the responsibility is on the part of the de…

It's not some third party adversary to be worried about, but an internal adversary who might harbor ill intent (or even if they mean well, might be forced to become evil under secret court orders.)

Telegram are advertising a system which they claim is encrypted end-to-end, which means that even with physical access to the servers which are routing messages, one would not be able to perform MITM attacks. However, the contest is an obvious farce because they're asking only to demonstrate flaws which can be done externally without the same access to servers that Telegram have.

It's obviously simpler for someone knowledgeable in cryptography to be critical in a few sentences than to demonstrate vulnerabilities with actual proof of concepts which require lots of work for no apparent gain other than to make a point. If Telegram were offering $100k for every flaw found in their system though, you can bet that there would be less mouthing on HN, because people would direct their effort at demonstrating the flaws.

Re: The story of Telegram or “Why you shouldn’t listen to Hacker News”

#5

Post by girvo »

You're joking right? Also, telling TextSecure to go make their protocol better... Have you even seen their new ratchet? It's awesome. I think you have no idea what you're talking about... I'm sick of attempting to show people like the OP why they're wrong, why Telegram is currently dangerous to rely on for anything secure, and why TextSecure isn't. Also, the smug crap at the end, real classy. Sigh.

Re: The story of Telegram or “Why you shouldn’t listen to Hacker News”

#8

Post by girvo »

tptacek wrote: post #4

You shouldn't listen to Hacker News because I might write a 1000 word comment about message authentication codes and RSA padding? Ok.

Where's your math PhD???? Posting about why there are huge inherent issues in someone's brand new protocol and having a wealth of experience in the crypto world means nothing... Apparently?
Post reply on HN