Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘I will show you how safe Telegram is’

twitter.com

Post reply on HN
Print view View original

101–110 of 206 posts

Re: ‘I will show you how safe Telegram is’

#101

Post by seanw444 »

ShowalkKama wrote: post #26
vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

telegram isn't e2e encrypted (unless you use secret chats which nobody does (and those do not support more than 2 participants))

I wouldn't say nobody. My parents, SO, and some of my friends all use the encrypted chats. It would be nice if the client made the differences more clear though. Although if it is a honeypot, then they obviously wouldn't want to advertise the workaround.

Re: ‘I will show you how safe Telegram is’

#102

Post by atq2119 »

tpetry wrote: post #48
xdennis wrote: post #31

Earlier quoted context omitted.

> My takeaway is that for truly private chat one should write his own software That's the only way to make sure you're using software you trust, but rolling your own crypto implementations is often not so secure (because of the many pitfalls).

You don't have to roll your own crypto. You can e.g. just use libsodium which is designed to be easy-to-use and not possible to use incorrectly.

Using libsodium is good advice, but all crypto libraries can be used incorrectly.

Re: ‘I will show you how safe Telegram is’

#103

Post by notdang »

throwaway13337 wrote: post #13

Isn't this a weakness in all SMS based verification? If you can reroute SMS auth codes, it's game over. It's too bad that most 2FA rely on this method (or use it as a fallback). I don't see how it is directly related to telegram, though.

From what I've heard from my Russian colleagues quite a lot of people have an alternative number they register telegram with. The SIM card is never stored in the main phone. Also it was popular to buy a phone number in countries like Finland and keep it alive by making small payments. Obviously you never use this number directly in Russia. The was a method to read the SMS messages online.

Re: ‘I will show you how safe Telegram is’

#105

Post by lloeki »

entropyneur wrote: post #58
chinathrow wrote: post #49

Earlier quoted context omitted.

I do not use Telegram: what SMS code?

The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to do it. Worse there are 2 things called "password" there: the "cloud password" which is the 2FA password and the "password code" (that's what it's called in Russian, maybe the English interface uses a better name) which is merely a pin code for locking the Tele…

Only if you have one device: once you have authenticated on two devices the code is sent over Telegram to other devices you have. In that case there is no option to fall back to SMS when authenticating. I think if you lose all your devices then you're locked out, unless you have a recovery email set up.

In addition, if login succeeds, an authentication warning that a new device has connected is sent to every other device, and contrary to other Telegram chat messages cannot be deleted from another device, even previously authenticated ones. The message does not show up on the new device anyway, and it has to be deleted manually, once per other device. So an attacker that would gain access cannot hide its tracks unless it has access to all Telegram-known devices simultaneously.

Re: ‘I will show you how safe Telegram is’

#106

Post by swores »

sdiacom wrote: post #38
mellosouls wrote: post #4

Better to link to the actual story (Guardian in partnership with a few others): https://www.theguardian.com/world/2023/feb/15/revealed-disin... Covered already on HN: https://news.ycombinator.com/item?id=34800157 https://news.ycombinator.com/item?id=34803779 Etc

Speaking of the actual story, how come they put all of this effort into unmasking this guy, discussing the consequences of his actions to the integrity of democracies... but then he says "I hack into Telegram accounts by using an SS7 vulnerability", and they just copy and paste that verbatim into the story, not even bothering to explain it in the slightest? Obviously it's because they themselves don't know what it me…

Ironically the Guardian could have even looked up a past article published by them - "SS7 hack explained: what can you do about it?"

https://www.theguardian.com/technology/2016/apr/19/ss7-hack-...

Re: ‘I will show you how safe Telegram is’

#107

Post by proxysna »

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

> Telegram accounts of opposition were hacked by belarus police as well. It's known and documented.

These were cases when cops either were able to access the device, or were able to intercept sms messages. Notice that that did not happen to those belarus related channels whose admins left the country. For example an ongoing issue [1][2] with one of the admins who left the country, but his identity was found out and now cops are using his brother, who was still in the country, as a lever to make him delete the channel.

They can't delete/hack your channel unless you let them.

[1] https://mediazona.by/article/2023/02/15/blackmail

[2] https://mediazona.by/news/2023/01/22/belzd

Re: ‘I will show you how safe Telegram is’

#108

Post by m3kw9 »

lxgr wrote: post #77
vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

> My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. That‘s actually pretty secure in practice, because you won‘t be communicating with anybody. > Ideally just use one time keys and xor everything. How do you generate the keys? How do you share them? And you only care about encryption, authentication does not matter to you at all? The chan…

OTP one time pads are uncrackable if is random enough. Hard part is transporting that decoder to someone.

Re: ‘I will show you how safe Telegram is’

#110

Post by VincentEvans »

vbezhenar wrote: post #24

I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…

There’s no need to “hack” anything in Belarus. They simply resort to torture.

https://www.themoscowtimes.com/2022/12/23/critics-slam-16-ye...

Post reply on HN