Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Most Backdoor-Looking Bug I’ve Ever Seen

buttondown.email

Post reply on HN
Print view View original

111–120 of 222 posts

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#111

Post by Yetanfou »

jbj wrote: post #30

One thing that always puzzled me about telegram was seeing maps being loaded from yandex when sharing locations with friends

I never share my location with anyone other than by telling them in normal language than I am at some specific location ("the ferry terminal at Marstrand" or something like that). I don't give the few apps I still use - I try to use self-hosted web services where possible - access to location data, other than those which need it to function (OsmAnd~ etc.). To use some WWII-related terms, "Feind hört mitt" (seen om german-language equipment, it means "the enemy is listening in"), "En svensk tiger" (a Swede stays silent (so that the enemy can't listen in)) or, more tangentially related "loose lips sink ships".

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#113

Post by pdimitar »

ryanlol wrote: post #110
pdimitar wrote: post #107

- Clickbait title: Check. - Half-admission that the clickbait title might not apply (at the end of the article by mentioning Hanlon's Razor): Check. - Actual good criticism on "don't roll your own crypto": Check (this is not a sarcasm, I liked that part of the article very much). - Casual mention that the incident is from 7 years ago but implying that today there's a backdoor: Check. - HN going crazy negative when Te…

> What's so uniquely awful about Telegram? Telegram puts its users in danger by lying to them. They claim to be a secure, encrypted messenger but do not actually encrypt chats. Then there’s the backdoor... >I am not shilling for Telegram :)

Well, sue them. I don't think all other messengers save for maybe Matrix and Signal are any better.

Even better, make a messenger that does encrypt chats. Make it paid. Prove its end-to-end encryption properties. I'll buy it and advocate for it to my friends and family.

In any case, the constant hate is (a) very tiring and (b) very uncharacteristic for HN.

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#114

Post by FiloSottile »

keyme wrote: post #63
FiloSottile wrote: post #42

Earlier quoted context omitted.

That page doesn't say that, and "tied to the phone number" sounds like they will only give you the key if you can authenticate via SMS. Do you have a better cite or did you check directly recently?

You can extract it yourself. https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre... I do not vouch for this repo, but it gets the job done. The only creds required are your Google account creds. No per-user whatsapp keys necessary.

That's disappointing, thank you for the link.

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#115

Post by logarhythmic »

adsche wrote: post #92
baobabKoodaa wrote: post #79

> PitM attack I see we've arrived at the point where we're re-naming commonly established acronyms in order to remain politically correct.

Good. (At the risk of stating the obvious: Changing commonly established things is how progress works.)

Can we really label changing "Man in the middle" to "Person in the middle" as "progress"?

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#116

Post by bildung »

wyuenho wrote: post #83
toyg wrote: post #69

Earlier quoted context omitted.

If i remember correctly, Telegram pre-dates Signal by several months. It was well-established by the time Signal became usable. This said, the relationship between Telegram and the cryptography community has always been rocky, probably because they touted their E2E support as a differentiator from the start (Whatsapp, Messenger, and whatever-Google-had were not e2e at the time) but quite a few people pointed out thei…

They indeed were one of the first if not the first to come out with a messaging app that can e2e encrypt your chat. This was a time when WhatsApp was found using a plaintext protocol, and right after the Snowden revelations. They did move the needle a bit at the right time. One of the most vocal critics was Moxie, who later founded Signal. It's ironic that 7 years after Snowden and Telegram, Signal the supposed more…

TextSecure (essentially the old name for Signal) is 3 years older (2010 vs. 2013), isn't it?

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#118

Post by cies »

> Most backdoor looking bug

While a backdoor is not a bug but a feature, it helps to disguise a backdoor as a bug (i.e. plausible deniability). I know of one instance (in MS Windows) where the backdoor feature was not even hidden so much:

https://en.wikipedia.org/wiki/NSAKEY

That's why we need opensource. It's a hedge against tyranny.

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#119

Post by ryanlol »

pdimitar wrote: post #113
ryanlol wrote: post #110

Earlier quoted context omitted.

> What's so uniquely awful about Telegram? Telegram puts its users in danger by lying to them. They claim to be a secure, encrypted messenger but do not actually encrypt chats. Then there’s the backdoor... >I am not shilling for Telegram :)

Well, sue them. I don't think all other messengers save for maybe Matrix and Signal are any better. Even better, make a messenger that does encrypt chats. Make it paid. Prove its end-to-end encryption properties. I'll buy it and advocate for it to my friends and family. In any case, the constant hate is (a) very tiring and (b) very uncharacteristic for HN.

Why are you so bothered by Telegram receiving some well deserved criticism? It’s weird.

There are lots of posts on HN I don’t care about, but I don’t think I’ve ever had the urge to make comments like yours.

> In any case, the constant hate is (a) very tiring and (b) very uncharacteristic for HN.

There are people who trust their life and liberty on these apps, I don’t think the “hate” towards Telegram is inappropriate at all.

And actually, I think that most of the time the HN community is far too positive about Telegram. Usually I see comments criticizing it get downvoted. Funny, no?

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#120

Post by dboreham »

rorykoehler wrote: post #31
Taek wrote: post #17

Earlier quoted context omitted.

The more I work with production systems, the more I appreciate healthy logs. We've solved at least a dozen big issues this past year with "just scan the logs and rebuild the historical data, we can pretend like we were monitoring that issue the whole time".

You run debug level logging on prod?

Not the OP, but: kind of, yes. Enough logging for someone with access to the source code to stand a good chance of reverse engineering what happened (code trace) when something goes wrong, without having the user reproduce. This capability is built into the product and involves significant development effort in itself.
Post reply on HN