111–120 of 206 posts
Earlier quoted context omitted.
The size is fairly irrelevant. 1 GB fits on a microSD card many times smaller than a Roman General's hand-written cypher.
How do you handle that SD card in practice to do your communication? My point is, if anyone is on to you and can physically get to you (or anyone else in the group), there is a high risk they can get hold of the data.
[flagged]
[flagged]
Earlier quoted context omitted.
Both could be, just from different queen bees
Moxie Marlinspike is a lot of things but I'm pretty confident the queen bee of a honeypot is not one of them.
[flagged]
If only for this twitter thread, you can comment with "unroll" on twitter to get one of these https://threadreaderapp.com/thread/1625719023081082880.html
But thank you for the tip!
Earlier quoted context omitted.
The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to do it. Worse there are 2 things called "password" there: the "cloud password" which is the 2FA password and the "password code" (that's what it's called in Russian, maybe the English interface uses a better name) which is merely a pin code for locking the Tele…
Only if you have one device: once you have authenticated on two devices the code is sent over Telegram to other devices you have. In that case there is no option to fall back to SMS when authenticating. I think if you lose all your devices then you're locked out, unless you have a recovery email set up. In addition, if login succeeds, an authentication warning that a new device has connected is sent to every other de…
That's not true. The option is there. (Edit: at least for now, some changes in that area are upcoming)
> In that case there is no option to fall back to SMS when authenticating.
The attack usually happens at night. By the time you wake up, all your chat histories are already downloaded and the secret police is on its way.
[flagged]
"Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting." - https://news.ycombinator.com/newsguidelines.html
Earlier quoted context omitted.
It's worse. 2FA is optional and SMS code is the first (and default) auth method.
> It's worse. 2FA is optional and SMS code is the first (and default) auth method. This will be changed on Saturday. Got the following message about API changes last week: https://telegra.ph/Telegram-API-Changes-02-16
Earlier quoted context omitted.
> My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. That‘s actually pretty secure in practice, because you won‘t be communicating with anybody. > Ideally just use one time keys and xor everything. How do you generate the keys? How do you share them? And you only care about encryption, authentication does not matter to you at all? The chan…
OTP one time pads are uncrackable if is random enough. Hard part is transporting that decoder to someone.
("This is POTUS, do$ÿ} launch the nukes!!!")
I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…