Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram - secure, free messaging

telegram.org

Post reply on HN
Print view View original

111–120 of 231 posts

Re: Telegram - secure, free messaging

#111

Post by e12e »

TelegramApp wrote: post #92
micheljansen wrote: post #73

Earlier quoted context omitted.

In this case, even if you remove the ad-hominem attack (a bunch of randoms), a valid point remains: implementing crypto is already notoriously difficult, let alone designing cryptographic protocols.

Still, there are sometimes valid reasons for not re-using existing solutions. In our case, we needed something that is both secure and competitive in comparison to mass market solutions in terms of speed, working on weak connections and usability. Disclaimer: I work for Telegram.

How do you improve on OTR?

Re: Telegram - secure, free messaging

#112

Post by TeeWEE »

Everybody is so negative here. Ok rolling your own security protocol might not be the best move. However, they want to be competetive with whatsapp.

Most people who try to make a whatsapp killer suck in uix. But this app is really good and fast. I think its better than whatsapp in a multitude of terms.

Okay, there are improvements. But I can submit a pull request to the android app and improve it myself! How Awesome!

Re: Telegram - secure, free messaging

#113

Post by TeeWEE »

ge0rg wrote: post #107

I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud": MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing t…

They need todo this to know which numbers are also using Telegram. Whatsapp does the exact same thing.

Re: Telegram - secure, free messaging

#114

Post by ge0rg »

TeeWEE wrote: post #113
ge0rg wrote: post #107

I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud": MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing t…

They need todo this to know which numbers are also using Telegram. Whatsapp does the exact same thing.

Sorry, but this is just a lame excuse. There is no need to upload the personal names for this feature.

Also, there are approaches to make number registration lookups more secure, e.g. bloom filters: http://en.wikipedia.org/wiki/Bloom_filter

I would expect such an approach from a "secure" app.

Re: Telegram - secure, free messaging

#115

Post by jgg »

sillysaurus2 wrote: post #33
yurylifshits wrote: post #25

Earlier quoted context omitted.

MTProto's author is Nikolai Durov: http://en.wikipedia.org/wiki/Nikolai_Durov He is one of most legendary math/programming champions of all time.

He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refac…

I scratched my head after reading your comment, and waited to see if anyone else would say something.

Colin's problem was that his (hand-written, from the looks of it) crypto primitives allowed him to use AES-CTR with a non-incrementing counter. I'm not sure if it's appropriate to say that in relation to a comment about "rolling your own protocol." I see that as a low-level problem.

Further, you've pulled a misdirection talking about TextSecure (which looks great, by the way). They don't roll their own crypto algorithms, but they have definitely tweaked and modified the OTR protocol for their own purposes in order to make it more secure. I'm left wondering why TextSecure is held up in contrast to someone who uses their "own" secure messaging protocol.

Whether or not this Telegram app is trustworthy (the lack of full source is suspicious), I have no idea. I would personally pick TextSecure over it.

Re: Telegram - secure, free messaging

#116

Post by sparkie »

artellectual wrote: post #77

why does HN comments have to be so negative all the time? its very depressing to read through HN comments.

Because intelligent, educated folk don't blindly accept the claims of others without scrutinizing them?

I don't see it as negativity. People are bringing attention to the details that marketers typically omit (perhaps intentionally). If anything, these are positive discussions as we're sharing our own views and experience to give others more information to allow them to make more informed decisions. (i.e, whether the claims of security can be trusted in this case.)

If you want comments that are always happy and positive about every claim made by marketers, there's plenty of other places on the web for that.

Re: Telegram - secure, free messaging

#117

Post by rblaze »

alonium wrote: post #71

Wow, there are so many cryptography experts with world names in this thread! And interesting why you think that it's not possible to read most of cryptography/cryptanalysis books and check common mistakes of implementation afterward? Do you really think that this is THAT hard? Your scepsis would be understandable if they used OWN cryptoalgorithm. However their protocol is based on well known strong crypto.

Yes, it's THAT hard. I'd read many good books and still feel bad looking on my first attempts in protocol design.

BTW, IGE cipher mode isn't well known for being strong.

Re: Telegram - secure, free messaging

#118

Post by BuildTheRobots »

qwertyboy wrote: post #78
sillysaurus2 wrote: post #33

Earlier quoted context omitted.

He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refac…

It looks like TextSecure encrypts your actual texts, for which you still pay, while Telegram also takes care of delivery, for free, and does it faster and better than SMS (which should be pretty darn easy, what with SMS doing such a very bad job indeed).

(iirc) If you're communicating with another TextSecure user then the messages go via the internet rather than over SMS

Re: Telegram - secure, free messaging

#119

Post by JshWright »

veeti wrote: post #104
TelegramApp wrote: post #88

Earlier quoted context omitted.

The main reason is speed. MTProto is designed to work fast on weak mobile connections. Another reason is security, with HTTPs you need to trust more parties.

> Another reason is security, with HTTPs you need to trust more parties. No, you don't. Use a self-signed certificate that is hardcoded in the app.

Or better yet, use a cert signed by a trusted CA and pi it in your app.

Re: Telegram - secure, free messaging

#120

Post by utnick »

A lot of haters in this thread. To be expected.

I've been following this space for a while and telegram is the best app out there right now. The usability is great and they are trying to do the right things when it comes to security.

The apps are open source and can be audited. I fully expect there to be bugs, that is part of the process! You would be insane to trust your life to a crypto app thats been around a few months. So yes, there will be bugs. But that doesn't mean they should just give up. In a few years this could turn into a really nice , secure app.

I think their big competition will be: Textsecure, also a great app and better for security due to OTR. But the iphone app is still in development as is their data channel. Once those are complete, they could take the #1 spot.

Also, hemlis is one to look out for. But they take about the same security approach as telegram but seem to be less open so far.

Post reply on HN