Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram - secure, free messaging

telegram.org

Post reply on HN
Print view View original

121–130 of 231 posts

Re: Telegram - secure, free messaging

#121

Post by ToastyMallows »

jzwinck wrote: post #103
kitd wrote: post #45

Earlier quoted context omitted.

You are correct to be wary. However, the MTProto java impl is here: https://github.com/ex3ndr/telegram-mt

Great, let's take a quick look. TcpContext.java[1] says: MAX_PACKED_SIZE = 1024 * 1024 * 1024;//1 MB READ_DIE_TIMEOUT = 5 * 1000; // 15 sec So those are bugs, though I'm not sure if documentation or code. Most importantly to me, there are very few comments in the code, and the few there are are incorrect. One might infer that this code has been written either in haste, or by someone who believes that comments are not…

Curious, why are those bugs?

Re: Telegram - secure, free messaging

#122

Post by davexunit »

Ihmahr wrote: post #65

People here are complaining a lot about this app, and rightfully so. However, this is definitely the best encrypted communications app there is for ios and therefore also the only app that is cross platform and able to reach a wide audience. I know they didn't do it completely right, but it definitely seems to be the best option that is currently available.

>this is definitely the best encrypted communications app there is for ios

If you actually cared about security then you wouldn't be using iOS.

Re: Telegram - secure, free messaging

#124

Post by rattray »

ToastyMallows wrote: post #121
jzwinck wrote: post #103

Earlier quoted context omitted.

Great, let's take a quick look. TcpContext.java[1] says: MAX_PACKED_SIZE = 1024 * 1024 * 1024;//1 MB READ_DIE_TIMEOUT = 5 * 1000; // 15 sec So those are bugs, though I'm not sure if documentation or code. Most importantly to me, there are very few comments in the code, and the few there are are incorrect. One might infer that this code has been written either in haste, or by someone who believes that comments are not…

Curious, why are those bugs?

5ms * 1000 != 15s. It's unclear whether the comment is outdated, and 5s is in fact intended, or whether 15s was intended and the 5 is a typo (therefore a bug, although unlikely a critical one). Either way, it's certainly sloppy programming, and the kind of thing that can lead to more serious problems.

Re: Telegram - secure, free messaging

#126

Post by tptacek »

kitd wrote: post #45
sillysaurus2 wrote: post #33

Earlier quoted context omitted.

He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refac…

You are correct to be wary. However, the MTProto java impl is here: https://github.com/ex3ndr/telegram-mt

I looked for 4 minutes.

* Uses unpadded RSA in its authentication protocol

* Uses a novelty mode (IGE) for its bulk transport

* Does not appear to authenticate messages (other than by using IGE)

* Or, at least, what authentication it is doing must be happening after it decrypts data, not before

I could be wrong about any of these things, because again, 4 minutes. But this design does not look sturdy.

Re: Telegram - secure, free messaging

#127

Post by utnick »

ge0rg wrote: post #114
TeeWEE wrote: post #113

Earlier quoted context omitted.

They need todo this to know which numbers are also using Telegram. Whatsapp does the exact same thing.

Sorry, but this is just a lame excuse. There is no need to upload the personal names for this feature. Also, there are approaches to make number registration lookups more secure, e.g. bloom filters: http://en.wikipedia.org/wiki/Bloom_filter I would expect such an approach from a "secure" app.

Don't Bloom filters provide just an illusion of privacy when talking about phone numbers because its easy to iterate through every possible number?

Re: Telegram - secure, free messaging

#129

Post by TelegramApp »

ge0rg wrote: post #107

I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud": MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing t…

That is correct, Telegram does upload names and numbers — naturally, after receiving permission to do so. (see also: http://telegram.org/privacy)

Apart from identifying Telegram users among the user's friends, this also enables us to use proper names in notifications on the iPhone, as well as facilitates moving between devices.

But you have highlighted an important issue. Our android developer relied on the system prompts when it comes to uploading contacts, which is definitely not enough for the issue at hand. We will add another prompt in the coming version. (As well as update the GitHub code to the current generation soon, it's been becoming a little stale.)

Post reply on HN