$300k for Cracking Telegram Encryption • Hacker News Board

Re: $300k for Cracking Telegram Encryption

#21

Post by kirushik » Tue, Nov 04, 2014, 4:16 PM UTC

tptacek wrote: post #3

Obligatory: https://www.schneier.com/crypto-gram-9812.html $300,000 isn't a whole lot more than it would cost to get n entire novel cryptosystem for a complex application built out of idiosyncratic components assessed professionally. They should just retain Riscure or Rambus to do that for them instead of the PR stunt. Previous thread about Telegram on HN, featuring Moxie Marlinspike: https://news.ycombinator.com/ite…

What's the mathematical expectation of "Let's pay $300K for the security analysis?"

–$300 000, and good publicity among security experts.

What's the mathematical expectation of "Let's start a contest with $300K for dealing with our crypto on our terms (assuming 5% of success)"?

–$15 000, and much larger PR effect. ($300K-resistant crypto, yay!)

Seems to be an easy choice, unfortunately.

Re: $300k for Cracking Telegram Encryption

#22

Post by higherpurpose » Tue, Nov 04, 2014, 4:17 PM UTC

asadlionpk wrote: post #15

tptacek wrote: post #3

Obligatory: https://www.schneier.com/crypto-gram-9812.html $300,000 isn't a whole lot more than it would cost to get n entire novel cryptosystem for a complex application built out of idiosyncratic components assessed professionally. They should just retain Riscure or Rambus to do that for them instead of the PR stunt. Previous thread about Telegram on HN, featuring Moxie Marlinspike: https://news.ycombinator.com/ite…

Moxie's blogpost about it http://www.thoughtcrime.org/blog/telegram-crypto-challenge/

Some other good overviews:

http://www.cryptofails.com/post/70546720222/telegrams-crypta...

http://unhandledexpression.com/2013/12/17/telegram-stand-bac...

Re: $300k for Cracking Telegram Encryption

#23

Post by simi_ » Tue, Nov 04, 2014, 4:20 PM UTC

electic wrote: post #6

I give them, or anyone, credit for trying to create a secure messenger. It is not easy. However, I just wish they would release the source code to their clients and server. They have not. That would go a long way.

I spectated this whole Telegram circus, and never for a moment thought they aren't disclosing the source code. This is hilarious!

Re: $300k for Cracking Telegram Encryption

#24

Post by cissou » Tue, Nov 04, 2014, 4:21 PM UTC

ropman76 wrote: post #5

Maybe restating the obvious, but why don't they pay out the 300k to some professional pen testers or cryptography auditors and publish the results. At least then they would have a shot at validity in this area.

Maybe they did?

Re: $300k for Cracking Telegram Encryption

#25

Post by dvl » Tue, Nov 04, 2014, 4:21 PM UTC

cpt1138 wrote: post #2

Have the Nigerian 419 scams gotten more sophisticated? "Your email must contain: . . - Your bank account details to receive the $300,000 prize."

and what else I can do with your bank account besides send you money?

Re: $300k for Cracking Telegram Encryption

#26

Post by mistagiggles » Tue, Nov 04, 2014, 4:22 PM UTC

Slightly off topic, but I really like their icons on their front page. Very reminiscent of the vault boy icons in the newer fallout games.

Re: $300k for Cracking Telegram Encryption

#27

Post by magikarp » Tue, Nov 04, 2014, 4:23 PM UTC

electic wrote: post #6

I give them, or anyone, credit for trying to create a secure messenger. It is not easy. However, I just wish they would release the source code to their clients and server. They have not. That would go a long way.

The majority of Telegram's source code seems to be released as free software: https://telegram.org/apps (scroll down)

Re: $300k for Cracking Telegram Encryption

#28

Post by sarciszewski » Tue, Nov 04, 2014, 4:23 PM UTC

WhitneyLand wrote: post #16

tptacek wrote: post #9

Earlier quoted context omitted.

Both OTR (ChatSecure on your phone) and TextSecure are good options. Telegram is not a good option.

because...?

http://www.cryptofails.com/post/70546720222/telegrams-crypta...

Because the designers have their heads firmly planted where the sun doesn't shine, for one.

Re: $300k for Cracking Telegram Encryption

#29

Post by gondo » Tue, Nov 04, 2014, 4:26 PM UTC

eli wrote: post #13

ilghiro wrote: post #7

Earlier quoted context omitted.

But without the PR stunt there wouldn't be PR?

Depends who your audience is. Personally I'm much more interested in a service with a successful professional audit than a gimmicky prize.

well if no one will manage to break it, surely they can spend the money on proper audit.

Re: $300k for Cracking Telegram Encryption

#30

Post by dwild » Tue, Nov 04, 2014, 4:27 PM UTC

bhhaskin wrote: post #4

cpt1138 wrote: post #2

Have the Nigerian 419 scams gotten more sophisticated? "Your email must contain: . . - Your bank account details to receive the $300,000 prize."

What....

In order to get the amount, you need to send an email to the secret email of the message, containing your bank account details. Nigerian prince scam also say that.