Telegram messaging app proves crucial to Belarus protests • Hacker News Board

Re: Telegram messaging app proves crucial to Belarus protests

#391

Post by maqp » Sat, Aug 22, 2020, 5:44 AM UTC

tryptophan wrote: post #344

asutekku wrote: post #336

Earlier quoted context omitted.

It’s no more unsafe as using whatsapp or some other similar service. To be fair, if most of my relatives would not use whatsapp, i would’ve turned 100% telegram already.

People get super morally-puristic when it comes to chat app security for some reason. Telegram is no worse (or even might be better) than email, your banking website, facebook, your credit card, etc... It's 100% better than SMS though, which is completely unencrypted. I'd bet that for most people its an upgrade in security and privacy.

Facebook's Messenger app is TLS-encrypted (i.e. encryption happens between client and server) unless special E2EE mode with Signal protocol is enabled.

Telegram is encrypted with client-server MTProto (i.e. encryption ALSO happens between client and server) unless their the special secret chat with its hand-rolled E2EE is enabled.

In LTE networks SMS uses the SNOW3G[1] encryption between the cell-tower and phone. This is also equivalent to client-server encryption in that the server-side area covers the more or less TelCo side decentralized SS7 backbone where message travel more or less unencrypted.

So by default with all three Telegram, Facebook, and SMS, all messages are readable by the vendor. Telegram and Facebook offer E2EE as an opt-in measure, but given that neither offers it for groups, they're not a viable option. Signal uses E2EE for everything, hence it's the recommendation by every security expert out there, nobody's recommending Telegram or Facebook.

There's nothing puristic about expecting companies in 2020 to implement basic security like E2EE for everything, by default. After all, we're not talking about anything short from protecting universal human right to privacy here.

[1] https://www.gsma.com/aboutus/wp-content/uploads/2014/12/snow...

Re: Telegram messaging app proves crucial to Belarus protests

#392

Post by maqp » Sat, Aug 22, 2020, 5:47 AM UTC

eitland wrote: post #273

prajjwal wrote: post #218

It's amazing that technology is empowering these protestors, but I'm not sure a vulnerable group of people such as this should be leaving identifying information on these servers. - You cannot sign up for Telegram without your phone number (even if it isn't public). - End to End encryption exists but is limited to 1-1 chats. - Telegram cooperates with data requests from law enforcements. The kind of risk this puts th…

> Telegram cooperates with data requests from law enforcements. It is not that black and white: AFAIK and IIRC it is more like this: - yes: Telegram gives data about members of public groups/channels - no: Telegram does not give out information from closed groups / personal chats, and they go to great lengths to prevent that information from becoming available. We might be sceptical all we want about the custom crypt…

"they go to great lengths to prevent that information from becoming available."

Where's the documentation for this? Without documentation your assumption that there's any security is just blind faith.

Re: Telegram messaging app proves crucial to Belarus protests

#393

Post by maqp » Sat, Aug 22, 2020, 5:48 AM UTC

stjohnswarts wrote: post #160

rectang wrote: post #44

Should the revolution fail, the digital trail left by these messages will give the government everything they need to hunt down every last activist. We saw it with the Green Revolution in Iran. We've seen it several times since. So long as messages are not encrypted, messaging apps are much more naturally suited as tools of oppression than tools of revolution.

I don't understand how they will get the chats except from individual phones. The convo is encrypted between telegram app and their servers and the servers aren't available to Bealrus' government officials, so how are they going to get the messages? Obviously they can if they're monitoring public group chats because all they have to do is join, but person to person or private groups, how are they going to get to thos…

"I don't understand how they will get the chats except from individual phones."

~~By default~~ Telegram's group chats used to organize protests aren't E2EE. If Belarusian government hacks Telegram server, they can read every dissident group's chat history trivially.

Re: Telegram messaging app proves crucial to Belarus protests

#394

Post by henriquemaia » Sat, Aug 22, 2020, 5:48 AM UTC

newscracker wrote: post #264

It's not surprising that every time Telegram pops up here, many comments miss the fact that Telegram has a great UX, a great feature set and also provides the kind of privacy protestors value, i.e., not having their phone numbers flashed to every random stranger in groups or to random channel owners whose channels you've subscribed to. With Telegram you cannot even do a phone number enumeration attack (this can be ch…

>Telegram has a great UX

I was making this exact point today to a couple of friends. Telegram's features puts it way ahead of its competitors. While using it, I feel I'm charge and not the other way around (WhatsApp being the worst offender here).

With the recent addition of video calls, and if you judged only by its feature set, it could arguably be called the best messaging app at the moment.

As for countering the network effect, I do my part. I politely ask my acquaintances to message me through telegram for anything important.

Re: Telegram messaging app proves crucial to Belarus protests

#395

Post by schmorptron » Sat, Aug 22, 2020, 5:50 AM UTC

crondung wrote: post #373

contravariant wrote: post #321

Earlier quoted context omitted.

Just in case anyone is wondering. The 'official' vote count for Thikhanovskaya is 588,622. So regardless of how unbiased a sample it may be the Telegram poll shows over 2x as many people (or phone numbers to be exact), willing to vote for Thikhanovskaya (at the time of writing). Use this information as you wish.

That's cool and all, except everyone in that country had 2 sim cards with 2 numbers. They don't have free long distance over there, nor are plans for cheap text+data the same plans as cheap calls. So I take this information to mean this poll was useless. Everyone who voted could vote twice, and felons and kids voted too.

Wait, how is felons voting a bad thing?

Re: Telegram messaging app proves crucial to Belarus protests

#396

Post by maqp » Sat, Aug 22, 2020, 5:50 AM UTC

BTCOG wrote: post #216

stjohnswarts wrote: post #160

Earlier quoted context omitted.

I don't understand how they will get the chats except from individual phones. The convo is encrypted between telegram app and their servers and the servers aren't available to Bealrus' government officials, so how are they going to get the messages? Obviously they can if they're monitoring public group chats because all they have to do is join, but person to person or private groups, how are they going to get to thos…

They are not going to get them, and the people saying otherwise don't use Telegram, and/or do not know what they are arguing over;pedantry. Telegram works well. Anyone can start a private chat encrypted end-to-end, those messages only stay on the device, and you can set them to auto-delete from BOTH user devices in 3 seconds, 5, 10, 30 second, 1min, 1 hour, 1 day. Nobody at all is going to get those messages. Go ahea…

"people saying otherwise don't use Telegram, and/or do not know what they are arguing over"

So that would include world famous professional cryptographers like Bruce Schneier and Matt Green. Meanwhile the people recommending Telegram are random usernames on internet forums. It sounds like you're the only one who doesn't know what they're talking about.

"Anyone can start a private chat encrypted end-to-end"

This is such a shill talking point. Telegram doesn't even support E2EE for groups. Every dissident groups leaks 100% of its chats to server with no possibility to opt-out.

Re: Telegram messaging app proves crucial to Belarus protests

#397

Post by maqp » Sat, Aug 22, 2020, 5:54 AM UTC

ldarby wrote: post #309

BTCOG wrote: post #216

Earlier quoted context omitted.

They are not going to get them, and the people saying otherwise don't use Telegram, and/or do not know what they are arguing over;pedantry. Telegram works well. Anyone can start a private chat encrypted end-to-end, those messages only stay on the device, and you can set them to auto-delete from BOTH user devices in 3 seconds, 5, 10, 30 second, 1min, 1 hour, 1 day. Nobody at all is going to get those messages. Go ahea…

> wireshark your connection This isn't good advice for trying to show someone their messages aren't being sent in clear text. It could be encrypted using a weak cipher or have other implementation bugs that make it trivial for a nation state to decrypt it. You need to be able to look at the application's source code to tell what encryption it's using and if it's secure enough.

Wireshark would show group messages in Telegram are indeed encrypted. However, they are encrypted only in-transit, meaning the server will see 100% of group chats. This can not be trivially detected with wireshark hence the advice to use the analyzer is useless and downright dangerous. It's like using a radiation detector to find cancer.

Re: Telegram messaging app proves crucial to Belarus protests

#398

Post by gardaani » Sat, Aug 22, 2020, 5:54 AM UTC

rectang wrote: post #44

Should the revolution fail, the digital trail left by these messages will give the government everything they need to hunt down every last activist. We saw it with the Green Revolution in Iran. We've seen it several times since. So long as messages are not encrypted, messaging apps are much more naturally suited as tools of oppression than tools of revolution.

Encryption isn't enough. They could just suspect or arrest anyone who has Telegram installed. Or they could check teleoperators' logs for anyone who has used Telegram during the past weeks.

In Turkey, they arrested people who had the ByLock app installed. It didn't matter how people had used it. Having installed it was enough.

https://en.wikipedia.org/wiki/ByLock_(application)

Re: Telegram messaging app proves crucial to Belarus protests

#399

Post by maqp » Sat, Aug 22, 2020, 5:56 AM UTC

bagacrap wrote: post #311

laksdjfkasljdf wrote: post #297

Earlier quoted context omitted.

sadly, very easy: 1. arrest person. 2. torture until you get the chat app unlocked. (which is readily verifiable and very practical to get with torture). 3. arrest everyone else based on the chats after cross-referencing telegram accounts and phone company records.

doesn't work if they've enabled disappearing messages

Oh yeah that feature which conveniently deletes your "Down with the " group and its member list every 60 minutes and forces users to create a new one.

Re: Telegram messaging app proves crucial to Belarus protests

#400

Post by brain5ide » Sat, Aug 22, 2020, 5:57 AM UTC

lrem wrote: post #332

Alupis wrote: post #284

Earlier quoted context omitted.

What we have here is a Sample, and in statistics (of which Polling is a discipline) you require a Randomized Sample of the Population before you can draw any meaningful conclusions. Telegram users are not going to pass any "Randomness" scrutiny. For all we know, Telegram User A asks Telegram User B to take the poll, etc. That's not random, and can introduce all sorts of statistical bias.

What kind of a statistical bias would explain having 1 million Belariusian phone numbers claiming having voted for a candidate, that officially received around 0.5 million votes total?

Adulthood necessary to vote could be one?