Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram - secure, free messaging

telegram.org

Post reply on HN
Print view View original

41–50 of 231 posts

Re: Telegram - secure, free messaging

#41

Post by egeozcan »

dchest wrote: post #29
egeozcan wrote: post #11

Earlier quoted context omitted.

I also don't get this. If we stopped trusting HTTPS, how are we supposed to make sure that we get an unmodified app from the play store, or the original source code from GitHub in the first place? Am I missing something?

The fact that we have to trust TLS to deliver software doesn't automatically mean that we should trust it for secure messaging. Also, I think App Store software delivery doesn't depend on only TLS, but also on Apple's signature. And you can visually verify that the source code downloaded from GitHub doesn't contain backdoors.

My knowledge on cryptography is next to nothing. Would you mind explaining to me what makes the case for secure messaging different than any other transfer through a secured HTTP connection? I also read a bit on OTR Messaging and the "Socialist Millionaires' Protocol" but just got even more confused.

Re: Telegram - secure, free messaging

#45

Post by kitd »

sillysaurus2 wrote: post #33
yurylifshits wrote: post #25

Earlier quoted context omitted.

MTProto's author is Nikolai Durov: http://en.wikipedia.org/wiki/Nikolai_Durov He is one of most legendary math/programming champions of all time.

He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refac…

You are correct to be wary. However, the MTProto java impl is here: https://github.com/ex3ndr/telegram-mt

Re: Telegram - secure, free messaging

#48

Post by sillysaurus2 »

kitd wrote: post #45
sillysaurus2 wrote: post #33

Earlier quoted context omitted.

He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refac…

You are correct to be wary. However, the MTProto java impl is here: https://github.com/ex3ndr/telegram-mt

Interesting. Some observations:

TextSecure has been a work in progress for two years: https://github.com/WhisperSystems/TextSecure/commits/master?...

Telegram seems to have been in progress for two months: https://github.com/ex3ndr/telegram-mt/commits/master?page=2

Telegram also seems to be the work of a single author. While TextSecure was written mostly by Moxie, there were several other contributing members.

Re: Telegram - secure, free messaging

#49

Post by techquery »

conroy wrote: post #3

The important thing to remember is that all Telegram messages are always securely encrypted. The difference between messages in Secret Chats and ordinary Telegram messages is in the encryption type: client-client in case of Secret Chats, client-server/server-client for ordinary chats. Where "securely encrypted" means that the Telegram server has full access to message contents for ordinary chats. All chats should be…

I guess, that the problem is in encryption key exchange. Cloud chats are easy to synchronize between devices. Secret chats require unique encryption key for each chat.

Re: Telegram - secure, free messaging

#50

Post by digitalengineer »

sillysaurus2 wrote: post #33
yurylifshits wrote: post #25

Earlier quoted context omitted.

MTProto's author is Nikolai Durov: http://en.wikipedia.org/wiki/Nikolai_Durov He is one of most legendary math/programming champions of all time.

He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refac…

To bad there's no iOS app.
Post reply on HN