61–70 of 138 posts
Earlier quoted context omitted.
With respect, at first glance it seems that way. The burden of proof lies with the claim to security, not the claim of insecurity.
The contest actually puts the burden of proof on the "claim of insecurity" side.
Earlier quoted context omitted.
So you didn't understand the article here then? There's no shame on that, crypto is complex and requires study. But please don't dismiss well written and well thought-out critiques like this one just because you didn't understand the arguments.
Oh, wow, and people complain about Telegram team's attitude. Don't be so vulnerable, please. Take the critics easy. As for the article, it's well written, but most of the points had been answered in Telegram FAQ or comments on HN. And yet they come up again and again. Not all, most.
I'm not sure what you mean by this as I'm not the author, so you haven't criticised anything I've said.
>> As for the article, it's well written, but most of the points had been answered in Telegram FAQ or comments on HN. And yet they come up again and again. Not all, most.
Not adequately, hence the well written deconstruction by the post author.
I'm going to echo what I've seen in another post - you appear to be a Telegram cheerleader with a brand new account, are you associated with them at all?
Or if its vulnerable to a MITM, then explain how.
Or if its vulnerable to chosen plaintext/ciphertext or known plaintest, explain how.
There has been so much piling on of telegram, but nobody has actually proven any problems with their code or protocol. Meanwhile telegram is trying to do the right thing by being open source and taking the time to respond here and elsewhere to misconceptions and criticisms about them.
I really don't get the hostility towards them so far.
Earlier quoted context omitted.
Alright, haters is probaby a too strong term. TextSecure team pointed out flaws in the first topic about Telegram on HN and these flaws were answered by Telegram team: they updated FAQ, they commented in twitter and here on HN. Every post with Telegram's flaws explicitly mentions TextSecure as an alternative, and that is suspicious - they seem to find it a great way to get publicity.
So are you associated with telegram, just to be clear?
Come on guys we can make this a thing...like the Twilight series.
Earlier quoted context omitted.
Yesterday's article A Crypto Challenge For The Telegram Developers was a good analysis on why Telegram's challenge fails to prove anything.
Sadly, it was probably too technical for most potential users to be swayed much by it. We need focused talking points, e.g. the fact that the NSA and other governments vacuum up all your data, and that TextSecure represents the first step toward a future in which it's very difficult for governments to do that. Whereas with Telegram, it's just as easy for them to access your conversations as it is for them to bypass S…
No we don't. At least not for your goal of:
an article that succinctly conveys to potential users why Telegram is snakeoil and why TextSecure is the real deal
There is no way to convey this with better rhetoric because the proof is in the technical detail, the party that is wrong can just ramp theirs rhetoric up too. If you don't dig into that detail, it just becomes a he said/she said argument that no observers can judge on merit. Those discussion relies on the participants to be knowledgeable, and politely acknowledge when they're out of their depth technically or just plain wrong. But there is nothing to enforce that, see any Hacker News discussion about something that isn't web development or devops.
The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (see contest FAQ: http://core.telegram.org/contestfaq ). Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to ch…
Why isn't end-to-end encryption enabled by default? Why is not having end-to-end encryption an option at all?
The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (see contest FAQ: http://core.telegram.org/contestfaq ). Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to ch…
Earlier quoted context omitted.
Alright, haters is probaby a too strong term. TextSecure team pointed out flaws in the first topic about Telegram on HN and these flaws were answered by Telegram team: they updated FAQ, they commented in twitter and here on HN. Every post with Telegram's flaws explicitly mentions TextSecure as an alternative, and that is suspicious - they seem to find it a great way to get publicity.
So are you associated with telegram, just to be clear?
I totally understand what Telegram critics are saying, but in every article there's always a note "Please use TextSecure, don't use Telegram". By how it looks, it seems to be a way to market TextSecure and not to discover Telegram's security flaws. And critics rarely respond to Telegram team's comments where they say that the claims are wrong.
The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (see contest FAQ: http://core.telegram.org/contestfaq ). Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to ch…
(Did he really just argue that sha1 isn't broken? ohmy)
The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (see contest FAQ: http://core.telegram.org/contestfaq ). Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to ch…
Right, but you still include the sha-1 of the plaintext in your outgoing message, which is (IIRC) generally considered bad practice because it leaks information about the plaintext.