Live data from Hacker News

The Most Backdoor-Looking Bug I’ve Ever Seen

buttondown.email

91–100 of 222 posts

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#91
post #7
post #4

Earlier quoted context omitted.

For me, chat history has a huge value. How many times things looks like meaningless when they are said but have a lot of values at a later date? For example, sometimes you wonder, "when was it that time when XXX event happened". Or "I remember that one day someone told me that he had the same problem as me, but who was it and what was his solution?" Otherwise, we are used to share thousands of links and snippets with…

Sure, but wouldn't you want to have control over these backups yourself? Not only do you get increased privacy from it, you also won't be in for a nasty surprise when the service decides to remove old logs/stop doing business.

So that explains why chat history has value in itself without just storing outside the important info on a given moment.

But sure, the best thing to deal with that is to be able to 'backup/export' your history and also being able open/import it in a usable form.

Whatsapp mostly fails on both topics. You can't easily backup, otherwise it would be stored in clear in google drive, in an area that is not even accessible to you.

And then it is a sqlite db with proprietary format for fields, so so far nothing can display it properly offline.

For telegram, they have a good export/backup feature.

I don't know of anytool that would allow to browse your history nicely when loaded offline from backups, but as the format is open, that should be doable.

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#93
> Anyway, it’s been a while, the world is a different place now, and maybe Hanlon’s razor cuts deeper than I thought.

I don't think people give credit for just how deep this actually does cut. On one project I worked on, which stored obscenely sensitive information, their product manager gave a speech about password security and told us he had a better algorithm than bcrypt. You couldn't explain why this was a bad idea - he wasn't taking feedback. When it landed, I found the botched the algorithm so this "sql injection detection code" basically changed every character to a ' mark. You just needed the right number in a password and it would always match. So I logged a bug, used it to push that they just use bcrypt, I got a big story about how he knows exactly what he was doing and he would fix the bug. It was "fixed" for a few days. Apparently what happened was, the developer didn't know how to use git properly and copied an older file on top the repo and brought the bug back. After it was known, disclosed, and every one was told it was fixed. The algorithm turned out to only handle a-z, and every other character was left in place. So I went though this again. Same speech about incredibly great design. They could have easily snuck a backdoor in because I never looked at 90% of the code, but this ongoing nonsense was 100% Hanlon's razor.

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#94
post #10

It's amazing to me that people still consider Telegram a legitimate contender in choosing a messenger. This blog post is far too charitable.

And it's amazing to me that any Telegram coverage on HN is met with extremely hostile reactions. All they did was not invent the best encryption in the world... like you, me, and 99.9% of the world. Mortal sin, right? So please stick to facts and what can be reasonably proven, please. The rest is meaningless noise and mindless hate. The author himself admits it's much more likely this was an amateurish mistake than s…

I don't think anybody's hating on the authors of Telegram - just that it's not one of the better options today.

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#95
post #86
post #71

Earlier quoted context omitted.

> Telegram does not encrypt most conversations, you cannot compare it to Signal. I wish people will stop repeating this nonsense. Just because they don't do end to end encryption by default, doesn't mean they don't encrypt, which implies messages are sent in plaintext. There are plenty of reasons why they did what they did, and these questions are all available publicly in their FAQ or the founder's Telegram channel.…

Do you really consider an "encrypted conversation" if you just do TLS to a central server that has everything in plaintext? Is Facebook Messaging encrypted messaging? Because that's the kind of thing we already had before this wave of apps and Telegram is marketed within this new wave but doesn't have any more security than what the previous wave already had, even if you trust their homegrown protocol.

Sending plaintext in a secure transport is not what they do either. They do have e2e encrypted secret chat on day one, and the ends are bound to the devices, so even if you login from your desktop app, you won't see the secret chats on your phone, unlike Signal.

Seriously, please educate yourself first.

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#96
post #92

> PitM attack I see we've arrived at the point where we're re-naming commonly established acronyms in order to remain politically correct.

Good. (At the risk of stating the obvious: Changing commonly established things is how progress works.)

Ok, I will bite.

Why is it good? What benefit does it achieve other than confusing people. It is also a good reminder that how things were before. One should not forget the past and things accomplished by many efforts. How is it different than 1984's newspeak or the idea of 'changing the history? Why not choose an approach similar to this (first link I found about Warner Bros' approach): https://twitter.com/stilkov/status/506324544177836032

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#97
post #92

> PitM attack I see we've arrived at the point where we're re-naming commonly established acronyms in order to remain politically correct.

Good. (At the risk of stating the obvious: Changing commonly established things is how progress works.)

The downside is the cost to communication. I didn't know what a PitM was. After a bit I guessed it was Person, i.e. man in the middle, but I wasn't sure that it didn't mean something else.

I'm not sure how big the gain is here. Are people really going to read "man in the middle" and assume that no woman could ever do this?

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#98
post #65

And obligatory reference to Backdoored Streebog cipher : https://eprint.iacr.org/2016/071 https://www.sstic.org/media/SSTIC2019/SSTIC-actes/RussianSty... The backdoor was hidden in the plain sight: the s-box was said to be randomly picked, but years long evasive answers of authors about cryptographic properties of the box made people to think that there was something really not right with it. If not for that specific…

This story is eerily reminiscient of the s-box in DES, except in that case there was no backdoor, the researchers had simply discovered a novel attack method, crafted their s-box to protect against that method, and then kept the attack unpublished for decades:

> The eight S-boxes of DES were the subject of intense study for many years out of a concern that a backdoor (a vulnerability known only to its designers) might have been planted in the cipher. The S-box design criteria were eventually published (in Coppersmith 1994) after the public rediscovery of differential cryptanalysis, showing that they had been carefully tuned to increase resistance against this specific attack. Biham and Shamir found that even small modifications to an S-box could significantly weaken DES.

https://en.wikipedia.org/wiki/S-box

Re: The Most Backdoor-Looking Bug I’ve Ever Seen

#100
post #80

If the dead comment by user ‘paveldurov’ is the actual Pavel Durov, then I just found extremely solid reasons never to go near Telegram. Yikes.

Where can we see this comment? Here at HN or the post itself? I could not see any comments with 'paveldurov'.
Post reply on HN