8 ms·

What a surprise, not. Many respected experts have criticised Telegram for implementing their own cryptography and using meaningless buzzwords, while also making

What a surprise, not. Many respected experts have criticised Telegram for implementing their own cryptography and using meaningless buzzwords, while also making encryption opt in. Telegram is clearly not a privacy-motivated platform and anyone who thinks so is deluding themselves. Even the closed source WhatsApp (uses ETE from the Signal guys) and iMessage are arguably less likely to contain cryptographic flaws than Telegram.

chinathrow 11y ago
I can't find any official statements by WA/FB that WhatsApp uses ETE. Do you have further sources aside from [1]? [1] http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/
- eggie 11y ago
  Why would they use ETE? Isn't the whole point of WA/FB to sell user-created data to third parties? Edit: Given the down vote(s), I guess I'm missing something obvious. What I'm getting at is this: If our activities were completely encrypted and we appeared anonymous to WA/FB they couldn't hope to make money. Would anyone smarter than me care to explain why this isn't the case?
  - eliteraspberrie 11y ago
    It's a good question. But I think the contents of their users' communications are less important for their revenues than the metadata.
    - eggie 11y ago
      Is there a description of this somewhere? (Such as in public filings.) Is the advertising so coarse as to ignore the content of what people say? Are they only propagating information about purchasing and browsing history through the metadata offered by the social network information in order to drive advertising? All the questions should suggest that I'm genuinely curious and looking to understand, so if you read this and get riled up, instead of downvoting please take twenty seconds to guide me to the truth...
newscracker 11y ago
> Even the closed source WhatsApp (uses ETE from the Signal guys) and iMessage are arguably less likely to contain cryptographic flaws than Telegram Even though you used the words "arguably less likely" to soften your statement, there's no way to check what WhatsApp or iMessage are doing because they're not open source. So even if security researchers want to look at the code or build their own clients, it's not possible. Reverse engineering is possible, but is tedious compared to having the source code. At least the Telegram client code is open source to support examining it. That said, the criticism of Telegram for using home brewed encryption is appropriate and needs to be mentioned often (hopefully Telegram will change the protocol). Even the authors of this paper state: > The take-home message (once again) is that well-studied, provably secure encryption schemes that achieve strong definitions of security (e.g., authenticated-encryption) are to be preferred to home-brewed encryption schemes.
- tptacek 11y ago
  There's "no way" to check what iMessage is doing?
  - cpach 11y ago
    I guess it’s possible on a jailbroken device. (Perhaps even on a non-jailbroken device…?)
    - chowells 11y ago
      All you need is to capture and view the traffic at the network level. You can easily do that off-device when using wifi.
      - askmike 11y ago
        That way you can't know for sure what is happening all the times you aren't watching (maybe the client is coded with "use shitty encryption [when client receives message X from server / the year is 2016 / your message includes a word on a blacklist]"). In theory you could reverse engineer the binary (which is compiled code), this is how security firms try to understand malware (like stuxnet). But this is pretty hard to do.
huskyr 11y ago
I'm saddened by this. I'm a heavy user of Telegram, and i think it's in many respects superior to WhatsApp and iMessage. The weird stance on cryptography is such a shame.
- newjersey 11y ago
  Please consider switching your team over to Signal. Or at least give it a try if you are on an iOS or an Android phone.
  - nicolapede 11y ago
    Any suggestion for Windows Phone 8 users?
    - newjersey 11y ago
      How recent is your device? Is it scheduled to get Windows 10? I'd say our best bet at this time is to push for a Universal Windows Platform app. How good is your C#?
      - nicolapede 11y ago
        I think quite good although I haven't tried to write anything in Universal Windows Platform yet. Sorry for the late reply.
eliteraspberrie 11y ago
WhatsApp encryption is broken. WhatsApp can just turn off encryption when they want, without users knowing: http://heise.de/-2630361 http://heise.de/-2630361 That's probably what happened in June: "Investigators said earlier they had detained 16 people in the anti-terror raids after working with U.S. authorities to monitor suspects' communications on WhatsApp Inc.'s messaging service." http://www.bloomberg.com/news/articles/2015-06-08/belgium-arrests-16-in-terror-raid-triggered-by-whatsapp-messages http://www.bloomberg.com/news/articles/2015-06-08/belgium-ar...

chinathrow 11y ago

I can't find any official statements by WA/FB that WhatsApp uses ETE. Do you have further sources aside from [1]? [1] http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/

eggie 11y ago
Why would they use ETE? Isn't the whole point of WA/FB to sell user-created data to third parties? Edit: Given the down vote(s), I guess I'm missing something obvious. What I'm getting at is this: If our activities were completely encrypted and we appeared anonymous to WA/FB they couldn't hope to make money. Would anyone smarter than me care to explain why this isn't the case?
- eliteraspberrie 11y ago
  It's a good question. But I think the contents of their users' communications are less important for their revenues than the metadata.
  - eggie 11y ago
    Is there a description of this somewhere? (Such as in public filings.) Is the advertising so coarse as to ignore the content of what people say? Are they only propagating information about purchasing and browsing history through the metadata offered by the social network information in order to drive advertising? All the questions should suggest that I'm genuinely curious and looking to understand, so if you read this and get riled up, instead of downvoting please take twenty seconds to guide me to the truth...

newscracker 11y ago

> Even the closed source WhatsApp (uses ETE from the Signal guys) and iMessage are arguably less likely to contain cryptographic flaws than Telegram Even though you used the words "arguably less likely" to soften your statement, there's no way to check what WhatsApp or iMessage are doing because they're not open source. So even if security researchers want to look at the code or build their own clients, it's not possible. Reverse engineering is possible, but is tedious compared to having the source code. At least the Telegram client code is open source to support examining it. That said, the criticism of Telegram for using home brewed encryption is appropriate and needs to be mentioned often (hopefully Telegram will change the protocol). Even the authors of this paper state: > The take-home message (once again) is that well-studied, provably secure encryption schemes that achieve strong definitions of security (e.g., authenticated-encryption) are to be preferred to home-brewed encryption schemes.

tptacek 11y ago
There's "no way" to check what iMessage is doing?
- cpach 11y ago
  I guess it’s possible on a jailbroken device. (Perhaps even on a non-jailbroken device…?)
  - chowells 11y ago
    All you need is to capture and view the traffic at the network level. You can easily do that off-device when using wifi.
    - askmike 11y ago
      That way you can't know for sure what is happening all the times you aren't watching (maybe the client is coded with "use shitty encryption [when client receives message X from server / the year is 2016 / your message includes a word on a blacklist]"). In theory you could reverse engineer the binary (which is compiled code), this is how security firms try to understand malware (like stuxnet). But this is pretty hard to do.

huskyr 11y ago

I'm saddened by this. I'm a heavy user of Telegram, and i think it's in many respects superior to WhatsApp and iMessage. The weird stance on cryptography is such a shame.

newjersey 11y ago
Please consider switching your team over to Signal. Or at least give it a try if you are on an iOS or an Android phone.
- nicolapede 11y ago
  Any suggestion for Windows Phone 8 users?
  - newjersey 11y ago
    How recent is your device? Is it scheduled to get Windows 10? I'd say our best bet at this time is to push for a Universal Windows Platform app. How good is your C#?
    - nicolapede 11y ago
      I think quite good although I haven't tried to write anything in Universal Windows Platform yet. Sorry for the late reply.

eliteraspberrie 11y ago

WhatsApp encryption is broken. WhatsApp can just turn off encryption when they want, without users knowing: http://heise.de/-2630361 http://heise.de/-2630361 That's probably what happened in June: "Investigators said earlier they had detained 16 people in the anti-terror raids after working with U.S. authorities to monitor suspects' communications on WhatsApp Inc.'s messaging service." http://www.bloomberg.com/news/articles/2015-06-08/belgium-arrests-16-in-terror-raid-triggered-by-whatsapp-messages http://www.bloomberg.com/news/articles/2015-06-08/belgium-ar...