5 ms·
All you need is to capture and view the traffic at the network level. You can easily do that off-device when using wifi.
by chowells 11y ago
All you need is to capture and view the traffic at the network level. You can easily do that off-device when using wifi.
- askmike 11y agoThat way you can't know for sure what is happening all the times you aren't watching (maybe the client is coded with "use shitty encryption [when client receives message X from server / the year is 2016 / your message includes a word on a blacklist]"). In theory you could reverse engineer the binary (which is compiled code), this is how security firms try to understand malware (like stuxnet). But this is pretty hard to do.
- tptacek 11y agoYour ability to reverse engineer a binary isn't "theoretical", nor is it hard. These programs haven't been obfuscated. The hard part of evaluating cryptographic messaging services isn't binary reversing; it's that evaluating cryptographic constructions is hard. The flaw we're discussing today in Telegram is evident from the documentation, but despite the fact that every cryptographer who has commented on Telegram has had nothing but bad things to say about how it does crypto, nobody connected these particular dots. Crypto is hard. Next to crypto, reversing a program compiled with a normal compiler is just a speed bump.
- nickpsecurity 11y agoThat's not enough. The keys could be distributed later when it's not obvious. System or network timing channels can be used. Subversion is a very difficult problem to deal with. Having the source code is a start on it. Not having the source code is a no-go for trustworthiness if malicious insiders exist.