4 ms·
That way you can't know for sure what is happening all the times you aren't watching (maybe the client is coded with "use shitty encryption [when client receive
by askmike 11y ago
That way you can't know for sure what is happening all the times you aren't watching (maybe the client is coded with "use shitty encryption [when client receives message X from server / the year is 2016 / your message includes a word on a blacklist]").
In theory you could reverse engineer the binary (which is compiled code), this is how security firms try to understand malware (like stuxnet). But this is pretty hard to do.
- tptacek 11y agoYour ability to reverse engineer a binary isn't "theoretical", nor is it hard. These programs haven't been obfuscated. The hard part of evaluating cryptographic messaging services isn't binary reversing; it's that evaluating cryptographic constructions is hard. The flaw we're discussing today in Telegram is evident from the documentation, but despite the fact that every cryptographer who has commented on Telegram has had nothing but bad things to say about how it does crypto, nobody connected these particular dots. Crypto is hard. Next to crypto, reversing a program compiled with a normal compiler is just a speed bump.