3 ms·

I've read up a while ago on the questionable cryptography (not an expert in that at all myself) but couldn't find a lot of actual substance. Certainly with clai

I've read up a while ago on the questionable cryptography (not an expert in that at all myself) but couldn't find a lot of actual substance. Certainly with claims [0] [1] being that Telegram offers nice sums for breaking it, which gives me as a consumer the idea that someone who actually knows this stuff would love to hit that down, if it was something in my area of expertise offering that I'd love to try and hit it. I get that it might all be some kind of cheat, but an actual cryptography researcher publishing that it is would, obviously, get a lot of bad karma going in the HN circles (for example) about these contests. [0] https://telegram.org/blog/winter-contest-ends https://telegram.org/blog/winter-contest-ends [1] https://telegram.org/blog/cryptocontest-ends https://telegram.org/blog/cryptocontest-ends

ultramancool 11y ago
https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf
tptacek 11y ago
What have you read about the questionable cryptography in Telegram that you found unpersuasive? That's a better starting point, because the formulation you use here is often used on message boards to bait people into doing research work that is then dismissed. Your comment includes an assertion that there aren't substantial complaints about Telegram's security (there very much are, BTW). I think the onus is on you to defend that argument.
- janpieterz 11y ago
  You're absolutely right if my goal was to get people to post these papers, which reading back can easily be how it is interpreted. My point was more that, as a 'consumer' of this product without any background knowledge, their contests seem extremely convincing to the point of being slightly ridiculous. A 300,000 dollar bounty, while participants get quite some more access than they would normally get while attacking this system, gives me that feeling of it being actually quite secure, besides some possible attacks. If they're possible, if there are complaints, why can't they be made real and substantiated? My first post is indeed not delivering the message I intended, hope this one shows it better.
  - tptacek 11y ago
    This is one of the rare instances where me and Bruce Schneier agree unequivocally, so maybe you can just take Schneier's word for it --- remembering, when you do, that this happens so often in security that Schneier was moved to write a little article about it! https://www.schneier.com/crypto-gram/archives/1998/1215.html#contests https://www.schneier.com/crypto-gram/archives/1998/1215.html...
    - janpieterz 11y ago
      Thanks a lot, that was very insightful and exactly the kind of insight I was looking for. I think for me as an outsider it's really easy to fall for that trap, where certainly point 3 in his article was a realization that I would look at it the same way, perhaps spend a bit of time in my evenings on it but never spend, say, 3 months of research on the off chance that they might pay and that I might be the first winner/best winner, compared to a good (hourly) pay.
deleted 11y ago
[deleted]

ultramancool 11y ago

https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf

tptacek 11y ago

What have you read about the questionable cryptography in Telegram that you found unpersuasive? That's a better starting point, because the formulation you use here is often used on message boards to bait people into doing research work that is then dismissed. Your comment includes an assertion that there aren't substantial complaints about Telegram's security (there very much are, BTW). I think the onus is on you to defend that argument.

janpieterz 11y ago
You're absolutely right if my goal was to get people to post these papers, which reading back can easily be how it is interpreted. My point was more that, as a 'consumer' of this product without any background knowledge, their contests seem extremely convincing to the point of being slightly ridiculous. A 300,000 dollar bounty, while participants get quite some more access than they would normally get while attacking this system, gives me that feeling of it being actually quite secure, besides some possible attacks. If they're possible, if there are complaints, why can't they be made real and substantiated? My first post is indeed not delivering the message I intended, hope this one shows it better.
- tptacek 11y ago
  This is one of the rare instances where me and Bruce Schneier agree unequivocally, so maybe you can just take Schneier's word for it --- remembering, when you do, that this happens so often in security that Schneier was moved to write a little article about it! https://www.schneier.com/crypto-gram/archives/1998/1215.html#contests https://www.schneier.com/crypto-gram/archives/1998/1215.html...
  - janpieterz 11y ago
    Thanks a lot, that was very insightful and exactly the kind of insight I was looking for. I think for me as an outsider it's really easy to fall for that trap, where certainly point 3 in his article was a realization that I would look at it the same way, perhaps spend a bit of time in my evenings on it but never spend, say, 3 months of research on the off chance that they might pay and that I might be the first winner/best winner, compared to a good (hourly) pay.

deleted 11y ago

[deleted]