3 ms·
I don't have skin in this game, but I want to mention that contests are not evidence of security. Furthermore, cryptographers other than those working at Signal
by dsacco 10y ago
I don't have skin in this game, but I want to mention that contests are not evidence of security. Furthermore, cryptographers other than those working at Signal have expressed distrust for its security.[1][2]
What Telegram should do to earn the trust of the technical community (specifically, the security savvy people who criticize it for unorthodox encryption methodologies), is contract a real audit from a leading security firm that specializes in cryptanalysis, like Riscure.
[1]: https://twitter.com/matthew_d_green/status/726428912968982529 https://twitter.com/matthew_d_green/status/72642891296898252...
[2]: https://news.ycombinator.com/item?id=9775080 https://news.ycombinator.com/item?id=9775080
- hueving 10y ago>is contract a real audit from a leading security firm Suggestions like this do nothing to dispell the image that modern security firms are little more than a protection racket. If you don't pay for "an audit" from an "industry leading" firm, you'll be shunned by everyone.
- ethbro 10y agoWhat's your alternative suggestion?
- Jtsummers 10y agoYou pay for an audit, or you release the code/algorithms for the community to publicly audit. Otherwise, you're just making claims that are unbacked by anything. Presumably only the fact that there hasn't, yet, been a public exploit. But that's not a useful metric.