5 ms·
Eh, Telegram looks more insecure [1] AFAICT. Sure, Signal will not stand up to high threat models due to hardware failings (backdoored baseband RTOS, missing du
by moyta 10y ago
Eh, Telegram looks more insecure [1] AFAICT. Sure, Signal will not stand up to high threat models due to hardware failings (backdoored baseband RTOS, missing dual backup RTC batteries for secure boot) and software failings (insecure Android), about the only thing designed to be attacked like that is a terminal like a Pax S80 or a Verifone VX520 and they do a bunch of fun stuff with magnetic tamper sensors, conductive wires that tear on opening, heat sensors, etc.
Then again, that isn't the threat model Signal is designed for, and if you are looking to protect against that type of threat model you could totally design hardware to support it for not too much (see Blackphone) and throw Replicant on there (with some development of course). Then, if it were Signal vs Telegram, the latter would likely be your security weakness.
[1] - http://security.stackexchange.com/questions/130559/is-telegram-e2e-still-insecure http://security.stackexchange.com/questions/130559/is-telegr...
- tptacek 10y agoNot only is Telegram far less secure --- even when its opt-in(!) end-to-end messaging is enabled --- than Signal, but Reuters has reported that Iran has exploited some of its faults to hijack accounts and track activists. Don't use Telegram.
- Dolores12 10y agoSo Iran can claim 300k award for breaking telegram crypto, can it?
- MrMullen 10y agoThat reward is bullshit. Their requirements are so strict that no one could defeat it. If they did that same challenge in Iran, Iran would win the challenge and the reward.
- Dolores12 10y agowhat requirements are you talking about? https://telegram.org/blog/cryptocontest https://telegram.org/blog/cryptocontest https://core.telegram.org/contest300K https://core.telegram.org/contest300K
- antocv 10y agoAt least there is an opt-in while Signal doesnt even have an opt-out of Google/NSA. btw, Reuters is not a reliable source in these matters.
- tptacek 10y agoYou should be embarrassed to be repeating these falsehoods on this thread.
- def_true_false 10y agoYeah, using GCM to wake up the device is totally worse than sending 99% messages without end-to-end encryption. What's wrong with Reuters? Would you prefer RT?
- antocv 10y agoSignal is providing usage data to Google, it is not anonymous, the messages sent are available for Google to decrypt at wish. Telegram is open to Russian version of NSA, and the company that made it. For me and you both, it doesnt matter, unless you work for NSA.
- def_true_false 10y agoThis is false. See http://support.whispersystems.org/hc/en-us/articles/215843598-Why-GCM-Does-Google-see-my-messages- http://support.whispersystems.org/hc/en-us/articles/21584359...
- antocv 10y agoI didnt mean the messages are available to decrypt, that messages would hit GCM or that encryption methods are flawed or anything like that. More like, Google has root on your phone so it can steal your private keys any time.