4 ms·

Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 Because both are Web versions, I'd rate Wha

by homakov 10y ago

Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 Because both are Web versions, I'd rate Whatsapp one as 6/10 severity and (due to how hard it is to trick the user) Telegram as 3/10. Don't have stats but given how inconvenient Web versions are, I don't think they are widely used.

zulln 10y ago
I would say more people use WhatsApp Web than Telegram (percent, not absolute numbers). Telegram does have a desktop client, while WhatsApp Web is the only choice if you want to reply to something from your desktop (taken third-parties aside).
- homakov 10y ago
  Then, I'd up it to 8/10! I use Telegram for macOS, it's much nicer.
- donatzsky 10y ago
  WhatsApp does actually have a desktop client. It's nothing spectacular, but works well enough.
mkagenius 10y ago
> Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 How is it that the explanation from companies come only after the researchers writes a blog? Why can't they disclose the bug themselves (if it had been fixed).
- homakov 10y ago
  In Telegram case, the bug is really a minor severity. Unpopular client, hard to phish scenario. It's only in checkmark's interest to overhype the issue.
  - mkagenius 10y ago
    I agree but Telegram's tone seem like they are unhackable, and they have checked for all possible scenarios and the mentioned scenario was overlooked as they had left only minor issues overlooked. They will feel the heat when an easy to exploit scenario comes up. I hope they own it properly before researchers publishes it.
    - homakov 10y ago
      How would you behave when someone finds hard to exploit XSS in rarely used Web client and tries to hype out yet another "completely hacked" story? I would have same annoyed tone too.
      - mkagenius 10y ago
        All this could have been avoided, had Telegram published the blog first. It's a common problem of companies not owning the vulnerabilities found in them and its understandable that they get scared owning them. But when it eventually comes out, they should talk like "yeah, there was silly xss not a big deal as the author said it to be, but yeah its there". That's it. There is no need to say "researcher wants PR" and "researcher is irresponsible".
morsch 10y ago
Don't have stats but given how inconvenient Web versions are, I don't think they are widely used. ... said the standalone email program developer, ca 2005. Couldn't find any numbers for Telegram, but in 2015 the number of WhatsApp Web users was reported[1] to be 200 million, which seems like a lot of people. Most of them probably aren't aware a desktop version exists, nor would they care. [1] http://www.ibtimes.com/whatsapp-web-security-bug-puts-200-million-users-risk-2088418 http://www.ibtimes.com/whatsapp-web-security-bug-puts-200-mi... in articles about a very similar WhatsApp Web bug, also found by Checkpoint. They don't bother to give a verifiable reference for the 200 million, fwiw.
- homakov 10y ago
  Telegram web doesn't support so called secret chats - good reason to use a native client. No idea about whatsapp.
  - ryanlol 10y ago
    Whatsapp web is super difficult to use. It requires your phone to be in your hand every time you start using it, your phone must also remain on and connected to the internet.
    - morsch 10y ago
      That's incorrect. You need your phone to log in, but you only have to sign in once per browser. (I assume sessions time out at some point. You can also invalidate existing sessions in the app.) It's correct that the phone does have to be online while you're using it. But at least you don't lose encryption. Somehow, Signal's web-based client manages to do e2e without that requirement; maybe there's a non-technical reason why WhatsApp does it the way they do.

by homakov 10y ago

zulln 10y ago

I would say more people use WhatsApp Web than Telegram (percent, not absolute numbers). Telegram does have a desktop client, while WhatsApp Web is the only choice if you want to reply to something from your desktop (taken third-parties aside).

homakov 10y ago
Then, I'd up it to 8/10! I use Telegram for macOS, it's much nicer.
donatzsky 10y ago
WhatsApp does actually have a desktop client. It's nothing spectacular, but works well enough.

mkagenius 10y ago

> Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 How is it that the explanation from companies come only after the researchers writes a blog? Why can't they disclose the bug themselves (if it had been fixed).

homakov 10y ago
In Telegram case, the bug is really a minor severity. Unpopular client, hard to phish scenario. It's only in checkmark's interest to overhype the issue.
- mkagenius 10y ago
  I agree but Telegram's tone seem like they are unhackable, and they have checked for all possible scenarios and the mentioned scenario was overlooked as they had left only minor issues overlooked. They will feel the heat when an easy to exploit scenario comes up. I hope they own it properly before researchers publishes it.
  - homakov 10y ago
    How would you behave when someone finds hard to exploit XSS in rarely used Web client and tries to hype out yet another "completely hacked" story? I would have same annoyed tone too.
    - mkagenius 10y ago
      All this could have been avoided, had Telegram published the blog first. It's a common problem of companies not owning the vulnerabilities found in them and its understandable that they get scared owning them. But when it eventually comes out, they should talk like "yeah, there was silly xss not a big deal as the author said it to be, but yeah its there". That's it. There is no need to say "researcher wants PR" and "researcher is irresponsible".

morsch 10y ago

Don't have stats but given how inconvenient Web versions are, I don't think they are widely used. ... said the standalone email program developer, ca 2005. Couldn't find any numbers for Telegram, but in 2015 the number of WhatsApp Web users was reported[1] to be 200 million, which seems like a lot of people. Most of them probably aren't aware a desktop version exists, nor would they care. [1] http://www.ibtimes.com/whatsapp-web-security-bug-puts-200-million-users-risk-2088418 http://www.ibtimes.com/whatsapp-web-security-bug-puts-200-mi... in articles about a very similar WhatsApp Web bug, also found by Checkpoint. They don't bother to give a verifiable reference for the 200 million, fwiw.

homakov 10y ago
Telegram web doesn't support so called secret chats - good reason to use a native client. No idea about whatsapp.
- ryanlol 10y ago
  Whatsapp web is super difficult to use. It requires your phone to be in your hand every time you start using it, your phone must also remain on and connected to the internet.
  - morsch 10y ago
    That's incorrect. You need your phone to log in, but you only have to sign in once per browser. (I assume sessions time out at some point. You can also invalidate existing sessions in the app.) It's correct that the phone does have to be online while you're using it. But at least you don't lose encryption. Somehow, Signal's web-based client manages to do e2e without that requirement; maybe there's a non-technical reason why WhatsApp does it the way they do.