21 ms·

>"It would be naive to think you can run an independent/secure cryptoapp based in the US." This seems to be a shot at WhatsApp and Signal, implying that they h

by otalp 9y ago

>"It would be naive to think you can run an independent/secure cryptoapp based in the US." This seems to be a shot at WhatsApp and Signal, implying that they have loopholes that allow the FBI to snoop in. I'm not sure how true that is. This might be an attempt to deflect from the fact that Telegram uses a home-baked encryption protocol which might be insecure, while WhatsApp uses the OWS protocol.

retox 9y ago
If I'm not mistaken Telegram has already been proven insecure once in the past. WhatsApp is a zuck property now, you can consider it insecure.
- deleted 9y ago
  [deleted]
- dymk 9y ago
  > WhatsApp is a zuck property now, you can consider it insecure. Another day on HN...
- Dolores12 9y ago
  when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?
  - narrowrail 9y ago
    Many prominent and respected HNers have laid out the case for why Telegram has security issues. If you use the search function at the bottom, you will easily find these issues raised. I don't personally possess the knowledge to determine the soundness of Telegram's crypto, but there have been enough red flags raised on HN over the years to merit skepticism.
    - Dolores12 9y ago
      Is that how you prove something - by reading comments on HN? Oh, how about all these red flags are raised to scare people to not let them use Telegram which is really secure?
      - WillyOnWheels 9y ago
        > Is that how you prove something - by reading comments on HN? I enjoy the comments of tpacek and ryanlol
        Dolores12 9y ago
        I don't think you answered my question.
        WillyOnWheels 9y ago
        I don't base my life on them but I think tpacek and ryanlol know more about computer security than I do.
    - RodericDay 9y ago
      tbh, people like tptacek and his buddies have a clear agenda and attitude of their own. I'm definitely not sated by their pronouncements alone.
      - daxorid 9y ago
        While I absolutely agree with you about the "tptacek & friends" agenda, that really has no bearing whatsoever on the actual problems they've raised with MTProto, their weird KDF, and IGE in general. Whenever one can consider a person's arguments in isolation from your opinion of said person, it's wise to do so. This is one of those opportunities.
        tanderson92 9y ago
  - notheguyouthink 9y ago
    I think he's spreading a lie.. based on what I've seen, at least. It's a not yet proven secure protocol, is the worst you can say against it I believe. I'm not a security guy mind you, I'm just parroting what I keep seeing. Rightfully so, lack of deep audit is a very valid reason to worry. Yet, worry and untrusted is vastly different than actively exploitable / broken.
    - roywiggins 9y ago
      Encryption should probably be considered broken until demonstrated otherwise.
      - memmcgee 9y ago
        By that logic all encryption is broken.
  - bascule 9y ago
    Their homebrew crypto seems very shaky: https://cs.au.dk/~jakjak/master-thesis.pdf https://cs.au.dk/~jakjak/master-thesis.pdf https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf tl;dr: they tried to use SHA-1 as a MAC. This is something of a crypto 101 mistake. Had they even used HMAC they'd be in much better shape. Worse, even after this was pointed out to them and people started writing papers about potential attacks, they have stood by their shaky design, refusing to update it or even admit mistakes were made in the initial design. But even worse than that, end-to-end encryption is off-by-default, and users must opt into it. Why? https://telegram.org/faq#q-why-not-just-make-all-chats-secret https://telegram.org/faq#q-why-not-just-make-all-chats-secre... "This allows Telegram to be widely adopted in broad circles, not just by activists and dissidents, so that the simple fact of using Telegram does not mark users as targets for heightened surveillance in certain countries. We are convinced that the separation of conversations into Cloud and Secret chats represents the most secure solution currently possible for a massively popular messaging application." Putting aside the fact that if Telegram's cryptography were properly implemented, an outside observer shouldn't be able to tell whether or not end-to-end encryption is being used or not (i.e. Telegram does not provide proper separation of data-at-rest versus data-in-motion), this seems to be the "I don't need encryption because I have nothing to hide" argument, but perpetrated by what's allegedly supposed to be a secure messenger. The real reason why Telegram doesn't enable end-to-end encryption is pretty clear: they don't have the features to provide a good end-to-end encryption experience: They don't support end-to-end encrypted group chats. They don't have encrypted backups like Signal and WhatsApp.
    - ycmbntrthrwaway 9y ago
      > But even worse than that, end-to-end encryption is off-by-default, and users must opt into it. Why? Because it is unusable. It has no synchronization between devices, only 1 device to 1 device. And if you accidentally closed the chat, you have to verify it again. You can't store trusted key fingerprint. It is not suitable for mobile devices. Secure chats are like OTR, but with bad crypto. Signal and WhatsApp are the same protocol as OMEMO, originally designed for Signal. > so that the simple fact of using Telegram does not mark users as targets for heightened surveillance in certain countries And yet Telegram is associated with terrorism more that, e.g., WhatsApp.
- toephu2 9y ago
  Why? Do you have any proof WhatsApp is insecure?
  - ams6110 9y ago
    I think the question should be do we have proof that it is secure?
    - moosingin3space 9y ago
      Moxie Marlinspike's reputation is dependent on his ability to deliver a secure product. Signal/Signal Protocol development is funded by donations and grants from groups like the Freedom of the Press Foundation, EFF, etc, and those groups desire a secure messaging product. Moxie has staked his reputation on WhatsApp's implementation of the Signal Protocol multiple times on the OWS blog, which he would not do if he disapproved of WhatsApp's implementation. There's no hard proof (except what can be gained through analysis of the executables), but there's no incentive for Moxie to lie, therefore, WhatsApp's implementation should be reasonably secure.
      - vkazanov 9y ago
        And you call that a proof? :-)
        moosingin3space 9y ago
        I did say "there's no hard proof". This was purely an analysis of incentives.
        vkazanov 9y ago
        I think "speculation" is a better word here. :-)
  - snakeanus 9y ago
    Yes https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935
ghughes 9y ago
Bingo. The CEO of Telegram likes to spread conspiracy theories that are good for business. In a recent tweet he claimed that Signal is "funded by the US government", [1] citing a ridiculous hit piece on OWS and Moxie. [2] [1] https://twitter.com/durov/status/872891017418113024 https://twitter.com/durov/status/872891017418113024 [2] https://surveillancevalley.com/blog/government-backed-privacy-tools-are-not-going-to-protect-us-from-president-trump https://surveillancevalley.com/blog/government-backed-privac...
- BoumTAC 9y ago
  Even wikipedia say it's founded by the governement ... As of October 2016, the project has received an unknown amount of donations from individual sponsors via the Freedom of the Press Foundation.[100] Open Whisper Systems has received grants from the Knight Foundation,[101] the Shuttleworth Foundation,[102] and the Open Technology Fund,[103] a U.S. government funded program that has also supported other privacy projects like the anonymity software Tor and the encrypted instant messaging app Cryptocat. https://en.wikipedia.org/wiki/Signal_(software) https://en.wikipedia.org/wiki/Signal_(software)
  - heartsucker 9y ago
    Funded by the government != The government has their hands all over it
    - gambiting 9y ago
      Even TOR was originally a government funded project
      - aluhut 9y ago
        Even "the Internet" was originally a government funded project
        akerro 9y ago
fossuser 9y ago
You can read about the court filings [1] for Whatsapp metadata (unencrypted), but the actual text communication from Whatsapp is secure - or at least not returned by subpoena. I think Signal doesn't even have the metadata available, but I'm not sure about that. [1] (Horrible Forbes Link) https://www.forbes.com/sites/thomasbrewster/2017/01/22/whatsapp-facebook-backdoor-government-data-request/print/ https://www.forbes.com/sites/thomasbrewster/2017/01/22/whats...
- r3bl 9y ago
  Someone already tried requesting data about two suspects from Whisper Systems. What they got is "one number is not a Signal user, while the second one created his account on X day at Y time."[0] So yeah, Signal doesn't retain metadata. All they can provide is whether you're using Signal or not and when you've started using it. [0] https://whispersystems.org/bigbrother/eastern-virginia-grand-jury/ https://whispersystems.org/bigbrother/eastern-virginia-grand...
mtgx 9y ago
I agree that it's somewhat a deflection, too, and I wish the Telegram team wasn't so stubborn about at least studying the Signal protocol and perhaps making its own version, if it doesn't trust it by default. I don't know if their "math Ph.Ds" would know how to do that, though. That said, I think it's pretty clear that WhatsApp does have a way to allow the FBI to snoop on users: https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... I know it's controversial and many don't believe WhatsApp would actually use it like that, but I don't buy it. Either they already use that "feature" as a legal intercept or they're about to do it at least in the UK, where Snoopers' Charter passed and the law is vague enough to force them to do something like that. It may happen in Australia, too, if the new anti-crypto bill passes. I still trust Signal for now, but I'm not sure whether or not their server-based solution will be so backdoor-proof against future bills, and I think they should be prioritizing decentralizing Signal somehow. EDIT: Sigh, Germany, too: http://fortune.com/2017/06/14/germany-fingerprint-children-spy-messages/ http://fortune.com/2017/06/14/germany-fingerprint-children-s...
permanentdecaf 9y ago
Pavel Durov wants everyone to think security is about trust in people. Most companies in that business do the same, because it's easier than building something that doesn't require trust in people. The way Pavel Durov and others like him present "trust" is (ironically) shady corporate structures[1], shell companies, or use of the word "Switzerland." They want people to think like that because they've built businesses that require it. Telegram stores the messages you send/receive unencrypted on their servers. That's not good, unless you've been trained to think that "privacy" is just about choosing the company, government, or legal jurisdiction that gets total access to your data. Security professionals know that's not how we should think about security (never trust people!), because Durov is leaving a lot out: there aren't safe jurisdictions, servers get hacked, and centralized databases will get compromised. Logic, though, is probably no match for conspiracy theories. 1: https://www.washingtonpost.com/news/the-intersect/wp/2015/11/23/the-secret-american-origins-of-telegram-the-encrypted-messaging-app-favored-by-the-islamic-state/ https://www.washingtonpost.com/news/the-intersect/wp/2015/11...
- skinnymuch 9y ago
  I read the WP article you cited, titled, "The secret American origins of Telegram, the encrypted messaging app favored by the Islamic State". If Telegram isn't that secure, then why are extremists like IS using it over Signal or WhatsApp? I know Telegram has better features for big groups and much better multi-platform support, so is that the reason? I'm legitimately asking without any snark.
  - kasey_junk 9y ago
    Because they have fallen for the marketing hype and are not secure messaging systems experts? We know some extremists still use SMS which is definitely not secure. Also, is there evidence that extremists aren't using Signal and WhatsApp?
    - skinnymuch 9y ago
      Them falling for the marketing makes sense.
deleted 9y ago
[deleted]
borncrusader 9y ago
Indeed, looks like a shot at Signal. I was under the impression that Signal is much secure than WhatsApp at least in terms of getting away from the prying eyes of Facebook. In reality both of them use the Whisper protocol underneath AFAICT for end-point encryption.
yogthos 9y ago
Even if the protocol is mathematically sound, there is no way to verify that it's implemented faithfully by closed source software such as WhatsApp. Telegram protocol is open and has an open source reference client. While not as good as having both the server and the client open source, at least it allows independent verification that the protocol is being implemented faithfully.
dingo_bat 9y ago
How do we know what WhatsApp uses? And do they use it in a secure way?

by otalp 9y ago

retox 9y ago

If I'm not mistaken Telegram has already been proven insecure once in the past. WhatsApp is a zuck property now, you can consider it insecure.

deleted 9y ago
[deleted]
dymk 9y ago
> WhatsApp is a zuck property now, you can consider it insecure. Another day on HN...
Dolores12 9y ago
when telegram has been proven insecure? in every topic about telegram people keep saying telegram is not secure. i failed to find info about how insecure their secure chats. maybe you can help me?
- narrowrail 9y ago
  Many prominent and respected HNers have laid out the case for why Telegram has security issues. If you use the search function at the bottom, you will easily find these issues raised. I don't personally possess the knowledge to determine the soundness of Telegram's crypto, but there have been enough red flags raised on HN over the years to merit skepticism.
  - Dolores12 9y ago
    Is that how you prove something - by reading comments on HN? Oh, how about all these red flags are raised to scare people to not let them use Telegram which is really secure?
    - WillyOnWheels 9y ago
      > Is that how you prove something - by reading comments on HN? I enjoy the comments of tpacek and ryanlol
      - Dolores12 9y ago
        I don't think you answered my question.
        WillyOnWheels 9y ago
        I don't base my life on them but I think tpacek and ryanlol know more about computer security than I do.
  - RodericDay 9y ago
    tbh, people like tptacek and his buddies have a clear agenda and attitude of their own. I'm definitely not sated by their pronouncements alone.
    - daxorid 9y ago
      While I absolutely agree with you about the "tptacek & friends" agenda, that really has no bearing whatsoever on the actual problems they've raised with MTProto, their weird KDF, and IGE in general. Whenever one can consider a person's arguments in isolation from your opinion of said person, it's wise to do so. This is one of those opportunities.
      - tanderson92 9y ago
- notheguyouthink 9y ago
  I think he's spreading a lie.. based on what I've seen, at least. It's a not yet proven secure protocol, is the worst you can say against it I believe. I'm not a security guy mind you, I'm just parroting what I keep seeing. Rightfully so, lack of deep audit is a very valid reason to worry. Yet, worry and untrusted is vastly different than actively exploitable / broken.
  - roywiggins 9y ago
    Encryption should probably be considered broken until demonstrated otherwise.
    - memmcgee 9y ago
      By that logic all encryption is broken.
- bascule 9y ago
  Their homebrew crypto seems very shaky: https://cs.au.dk/~jakjak/master-thesis.pdf https://cs.au.dk/~jakjak/master-thesis.pdf https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf tl;dr: they tried to use SHA-1 as a MAC. This is something of a crypto 101 mistake. Had they even used HMAC they'd be in much better shape. Worse, even after this was pointed out to them and people started writing papers about potential attacks, they have stood by their shaky design, refusing to update it or even admit mistakes were made in the initial design. But even worse than that, end-to-end encryption is off-by-default, and users must opt into it. Why? https://telegram.org/faq#q-why-not-just-make-all-chats-secret https://telegram.org/faq#q-why-not-just-make-all-chats-secre... "This allows Telegram to be widely adopted in broad circles, not just by activists and dissidents, so that the simple fact of using Telegram does not mark users as targets for heightened surveillance in certain countries. We are convinced that the separation of conversations into Cloud and Secret chats represents the most secure solution currently possible for a massively popular messaging application." Putting aside the fact that if Telegram's cryptography were properly implemented, an outside observer shouldn't be able to tell whether or not end-to-end encryption is being used or not (i.e. Telegram does not provide proper separation of data-at-rest versus data-in-motion), this seems to be the "I don't need encryption because I have nothing to hide" argument, but perpetrated by what's allegedly supposed to be a secure messenger. The real reason why Telegram doesn't enable end-to-end encryption is pretty clear: they don't have the features to provide a good end-to-end encryption experience: They don't support end-to-end encrypted group chats. They don't have encrypted backups like Signal and WhatsApp.
  - ycmbntrthrwaway 9y ago
    > But even worse than that, end-to-end encryption is off-by-default, and users must opt into it. Why? Because it is unusable. It has no synchronization between devices, only 1 device to 1 device. And if you accidentally closed the chat, you have to verify it again. You can't store trusted key fingerprint. It is not suitable for mobile devices. Secure chats are like OTR, but with bad crypto. Signal and WhatsApp are the same protocol as OMEMO, originally designed for Signal. > so that the simple fact of using Telegram does not mark users as targets for heightened surveillance in certain countries And yet Telegram is associated with terrorism more that, e.g., WhatsApp.
toephu2 9y ago
Why? Do you have any proof WhatsApp is insecure?
- ams6110 9y ago
  I think the question should be do we have proof that it is secure?
  - moosingin3space 9y ago
    Moxie Marlinspike's reputation is dependent on his ability to deliver a secure product. Signal/Signal Protocol development is funded by donations and grants from groups like the Freedom of the Press Foundation, EFF, etc, and those groups desire a secure messaging product. Moxie has staked his reputation on WhatsApp's implementation of the Signal Protocol multiple times on the OWS blog, which he would not do if he disapproved of WhatsApp's implementation. There's no hard proof (except what can be gained through analysis of the executables), but there's no incentive for Moxie to lie, therefore, WhatsApp's implementation should be reasonably secure.
    - vkazanov 9y ago
      And you call that a proof? :-)
      - moosingin3space 9y ago
        I did say "there's no hard proof". This was purely an analysis of incentives.
        vkazanov 9y ago
        I think "speculation" is a better word here. :-)
- snakeanus 9y ago
  Yes https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935

ghughes 9y ago

Bingo. The CEO of Telegram likes to spread conspiracy theories that are good for business. In a recent tweet he claimed that Signal is "funded by the US government", [1] citing a ridiculous hit piece on OWS and Moxie. [2] [1] https://twitter.com/durov/status/872891017418113024 https://twitter.com/durov/status/872891017418113024 [2] https://surveillancevalley.com/blog/government-backed-privacy-tools-are-not-going-to-protect-us-from-president-trump https://surveillancevalley.com/blog/government-backed-privac...

BoumTAC 9y ago
Even wikipedia say it's founded by the governement ... As of October 2016, the project has received an unknown amount of donations from individual sponsors via the Freedom of the Press Foundation.[100] Open Whisper Systems has received grants from the Knight Foundation,[101] the Shuttleworth Foundation,[102] and the Open Technology Fund,[103] a U.S. government funded program that has also supported other privacy projects like the anonymity software Tor and the encrypted instant messaging app Cryptocat. https://en.wikipedia.org/wiki/Signal_(software) https://en.wikipedia.org/wiki/Signal_(software)
- heartsucker 9y ago
  Funded by the government != The government has their hands all over it
  - gambiting 9y ago
    Even TOR was originally a government funded project
    - aluhut 9y ago
      Even "the Internet" was originally a government funded project
      - akerro 9y ago

fossuser 9y ago

You can read about the court filings [1] for Whatsapp metadata (unencrypted), but the actual text communication from Whatsapp is secure - or at least not returned by subpoena. I think Signal doesn't even have the metadata available, but I'm not sure about that. [1] (Horrible Forbes Link) https://www.forbes.com/sites/thomasbrewster/2017/01/22/whatsapp-facebook-backdoor-government-data-request/print/ https://www.forbes.com/sites/thomasbrewster/2017/01/22/whats...

r3bl 9y ago
Someone already tried requesting data about two suspects from Whisper Systems. What they got is "one number is not a Signal user, while the second one created his account on X day at Y time."[0] So yeah, Signal doesn't retain metadata. All they can provide is whether you're using Signal or not and when you've started using it. [0] https://whispersystems.org/bigbrother/eastern-virginia-grand-jury/ https://whispersystems.org/bigbrother/eastern-virginia-grand...

mtgx 9y ago

I agree that it's somewhat a deflection, too, and I wish the Telegram team wasn't so stubborn about at least studying the Signal protocol and perhaps making its own version, if it doesn't trust it by default. I don't know if their "math Ph.Ds" would know how to do that, though. That said, I think it's pretty clear that WhatsApp does have a way to allow the FBI to snoop on users: https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... I know it's controversial and many don't believe WhatsApp would actually use it like that, but I don't buy it. Either they already use that "feature" as a legal intercept or they're about to do it at least in the UK, where Snoopers' Charter passed and the law is vague enough to force them to do something like that. It may happen in Australia, too, if the new anti-crypto bill passes. I still trust Signal for now, but I'm not sure whether or not their server-based solution will be so backdoor-proof against future bills, and I think they should be prioritizing decentralizing Signal somehow. EDIT: Sigh, Germany, too: http://fortune.com/2017/06/14/germany-fingerprint-children-spy-messages/ http://fortune.com/2017/06/14/germany-fingerprint-children-s...

permanentdecaf 9y ago

Pavel Durov wants everyone to think security is about trust in people. Most companies in that business do the same, because it's easier than building something that doesn't require trust in people. The way Pavel Durov and others like him present "trust" is (ironically) shady corporate structures[1], shell companies, or use of the word "Switzerland." They want people to think like that because they've built businesses that require it. Telegram stores the messages you send/receive unencrypted on their servers. That's not good, unless you've been trained to think that "privacy" is just about choosing the company, government, or legal jurisdiction that gets total access to your data. Security professionals know that's not how we should think about security (never trust people!), because Durov is leaving a lot out: there aren't safe jurisdictions, servers get hacked, and centralized databases will get compromised. Logic, though, is probably no match for conspiracy theories. 1: https://www.washingtonpost.com/news/the-intersect/wp/2015/11/23/the-secret-american-origins-of-telegram-the-encrypted-messaging-app-favored-by-the-islamic-state/ https://www.washingtonpost.com/news/the-intersect/wp/2015/11...

skinnymuch 9y ago
I read the WP article you cited, titled, "The secret American origins of Telegram, the encrypted messaging app favored by the Islamic State". If Telegram isn't that secure, then why are extremists like IS using it over Signal or WhatsApp? I know Telegram has better features for big groups and much better multi-platform support, so is that the reason? I'm legitimately asking without any snark.
- kasey_junk 9y ago
  Because they have fallen for the marketing hype and are not secure messaging systems experts? We know some extremists still use SMS which is definitely not secure. Also, is there evidence that extremists aren't using Signal and WhatsApp?
  - skinnymuch 9y ago
    Them falling for the marketing makes sense.

deleted 9y ago

[deleted]

borncrusader 9y ago

Indeed, looks like a shot at Signal. I was under the impression that Signal is much secure than WhatsApp at least in terms of getting away from the prying eyes of Facebook. In reality both of them use the Whisper protocol underneath AFAICT for end-point encryption.

yogthos 9y ago

Even if the protocol is mathematically sound, there is no way to verify that it's implemented faithfully by closed source software such as WhatsApp. Telegram protocol is open and has an open source reference client. While not as good as having both the server and the client open source, at least it allows independent verification that the protocol is being implemented faithfully.

dingo_bat 9y ago

How do we know what WhatsApp uses? And do they use it in a secure way?