18 ms·

Why Telegram is insecure (2015)

230 points by known 8y ago

throwaway12iii 8y ago
No.
ape4 8y ago
Is there a standard checklist for messaging services that want to be secure?
- r3bl 8y ago
  EFF designed a way of scoring the security/privacy practices of IM applications. They've called it Secure Messaging Scorecard. While it was useful, they've decided it was a fruitless attempt[0] and their arguments are very convincing to me. On the other hand, it's kind of shitty not to have a reputable resource to point to and say "you shouldn't be using this, it's at the bottom of this list". I appreciated the list while it was a thing more for its bottom than its top. [0] https://www.eff.org/deeplinks/2018/03/secure-messaging-more-secure-mess https://www.eff.org/deeplinks/2018/03/secure-messaging-more-...
- dbrgn 8y ago
  The most comprehensive comparison table I know is here: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
- fghtr 8y ago
  https://prism-break.org/en/all/#instant-messaging https://prism-break.org/en/all/#instant-messaging
tareqak 8y ago
At the end, the author recommends Signal (https://signal.org/ https://signal.org/) and Threema ((https://threema.ch/en https://threema.ch/en). I've never heard of Threema before, but having more viable options in this space is definitely a good thing.
- johnisgood 8y ago
  How about Wire as an alternative? I'm curious.
  - svalorzen 8y ago
    I've started using Wire recently, and while it has some minor warts, call quality has always been excellent. In addition I really love being able to use it on my computer without having to check whether my phone has connectivity or not. I hate having to babysit my phone all the time and Wire is just wonderful for that, kind of brings me back to MSN days. This chart [1] compares several messaging apps' security standards; I'm not sure how accurate it is but maybe it can help you. [1]: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
    - iagovar 8y ago
      I thought the best jurisdiction for privacy was Iceland? The solutions provided by your link are all USA/Switzerland/Germany.
      - lucb1e 8y ago
        Meh, jurisdiction is one thing, but if the trust model does not include the server (a e2e encrypted chat app does not require a trusted server by definition), it doesn't really matter that much. Most they can do is social network analysis (as in, who talks to whom), against which the only solution is using an anonymisation network like Tor (no jurisdiction is going to disallow their intelligence services to see to whom an alleged terrorist is talking).
  - lucb1e 8y ago
    We use Wire at work. It's sometimes a little buggy, but given the advantages (see my other comment in this thread: https://news.ycombinator.com/item?id=18838010 https://news.ycombinator.com/item?id=18838010), it's a definite recommendation. Full disclosure: my company is one of the independent auditors of Wire (though they did so before I joined them).
deleted 8y ago
[deleted]
ymolodtsov 8y ago
Yes, because it’s such a delight to don’t have a synced history across devices. When I was figuring out how to transfer WhatsApp hustory from my mother’s Android to her new iPhone I realized that was no longer possible unless you use some wacky paid tools, because one only syncs with Drive and the other is with iCloud. Although I’d love to log in Telegram with Authy.
- ishitatsuyuki 8y ago
  Adding to this, another well known trade-off of E2EE is not being able to have server-side indexed full text search. For example sometimes it’s necessary to look for some link you shared months ago, and keeping histories local and searching through it is just inefficient on space and speed.
  - pmlnr 8y ago
    Local history in plain text/SQLite is not that bad. I have 15 years of chat history including small traffic chat rooms, and it takes ~400MB.
  - deleted 8y ago
    [deleted]
- joeseeder 8y ago
  Or just not keep your chat history , never back it up, never miss it info which i want to keep just gets send via email
  - enitihas 8y ago
    Yeah, that probably works well for you, but a lot of people want chat histories. In general, telling people to give up features which they really want is not a recipe for product adoption.
    - joeseeder 8y ago
      Why don't we actually ask the question from a perspective of a user. Do people want randomly scattered , unmaintained information containers which are not accessible via unified interface, but still vulnerable to theft and abuse ? Or the desirable functionality is an easy to use, secure, organized knowledge repository ? My answer is: As a user, I want to be the only one able to search my own information, and I want to do it conveniently and securely.
pmlnr 8y ago
XMPP: OMEMO, XEP-313, XEP-280, done. Cross-device e2e encrypted, synchronized messages. Local storage is not in-app encrypted though, but that needs to be taken care of on the system level anyway in my opinion.
- Erlich_Bachman 8y ago
  What about PFS? Which apps would you recommend? Also with XMPP you almost have to specify which apps to use. Since it is as an open standard, just recommending the protocol means that someone could just pick one of the "bad" apps (old non-updated, or some which are actively against privacy) and the whole effort becomes pointless anyway.
  - herewuare 8y ago
    For Android phones you need to get the app called Conversations, and for Linux Windows Mac desktops you need to get the app called Gajim, and just enable OMEMO encryption under plugins. Conversations for Android is definitely the best XMPP client out there right now, so just make all your family and friends use it. And everything will be transparently flawless.
- lucb1e 8y ago
  Where can I sign up? Serious question because I can't tell a few dozen friends and family to either run their own server, nor do I want to play customer support for all of them.
  - pgeorgi 8y ago
    Conversations (the best Android client out there) proposes using its author's server for a fee. https://list.jabber.at https://list.jabber.at has more servers.
  - throwaway72555 8y ago
    Also take a look at Quicksy [0]. It is done by the author of Conversations but allows phone number sign up, which simplifies things for non-tech people. [0] https://quicksy.im/ https://quicksy.im/
stabbles 8y ago
I made a habit of using automatically disappearing messages in chat using Signal (after a day or week). You have to manually save important messages, but typically this is not an issue. The only downside is that the Signal servers may store automatically disappearing messages until all devices have received it, so you can't rely on messages being removed in due time. It would be nice to have an e2e encrypted p2p messaging platform to overcome this issue.
- xena 8y ago
  So, Tox?
  - eeZah7Ux 8y ago
    No way. Tox claims to keep users safe from governments and does not even have a threat model in the documentation.
  - OpenBSD-empire 8y ago
    Yes definitely Tox. No centralization, ID is created, managed, and stored locally. Works over Tor (the text and file transfer portions). Only things wrong with it is it doesn't do multi-device -> single ID (minor annoyance), and its mobile clients are Samantha somewhat buggy. It's more than adequate though to install on your and your family's/friends' phones and switch to it once you've roused them on an insecure normie-net medium like text or FB Messenger, saying something like "Hey Bob, you there? Let's go secure!" "Alright Alice..." and they both open their Tox clients. Security takes a modicum of effort, and with Tox the bar is set really low. Is the ability to group audio chat and get all your past messages on a new device really worth bending over and letting megacorp rape you in the privacy? Think before answering...
- wtmt 8y ago
  > The only downside is that the Signal servers may store automatically disappearing messages until all devices have received it, so you can't rely on messages being removed in due time. I don’t understand your problem statement. Signal is completely an end-to-end encrypted chat platform. Those messages stored on the servers are encrypted and Signal (the platform or employees) doesn’t have the keys to decrypt the messages. So what’s the issue if the messages remain on the servers until they’re delivered to the recipients’ devices? Even the non-disappearing messages don’t stay on the Signal servers forever (unlike say, Telegram).
x092 8y ago
What I find interesting is that this article is very recent, however the calculations on Crypto are not up to date. MtProto has had some big changes some time ago already: - SHA-256 is used instead of SHA-1; - Padding bytes are involved in the computation of msg_key; - msg_key depends not only on the message to be encrypted, but on a portion of auth_key as well; - 12..1024 padding bytes are used instead of 0..15 padding bytes in v.1.0. See https://core.telegram.org/mtproto/description https://core.telegram.org/mtproto/description
- Fnoord 8y ago
  None of these changes are big enough; it is still homebrew crypto. If there's issues with cryptography standards you can be sure your OS (such as your Linux distribution) lost CIA in one way or another. Whereas with MTProto, if that is broken, only your Telegram chats lose CIA. Which raises the question why not use standards?
  - x092 8y ago
    They were, actually. MtProto v2 satisfies IND-CCA now as opposed to what the blog post claims: https://core.telegram.org/techfaq#what-about-ind-cca https://core.telegram.org/techfaq#what-about-ind-cca
  - raverbashing 8y ago
    So Signal and others are not "homebrew crypto"? That criticism is fair a lot of times, but every higher level crypto construction is going to be unproven for a while until checked. It's not like they were inventing their own hash function and stream cypher.
    - tptacek 8y ago
      Signal is the best-studied multiparty secure messaging protocol; there are academic papers that provide formal analyses. Trevor and Moxie won the Levchin Prize at Real World Crypto for Signal Protocol; the Levchin steering committee is a "Who's Who" of cryptographers, as are the other winners of the prize. No, Signal is not "homebrew crypto".
d0mine 8y ago
To summarize: there is a theoretical concern about the MTProto protocol used by Telegram. Mentioning "nation states" is laughable and it seems everybody should be reminded that not only advertisers have access to "metadata" generated by their mobile devices. To make the life less convenient but more "secure", one could enable "secure chats", set an explicit password and don't allow access to the Contacts on iOS.
- aasasd 8y ago
  > Mentioning "nation states" is laughable In some countries, a “nation state“ is pretty much every local police chief and prosecutor who like their comfy and paying positions a lot, don't like having too many loud democracy advocates around, and know who to call in such cases. People tend to forget that the state is basically evolved mafia.
- opencl 8y ago
  A theoretical concern about MTProto that was already fixed over a year ago with MTProto 2.0.
fabiandesimone 8y ago
I checked Threema because of this post (didn't know about it) and while searching, some people are complaining about it being under control of the Russian gov? Does anyone know anything about this? https://www.newsbtc.com/2017/10/04/crypviser-secure-messaging/ https://www.newsbtc.com/2017/10/04/crypviser-secure-messagin...
- dbrgn 8y ago
  Threema does not fall under Russian jurisdiction, so no. http://www.ewdn.com/2017/03/16/russia-adds-intrernational-messenger-threema-to-official-registry-with-a-view-to-control-users-communications/ http://www.ewdn.com/2017/03/16/russia-adds-intrernational-me... > Interviewed by Runet Echo, a Threema spokesperson said, however: “We operate under Swiss law and are neither allowed nor willing to provide any information about our users to foreign authorities.”
  - gsich 8y ago
    That seems suspiciously specific. >foreign authorities This reads as "but local authorities are no problem" to me.
    - dbrgn 8y ago
      Check out the transparency report for details: https://threema.ch/en/transparencyreport https://threema.ch/en/transparencyreport
- jsn 8y ago
  This is just Crypviser spreading lies. No, being on that Russian register doesn't imply any intention to comply with any wiretapping / censorship requests; in fact, IIRC, it doesn't even necessarily imply any consent to being added to the register. Saying that Treema's being added to the register means it "moved under the control of the Russian government" is no different than adding their company name and address to some Excel file on your computer and then saying that Threema has moved under your control.
lucb1e 8y ago
Any reason you mention Signal and Threema but not Wire? Wire is objectively superior as far as I can tell. For a quick (probably incomplete) comparison, Wire has proper multi-device support (not sure how Threema does that), open source and cross-platform clients and open source server (Threema does not appear to have a Linux client nor publishes sources as far as I can tell), it's free (allowing everyone to use it, even if you're in a country where it's hard to pay from), it has a proper profit model (unlike Telegram, and to a much lesser extent Signal), and it does not require a phone number. The two major downsides of Wire is the battery usage due to all clients being Electron, and that few people know about it (hence my prompt to give them a mention). Not major stoppers I'd say...
- wtmt 8y ago
  I like Wire and use it with some people. It allows signing up with email and supports up to three accounts on a device. But I do find it to be a bit slow, mainly in sending as well as downloading images where it’s painfully obvious. Telegram is better on many counts and is a very nice app to use. Usability will usually beat other factors when it comes to mass adoption. Signal is the last on my list (it’s slow and unreliable, setting up an account is a coin toss because the verification process wouldn’t work, can’t move chats to a new device, etc.).
  - otachack 8y ago
    I believe you can move chats between devices, they just have to be sourced from Signal and not SMS. SMS/MMS chats are what you may be talking about as immovable from Signal. Those are not shared between your Signal devices for security purposes, I imagine. You can back these up or move them yourself separately. Also, Signal device linking only works between one mobile device and multiple desktop clients. To move between mobile devices it requires a Signal chat backup and restore.
    - wtmt 8y ago
      It’s just not possible to move Signal chats from one iOS device to another (on iOS, Signal and SMS are not connected). Signal prohibits backing up of the data to iTunes and to iCloud. So there’s no way to make this work. That’s how it has been, and Signal does this for “security reasons”.
arctica123 8y ago
Does anyone have experience with using Matrix [0] as an alternative to Telegram and Signal? Maybe even running your own homeserver which stores your history on a server you control and syncs that across all devices? As far as I saw you can also bridge to other messaging services, even to WhatsApp [1] which is why it might be worth a try. [0] https://matrix.org/blog/home/ https://matrix.org/blog/home/ [1] https://github.com/tulir/mautrix-whatsapp https://github.com/tulir/mautrix-whatsapp
- pinusc 8y ago
  I'm currently self-hosting a Matrix homeserver! I got a few friends to join me and we use it to chat daily. I can't really speak for its security. Afaik the protocol is almost considered stable, and I trust it for everyday communications — but I wouldn't trust it if dealing with a nation-state level adversary. The only privacy pain point is that if you run a synapse home server (the reference implementation), by default your voice and video chats are routed through Google's servers. You have to run your own TURN server alongside synapse to prevent this. This is fine, but imho it's not well explained on the install guide. Riot is... Okay. It's great ffor power users, but imho is quite obscure for the average chat app user; the ux isn't great yet. Perhaps with the redesign... Lastly, bridges are the biggest reason why I want matrix to succeed... But as of now, none of them are really useful or even usable. They're all in very early stages of development and need contributions.
  - squeezingswirls 8y ago
    >Lastly, bridges are the biggest reason why I want matrix to succeed... But as of now, none of them are really useful or even usable Why do you say that? I know many projects using bridges successfully. For example the UBports [0] guys have bridges between their Telegram and Matrix rooms. Besides FluffyChat [1] works wonderfully on UT phones, so that's a plus for them. [0] https://ubports.com/ https://ubports.com/ [1] https://christianpauly.github.io/fluffychat/ https://christianpauly.github.io/fluffychat/
- squeezingswirls 8y ago
  Yes, I do. If you have 39 minutes to spare I recommend you to watch this Ben Parsons talk at 35c3 https://media.ccc.de/v/35c3-9400-matrix_the_current_status_and_year_to_date https://media.ccc.de/v/35c3-9400-matrix_the_current_status_a...
wscott 8y ago
Keybase.io is an alternative for secure chats. Anyone know how it compares to signal, wire & threema?
- otachack 8y ago
  I think Keybase does chat well and their code is open source. One issue I see with them is that they seem in a perpetual beta phase, so who knows how dependent you can be on their software. I also don't like the React Native based phone apps as they don't feel native and lack polish. I also worry about them having joined the crypto train with no reason besides being backed up by Stellar foundation. The stake from Stellar into Keybase isn't clear and may influence decision making in direction of Keybase. The chat clients do have a nifty feature of setting up a time based, self destroying message. And you can share git repos within your registered clients and peers. They also have a shared filesystem and team based chat. You can also generate a PGP key pair for identity. The feature list is vast. The main point of Keybase is also sound in my book, which is to have a network of proof such that you can prove who you are in your correspondence in whatever social media or chat you use. You can even use the encryption / decryption services of Keybase only and send the encrypted payloads however you'd like. I think with more polish on their clients and proven stability that Keybase will be a great service to depend on. But I do think they need more personnel and/or they need to step up on their social aspect because their last blog post was 200 days ago.
  - wscott 8y ago
    I hear you. The blog post about Stellar made me very nervous. https://keybase.io/blog/keybase-stellar https://keybase.io/blog/keybase-stellar However, I get more nervous about use software without an obvious means of support for the developers so it would be nice if they can fill some nitch and make money as long as they don't kill the current client.
  - jillesvangurp 8y ago
    Keybase is nice indeed. I think what they are doing with their network of proofs is somewhat unique in this space and makes end to end crypto usable for the masses (unlike e.g. pgp). I agree they UI is not as slick as slack or telegram but nothing that they won't be able to fix with a bit of love and attention. Fixing this is expensive, however. Hence their association with Stellar for funding. It's worth pointing out that Telegram has recently funded itself with an ICO as well. They are very well funded and they have a huge user base. IMHO investor/greed driven walled gardens have long been a problem in this space and is also the reason email is still around because despite its many flaws, it has one feature that is incompatible with running a walled garden: it is federated and decentralized from the ground up. Anybody can run a server and email clients that lock you into communicating only to users on one server went extinct in the nineties. With chat, it seems there is a pattern of perpetually recreating walled gardens with a single all powerful company at the center. This has been going on since the days of ICQ, AIM, Yahoo messenger, MSN and all those other long forgotten products that each did more or less the same thing and each tried to own your network. Strictly speaking, there's actually very little that differentiates modern day chat apps from those early chat apps in terms of what they do. Signal just got a capital injection from the whatsapp founders. I like that Signal are setup as a foundation and that their stack is intentionally completely open source end to end and yet easy to get into for on techie users. This breaks the pattern of centrally controlled for profit walled gardens as the only option. And this makes them somewhat unique in this space: they are now well funded, independent, and widely respected by people that care about communicating securely, and their mission is keeping it like that. I'm not that eager to swap out Whatsapp for Telegram. Ultimately, I don't trust either of them to do the right thing. But, arguably Whatsapp is somewhat more secure because at least it uses Signal's crypto. I use Keybase because I find their setup intriguing. And of course, I have Signal installed on principle but it seems none of the people I normally chat with are on it. I hope that they can fix that. But realistically, I seem stuck on Whatsapp, which I've never liked because it is such an inferior product compared to almost anything I've used for chat in the last 20 years (fugly UI, limited feature set, no decent desktop client, etc.). But world + dog seems to be on it so there's that.
amaccuish 8y ago
> Telegram links an account to a telephone number. > If you want to use secure and private apps, I recommend: Signal Private Messenger: https://signal.org.. https://signal.org... I feel it's wrong to criticise Telegram for using phone numbers, and then in the same breath recommend Signal.
- Erlich_Bachman 8y ago
  Why do all messengers keep requiring phone numbers? Is it because of the problem of spam? Couldn't this easily be prevented by for example requiring consent before sending messages to new contacts? You could for example have it work 2 ways: 1) require a phone number connected to message unknown contacts. 2) without phone number, requiring prior consent from any new unknown contact, to message them.
  - nebulous1 8y ago
    Ease of use
  - unicornporn 8y ago
    > Why do all messengers keep requiring phone numbers? Matrix/Riot.im and Wire doesn't. I think they're both good alternatives.
    - ekianjo 8y ago
      Wire only if you register first on a computer. from the phone if you create an account you have to use your number.
      - walterbell 8y ago
        They seem to have changed this now, you can register with an email address from mobile. It still asks for a phone number, but you can say no.
        8y ago
VvR-Ox 8y ago
Threema is proprietary and I think it's dangerous to recommend it as an alternative. Everything we trust should be open. Telegram is not perfect but better than WhatsApp. Also there is people who want convenience like history sync - it won't help telling them that it's unsecure. In the end at least facebook doesn't have their data. For NSA etc. it's not that important where stuff is. From the leaks we know they can do everything they want (expertise + huge money) so if you want something more secure you maybe shouldn't use one of the popular solutions at all ;-)
- xashor 8y ago
  It doesn't relly matter that much if Facebook has your metadata or Telegram has your metadata. What's more important: WhatsApp E2E is more secure than Telegrams self built E2E, that needs to be enabled and doesn't support group chats. Also, Telegram isn't that open source either: server side is closed source and the client side seems to be still an undocumented, mirrored mess. So for me at least, as I don't want anyone that easily to read my messages: many other solutions > WhatsApp > Telegram.
  - enitihas 8y ago
    Isn't Telegram open source strictly superior than WhatsApp open source? WhatsApp has neither client side nor server side code available(server side doesn't mean much anyways, as Good luck verifying if that is the code which runs on some server).
- chappi42 8y ago
  > Threema is proprietary and I think it's dangerous to recommend it as an alternative. Everything we trust should be open. On the other hand, they have been audited [1], have transparency reports [2] and their servers are Swiss based [3]. Yes open source would be nice, but a relative small company with a focused business model (not dependent on advertisement, data-gathering, donations, kind [bi|mi]llionairs) has its advantages too. I'm using Threema since some years and wouldn't want anything else. [1]: https://threema.ch/en/faq/code_audit/ https://threema.ch/en/faq/code_audit/ [2]: https://threema.ch/en/transparencyreport https://threema.ch/en/transparencyreport [3]: https://en.wikipedia.org/wiki/Threema#Privacy https://en.wikipedia.org/wiki/Threema#Privacy
Gasp0de 8y ago
"Telegram provides a feature called "Links previews" that's available and on by default in not encrypted chats, anyways if you use a "Secret chat", Telegram app ask to you if you want to use "links previews" adversiting that it previews are done in the server side. How can they know what links are you writing? Can they read your messages still if you are using "Secret chats"? (Not sure but is a edge case)." They probably do pattern matching on the app, why would they need to send anything to the servers for content previews?
- morrbo 8y ago
  Not verified but i'd imagine the retrieval of the metadata (the cards/tags needed to show the image previews, etc.) is done by proxying via telegram servers, possible to prevent semi-doxxing someone (returning their real IP) just by sending them a message?
wtmt 8y ago
This post has some useful information, but the recommendation of other centralized platforms that rely on a phone number make this post seem like the pile of FUD that Telegram has been enduring for long. Contact theft, metadata, susceptibility to phone number for setting up or verifying an account are issues shared by the other recommendations too. [1] For someone who doesn’t know much about security, it comes down to “who can be trusted”, and that question applies to Signal and Threema too. [1]: Edit. I wasn’t aware that Threema does not require phone numbers. Thanks to dbrgn for correcting me.
- dbrgn 8y ago
  Threema does not rely on phone numbers. You can use it anonymously, and you can add other contacts without knowing their phone number. More details can be found in the crypto whitepaper: https://threema.ch/press-files/2_documentation/cryptography_whitepaper.pdf https://threema.ch/press-files/2_documentation/cryptography_...
tinus_hn 8y ago
So storing data remotely is now a security nightmare? It doesn’t really help to exaggerate like this.
- mfwoods 8y ago
  Not necessarily. But storing them in plain text on the server and all history accessible just by hijacking a phone number (or a single text message) is, considering the alternatives, don't you agree?
  - jhasse 8y ago
    How do you know that it is stored in plain text on the server?
    - mfwoods 8y ago
      Because there is no end to end encryption (other than some very limited temporary one on one chats that only work between two mobile devices) which means the server can (and does) read and store all your messages. Getting access to your full chat history is as simple as intercepting a single text, because the server has access to your plain text messages. They might do some form of encryption to store the messages, but this is meaningless when they also have access to the keys and can decrypt any message whenever they want.
      - tinus_hn 8y ago
        So in essence, like about any service that performs manipulations on your files? Like a storage service that creates thumbnails of your photos?
yogthos 8y ago
So, here's the thing I'd like somebody to explain to me. Telegram encryption spec is published, and the client is open source. This means you can verify that the server is following the spec by creating a clean room client implementation. You could even create a green field server implementation if you wanted. Telegram regularly has contests to break its encryption with a reward of 300K USD https://telegram.org/blog/cryptocontest https://telegram.org/blog/cryptocontest If it's not secure, then surely people would be cashing in on that sweet money. So, why is it that we constantly see articles talking about how insecure Telegram encryption is, but nobody is showing a proof of concept attack or collecting the prize? Unless somebody puts their money where their mouth is and shows an actual exploit with code, it seems like pure FUD to me. On top of that, it appears that attacks on Telegram often come from people associated with Signal in some way. Signal is endorsed by NSA who have a history of promoting weak encryption that they have found backdoors into. I hope everybody still remembers this debacle https://golem.ph.utexas.edu/category/2014/10/new_evidence_of_nsa_weakening.html https://golem.ph.utexas.edu/category/2014/10/new_evidence_of...
- xashor 8y ago
  >Telegram regularly has contests to break its encryption with a reward of 300K USD https://telegram.org/blog/cryptocontest https://telegram.org/blog/cryptocontest >If it's not secure, then surely people would be cashing in on that sweet money. So, why is it that we constantly see articles talking about how insecure Telegram encryption is, but nobody is showing a proof of concept attack or collecting the prize? regulary != 2 times with limited time. Also, E2EE is not only about decrypting a message. E.g. signing messages as someone else isn't awarded. Also, you might need a lot of computation power. SHA-1 used in MTProto 1.0 for example is practically pretty secure, but not against a well funded attack. But that aside, Telegram's encryption is probably good enough. But we already have standards that are good enough. Why risk it? For example, from On the CCA (in)Security of MTProto[0]: >Telegram is a popular messaging app which supports end-to-end encrypted communication. In Spring 2015 we performed an audit of Telegram's Android source code. This short paper summarizes our findings. Our main discovery is that the symmetric encryption scheme used in Telegram -- known as MTProto -- is not IND-CCA secure, since it is possible to turn any ciphertext into a different ciphertext that decrypts to the same message. >We stress that this is a theoretical attack on the definition of security and we do not see any way of turning the attack into a full plaintext-recovery attack. At the same time, we see no reason why one should use a less secure encryption scheme when more secure (and at least as efficient) solutions exist. >The take-home message (once again) is that well-studied, provably secure encryption schemes that achieve strong definitions of security (e.g., authenticated-encryption) are to be preferred to home-brewed encryption schemes. And that aside, E2EE is not default and neither E2E group chats or E2E video calls are supported. This is the biggest security problem. [0] https://dl.acm.org/citation.cfm?id=2994468 https://dl.acm.org/citation.cfm?id=2994468
dm33tri 8y ago
Telegram is popular because of it's convenience, not security. I've tried using whatsapp and the app seemed so much inferior: no nicknames, crippled desktop client, no separate contact list. It happened so that telegram became some kind of standart for formal chatting in my country (universities, businesses, journalists, officials use it) even thought it's blocked by ISPs (still works fine most of the time), I think mainly because you don't have to expose your phone number to be contacted and you can easily use it on desktop (also bots, I know one big store chain that uses tg bots for managing your bonus programme).
qwerty456127 8y ago
> Telegram provides a feature called "Links previews" that's available and on by default in not encrypted chats, anyways if you use a "Secret chat", Telegram app ask to you if you want to use "links previews" adversiting that it previews are done in the server side. How can they know what links are you writing? Can they read your messages still if you are using "Secret chats"? (Not sure but is a edge case). It feels reasonable to assume the Telegram client detects the links (using a regexp or something) and sends them to the server side. Of course they see the links if you ask them to but this doesn't mean they also see all the text.
localguy 8y ago
https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/htmlview?sle=true https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal... Digital Communications Protocols
zelon88 8y ago
Sounds more like this guy works for a competitor than a security firm. No proof, and he apparently didn't even test his own theories. And the whole "Telegram isn't secure because nation states can abuse their telcos to break 2fa" is, while accurate, also true for about 90% of the internet. And what's with this method of disclosure? It's not ethical or responsible. It's plain defamatory.
TACIXAT 8y ago
Let me preface this by saying I work in security and use Signal. That said, the security industry can be incredibly obtuse at times. End users don't care. Full stop. Having the best encryption isn't a selling point to the masses. I'm making a chat app right now and I'm doing it exactly the same way as Telegram, unencrypted by default with an E2E private chat option. Why? Search. I don't need E2E. I use it based on principle. I do need to be able to search my conversations. As long as the chat provider is trusted, I'm happy to have my messages in plain text to be searchable and I think 99% of end users feel the same way.
- nitrogen 8y ago
  Why can't search be done entirely client side?
  - TACIXAT 8y ago
    It could, with IndexedDB or similar, but then you have a massive conversation history being stored on user devices. Space is a precious commodity on phones.
    - xashor 8y ago
      For text? Nah. Most apps automatically store photos on your device, and that's fine. Mobile phones have several GB for storage. That is enough for hundred thousands of messages, before even noticeable. Please reconsider your E2E policy and don't make the world a more insecure place.
xte 8y ago
Telegram is insecure by nature because it's a proprietary service. It doesn't really matter much how is coded or how appear to be coded. Not to reduce the value of author's analysis of course, but just to clarify a point: no proprietary service can be considered secure, no matter how good and well intentioned it's property is.
- gtirloni 8y ago
  Unless you're advocating for P2P chat, I don't see how it's any different for open source solutions. At some point you have to trust the people hosting the centralized servers, OSS or proprietary.
  - xte 8y ago
    Of course, we need decentralized solution at minimum, distributed at best. Also about trust: I can trust a bit certain kind of paid hosting/services, for instance companies that are in my country under my country law can be trusted in the sense that I have a certain kind of legal protection and a clear signed contract. It does not stop them do thing I can't know with my data but I have few options. Against services hosted elsewhere in the world with "not-real-contracts" and zero formal fee my possibility of action is essentially ZERO so I can't even being protected by my country's law.
fiatjaf 8y ago
All these criticisms apply to Gmail, Slack, Hangouts, Skype, whatever.
- saagarjha 8y ago
  None of these use “security” as their a primary component of their advertising strategy.
saagarjha 8y ago
> When registering an account with Telegram, the app helpfully uploads the entire Contacts database to Telegram's servers (optional on iOS). The Telegram iOS client has started pushing dark patterns to get me to upload my contacts: it now shows a perpetual “badge” in the app’s main tab view (so that I can’t ever miss it), as if it has an error or alert it needs to tell me about. If I tap on it Telegram will helpfully tell me, on a visually broken page, that I should please allow Telegram to access and upload all my contacts to “seamlessly find all my friends” (like I needed this).
- Fins 8y ago
  You my not need it, but FSB sure does.
nithinm 8y ago
The whole article is based on the fact that secret chats are not enabled by default. But i dont understand why that's a critical point, if you are so worried about privacy just start a secret chat. Also from what i can understand its a design decision telegram took. If the secret chats are always on then the private key needs to be transfered from device to device and on new devices,which is a security risk. The points about the contacts is right though. Also i am a strict no for closed-source privacy app. Even though telegrams code is open, the repo is handedly very badly. With squashed commits pushed once in few months, issues disabled.
- saagarjha 8y ago
  > But i dont understand why that's a critical point, if you are so worried about privacy just start a secret chat. Usability is important. The more steps you put in the way of security, the less likely people will do the right thing.
enitihas 8y ago
I think we should always remember that users want usability too and most of the times aren't willing to surrender features for the extra gain in security. If users preferred security, a lot more people would be using PGP.
grugq 8y ago
Not sure what the policy is on plagiarism, but this post plagiarized my write up. The structure is the same and the section headings are the same. It is blatant plagiarism. https://link.medium.com/cWfUtKQjgT https://link.medium.com/cWfUtKQjgT
- markbnj 8y ago
  I've had a couple of popular medium posts copied by a person looking to boost the visibility of his consulting company site. It's frustrating, but I think ultimately it does the thief more harm than good.
- huehehue 8y ago
  They added references a couple of minutes ago, I think very large chunks of their post should still be in quote blocks though. Great writeup btw, grugq https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca669c86998154c9e840f10 https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca...
  - grugq 8y ago
    Thanks
- rrdharan 8y ago
  Author just edited it and added your post as a reference: https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca669c86998154c9e840f10 https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca... ... + 7 https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a https://medium.com/@thegrugq/operational-telegram-cbbaadb901... by https://twitter.com/thegrugq https://twitter.com/thegrugq
  - grugq 8y ago
    He did only after I publicly called him out[0]. And it is still plagiarism. “Plagiarism is the "wrongful appropriation" and "stealing and publication" of another author's "language, thoughts, ideas, or expressions" and the representation of them as one's own original work.”[1] [0] https://twitter.com/Edu4rdSHL/status/1081971696431706113 https://twitter.com/Edu4rdSHL/status/1081971696431706113 [1] https://en.m.wikipedia.org/wiki/Plagiarism https://en.m.wikipedia.org/wiki/Plagiarism
ancarda 8y ago
Sadly switching to Signal, Wire, and other "technologically superior to Telegram" apps means a drop in user experience. For example, I tried switching to Wire recently but I found that setting up a new device means I wouldn't have access to my old messages. I understand these apps don't want to upload messages to a server, but can't messages be synced between clients? Even if I had to scan a QR code on my phone to sync with my laptop and had to stay on the same Wi-Fi network until it was done, it could then sync historical messages. I have Telegram messages from 2015 when I had a different computer, laptop, phone, and lived in a different house. This is also why I don't use the secret chat on Telegram. As soon as you add too much encryption and security you have to trade-off usability. Must it always be that way? If you have to chose between security and usability, people will always choose usability.
- przmk 8y ago
  This is a pretty big issues for me as well. In terms of user experience on desktop, all the other apps are complete garbage. Telegram has a native client for all major platforms written in Qt that has all the features the mobile app has (except for secret chats). Everything else feels slow, unresponsive and has poor features.
- kitsunesoba 8y ago
  Those other more secure chat apps also treat desktop as an afterthought or worse, which is simply not acceptable for my use case. I live at my desk, not on my phone, and expect desktop to be treated as a first class citizen. At present, the only two services that do this are iMessage and Telegram, so I use iMessage with everybody with Apple stuff and Telegram for everybody else.
john4534243 8y ago
Telegram does not store private keys only on client. On the other hand telegram splits the private key and stores in multiple severs in several countries making it legally very very hard to process requests. But this also means the founders or just some developer who has access to the servers can read the messages as they have access to private keys. Signal app is more secure.Signal app does not store private keys on the server. The following faq is from telegram site. Q: Do you process data requests? Secret chats use end-to-end encryption, thanks to which we don't have any data to disclose. To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, several court orders from different jurisdictions are required to force us to give up any data. Thanks to this structure, we can ensure that no single government or block of like-minded countries can intrude on people's privacy and freedom of expression. Telegram can be forced to give up data only if an issue is grave and universal enough to pass the scrutiny of several different legal systems around the world. To this day, we have disclosed 0 bytes of user data to third parties, including governments. ### End of Faq #### Even the secret chats in telegram are not secret because the protocol is custom developed by amateurs devs. It is not tested and have seen some articles on methods to attack, could not get the link now.

230 points by known 8y ago

throwaway12iii 8y ago

No.

ape4 8y ago

Is there a standard checklist for messaging services that want to be secure?

r3bl 8y ago
EFF designed a way of scoring the security/privacy practices of IM applications. They've called it Secure Messaging Scorecard. While it was useful, they've decided it was a fruitless attempt[0] and their arguments are very convincing to me. On the other hand, it's kind of shitty not to have a reputable resource to point to and say "you shouldn't be using this, it's at the bottom of this list". I appreciated the list while it was a thing more for its bottom than its top. [0] https://www.eff.org/deeplinks/2018/03/secure-messaging-more-secure-mess https://www.eff.org/deeplinks/2018/03/secure-messaging-more-...
dbrgn 8y ago
The most comprehensive comparison table I know is here: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
fghtr 8y ago
https://prism-break.org/en/all/#instant-messaging https://prism-break.org/en/all/#instant-messaging

tareqak 8y ago

At the end, the author recommends Signal (https://signal.org/ https://signal.org/) and Threema ((https://threema.ch/en https://threema.ch/en). I've never heard of Threema before, but having more viable options in this space is definitely a good thing.

johnisgood 8y ago
How about Wire as an alternative? I'm curious.
- svalorzen 8y ago
  I've started using Wire recently, and while it has some minor warts, call quality has always been excellent. In addition I really love being able to use it on my computer without having to check whether my phone has connectivity or not. I hate having to babysit my phone all the time and Wire is just wonderful for that, kind of brings me back to MSN days. This chart [1] compares several messaging apps' security standards; I'm not sure how accurate it is but maybe it can help you. [1]: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
  - iagovar 8y ago
    I thought the best jurisdiction for privacy was Iceland? The solutions provided by your link are all USA/Switzerland/Germany.
    - lucb1e 8y ago
      Meh, jurisdiction is one thing, but if the trust model does not include the server (a e2e encrypted chat app does not require a trusted server by definition), it doesn't really matter that much. Most they can do is social network analysis (as in, who talks to whom), against which the only solution is using an anonymisation network like Tor (no jurisdiction is going to disallow their intelligence services to see to whom an alleged terrorist is talking).
- lucb1e 8y ago
  We use Wire at work. It's sometimes a little buggy, but given the advantages (see my other comment in this thread: https://news.ycombinator.com/item?id=18838010 https://news.ycombinator.com/item?id=18838010), it's a definite recommendation. Full disclosure: my company is one of the independent auditors of Wire (though they did so before I joined them).

deleted 8y ago

[deleted]

ymolodtsov 8y ago

Yes, because it’s such a delight to don’t have a synced history across devices. When I was figuring out how to transfer WhatsApp hustory from my mother’s Android to her new iPhone I realized that was no longer possible unless you use some wacky paid tools, because one only syncs with Drive and the other is with iCloud. Although I’d love to log in Telegram with Authy.

ishitatsuyuki 8y ago
Adding to this, another well known trade-off of E2EE is not being able to have server-side indexed full text search. For example sometimes it’s necessary to look for some link you shared months ago, and keeping histories local and searching through it is just inefficient on space and speed.
- pmlnr 8y ago
  Local history in plain text/SQLite is not that bad. I have 15 years of chat history including small traffic chat rooms, and it takes ~400MB.
- deleted 8y ago
  [deleted]
joeseeder 8y ago
Or just not keep your chat history , never back it up, never miss it info which i want to keep just gets send via email
- enitihas 8y ago
  Yeah, that probably works well for you, but a lot of people want chat histories. In general, telling people to give up features which they really want is not a recipe for product adoption.
  - joeseeder 8y ago
    Why don't we actually ask the question from a perspective of a user. Do people want randomly scattered , unmaintained information containers which are not accessible via unified interface, but still vulnerable to theft and abuse ? Or the desirable functionality is an easy to use, secure, organized knowledge repository ? My answer is: As a user, I want to be the only one able to search my own information, and I want to do it conveniently and securely.

pmlnr 8y ago

XMPP: OMEMO, XEP-313, XEP-280, done. Cross-device e2e encrypted, synchronized messages. Local storage is not in-app encrypted though, but that needs to be taken care of on the system level anyway in my opinion.

Erlich_Bachman 8y ago
What about PFS? Which apps would you recommend? Also with XMPP you almost have to specify which apps to use. Since it is as an open standard, just recommending the protocol means that someone could just pick one of the "bad" apps (old non-updated, or some which are actively against privacy) and the whole effort becomes pointless anyway.
- herewuare 8y ago
  For Android phones you need to get the app called Conversations, and for Linux Windows Mac desktops you need to get the app called Gajim, and just enable OMEMO encryption under plugins. Conversations for Android is definitely the best XMPP client out there right now, so just make all your family and friends use it. And everything will be transparently flawless.
lucb1e 8y ago
Where can I sign up? Serious question because I can't tell a few dozen friends and family to either run their own server, nor do I want to play customer support for all of them.
- pgeorgi 8y ago
  Conversations (the best Android client out there) proposes using its author's server for a fee. https://list.jabber.at https://list.jabber.at has more servers.
- throwaway72555 8y ago
  Also take a look at Quicksy [0]. It is done by the author of Conversations but allows phone number sign up, which simplifies things for non-tech people. [0] https://quicksy.im/ https://quicksy.im/

stabbles 8y ago

I made a habit of using automatically disappearing messages in chat using Signal (after a day or week). You have to manually save important messages, but typically this is not an issue. The only downside is that the Signal servers may store automatically disappearing messages until all devices have received it, so you can't rely on messages being removed in due time. It would be nice to have an e2e encrypted p2p messaging platform to overcome this issue.

xena 8y ago
So, Tox?
- eeZah7Ux 8y ago
  No way. Tox claims to keep users safe from governments and does not even have a threat model in the documentation.
- OpenBSD-empire 8y ago
  Yes definitely Tox. No centralization, ID is created, managed, and stored locally. Works over Tor (the text and file transfer portions). Only things wrong with it is it doesn't do multi-device -> single ID (minor annoyance), and its mobile clients are Samantha somewhat buggy. It's more than adequate though to install on your and your family's/friends' phones and switch to it once you've roused them on an insecure normie-net medium like text or FB Messenger, saying something like "Hey Bob, you there? Let's go secure!" "Alright Alice..." and they both open their Tox clients. Security takes a modicum of effort, and with Tox the bar is set really low. Is the ability to group audio chat and get all your past messages on a new device really worth bending over and letting megacorp rape you in the privacy? Think before answering...
wtmt 8y ago
> The only downside is that the Signal servers may store automatically disappearing messages until all devices have received it, so you can't rely on messages being removed in due time. I don’t understand your problem statement. Signal is completely an end-to-end encrypted chat platform. Those messages stored on the servers are encrypted and Signal (the platform or employees) doesn’t have the keys to decrypt the messages. So what’s the issue if the messages remain on the servers until they’re delivered to the recipients’ devices? Even the non-disappearing messages don’t stay on the Signal servers forever (unlike say, Telegram).

x092 8y ago

What I find interesting is that this article is very recent, however the calculations on Crypto are not up to date. MtProto has had some big changes some time ago already: - SHA-256 is used instead of SHA-1; - Padding bytes are involved in the computation of msg_key; - msg_key depends not only on the message to be encrypted, but on a portion of auth_key as well; - 12..1024 padding bytes are used instead of 0..15 padding bytes in v.1.0. See https://core.telegram.org/mtproto/description https://core.telegram.org/mtproto/description

Fnoord 8y ago
None of these changes are big enough; it is still homebrew crypto. If there's issues with cryptography standards you can be sure your OS (such as your Linux distribution) lost CIA in one way or another. Whereas with MTProto, if that is broken, only your Telegram chats lose CIA. Which raises the question why not use standards?
- x092 8y ago
  They were, actually. MtProto v2 satisfies IND-CCA now as opposed to what the blog post claims: https://core.telegram.org/techfaq#what-about-ind-cca https://core.telegram.org/techfaq#what-about-ind-cca
- raverbashing 8y ago
  So Signal and others are not "homebrew crypto"? That criticism is fair a lot of times, but every higher level crypto construction is going to be unproven for a while until checked. It's not like they were inventing their own hash function and stream cypher.
  - tptacek 8y ago
    Signal is the best-studied multiparty secure messaging protocol; there are academic papers that provide formal analyses. Trevor and Moxie won the Levchin Prize at Real World Crypto for Signal Protocol; the Levchin steering committee is a "Who's Who" of cryptographers, as are the other winners of the prize. No, Signal is not "homebrew crypto".

d0mine 8y ago

To summarize: there is a theoretical concern about the MTProto protocol used by Telegram. Mentioning "nation states" is laughable and it seems everybody should be reminded that not only advertisers have access to "metadata" generated by their mobile devices. To make the life less convenient but more "secure", one could enable "secure chats", set an explicit password and don't allow access to the Contacts on iOS.

aasasd 8y ago
> Mentioning "nation states" is laughable In some countries, a “nation state“ is pretty much every local police chief and prosecutor who like their comfy and paying positions a lot, don't like having too many loud democracy advocates around, and know who to call in such cases. People tend to forget that the state is basically evolved mafia.
opencl 8y ago
A theoretical concern about MTProto that was already fixed over a year ago with MTProto 2.0.

fabiandesimone 8y ago

I checked Threema because of this post (didn't know about it) and while searching, some people are complaining about it being under control of the Russian gov? Does anyone know anything about this? https://www.newsbtc.com/2017/10/04/crypviser-secure-messaging/ https://www.newsbtc.com/2017/10/04/crypviser-secure-messagin...

dbrgn 8y ago
Threema does not fall under Russian jurisdiction, so no. http://www.ewdn.com/2017/03/16/russia-adds-intrernational-messenger-threema-to-official-registry-with-a-view-to-control-users-communications/ http://www.ewdn.com/2017/03/16/russia-adds-intrernational-me... > Interviewed by Runet Echo, a Threema spokesperson said, however: “We operate under Swiss law and are neither allowed nor willing to provide any information about our users to foreign authorities.”
- gsich 8y ago
  That seems suspiciously specific. >foreign authorities This reads as "but local authorities are no problem" to me.
  - dbrgn 8y ago
    Check out the transparency report for details: https://threema.ch/en/transparencyreport https://threema.ch/en/transparencyreport
jsn 8y ago
This is just Crypviser spreading lies. No, being on that Russian register doesn't imply any intention to comply with any wiretapping / censorship requests; in fact, IIRC, it doesn't even necessarily imply any consent to being added to the register. Saying that Treema's being added to the register means it "moved under the control of the Russian government" is no different than adding their company name and address to some Excel file on your computer and then saying that Threema has moved under your control.

lucb1e 8y ago

Any reason you mention Signal and Threema but not Wire? Wire is objectively superior as far as I can tell. For a quick (probably incomplete) comparison, Wire has proper multi-device support (not sure how Threema does that), open source and cross-platform clients and open source server (Threema does not appear to have a Linux client nor publishes sources as far as I can tell), it's free (allowing everyone to use it, even if you're in a country where it's hard to pay from), it has a proper profit model (unlike Telegram, and to a much lesser extent Signal), and it does not require a phone number. The two major downsides of Wire is the battery usage due to all clients being Electron, and that few people know about it (hence my prompt to give them a mention). Not major stoppers I'd say...

wtmt 8y ago
I like Wire and use it with some people. It allows signing up with email and supports up to three accounts on a device. But I do find it to be a bit slow, mainly in sending as well as downloading images where it’s painfully obvious. Telegram is better on many counts and is a very nice app to use. Usability will usually beat other factors when it comes to mass adoption. Signal is the last on my list (it’s slow and unreliable, setting up an account is a coin toss because the verification process wouldn’t work, can’t move chats to a new device, etc.).
- otachack 8y ago
  I believe you can move chats between devices, they just have to be sourced from Signal and not SMS. SMS/MMS chats are what you may be talking about as immovable from Signal. Those are not shared between your Signal devices for security purposes, I imagine. You can back these up or move them yourself separately. Also, Signal device linking only works between one mobile device and multiple desktop clients. To move between mobile devices it requires a Signal chat backup and restore.
  - wtmt 8y ago
    It’s just not possible to move Signal chats from one iOS device to another (on iOS, Signal and SMS are not connected). Signal prohibits backing up of the data to iTunes and to iCloud. So there’s no way to make this work. That’s how it has been, and Signal does this for “security reasons”.

arctica123 8y ago

Does anyone have experience with using Matrix [0] as an alternative to Telegram and Signal? Maybe even running your own homeserver which stores your history on a server you control and syncs that across all devices? As far as I saw you can also bridge to other messaging services, even to WhatsApp [1] which is why it might be worth a try. [0] https://matrix.org/blog/home/ https://matrix.org/blog/home/ [1] https://github.com/tulir/mautrix-whatsapp https://github.com/tulir/mautrix-whatsapp

pinusc 8y ago
I'm currently self-hosting a Matrix homeserver! I got a few friends to join me and we use it to chat daily. I can't really speak for its security. Afaik the protocol is almost considered stable, and I trust it for everyday communications — but I wouldn't trust it if dealing with a nation-state level adversary. The only privacy pain point is that if you run a synapse home server (the reference implementation), by default your voice and video chats are routed through Google's servers. You have to run your own TURN server alongside synapse to prevent this. This is fine, but imho it's not well explained on the install guide. Riot is... Okay. It's great ffor power users, but imho is quite obscure for the average chat app user; the ux isn't great yet. Perhaps with the redesign... Lastly, bridges are the biggest reason why I want matrix to succeed... But as of now, none of them are really useful or even usable. They're all in very early stages of development and need contributions.
- squeezingswirls 8y ago
  >Lastly, bridges are the biggest reason why I want matrix to succeed... But as of now, none of them are really useful or even usable Why do you say that? I know many projects using bridges successfully. For example the UBports [0] guys have bridges between their Telegram and Matrix rooms. Besides FluffyChat [1] works wonderfully on UT phones, so that's a plus for them. [0] https://ubports.com/ https://ubports.com/ [1] https://christianpauly.github.io/fluffychat/ https://christianpauly.github.io/fluffychat/
squeezingswirls 8y ago
Yes, I do. If you have 39 minutes to spare I recommend you to watch this Ben Parsons talk at 35c3 https://media.ccc.de/v/35c3-9400-matrix_the_current_status_and_year_to_date https://media.ccc.de/v/35c3-9400-matrix_the_current_status_a...

wscott 8y ago

Keybase.io is an alternative for secure chats. Anyone know how it compares to signal, wire & threema?

otachack 8y ago
I think Keybase does chat well and their code is open source. One issue I see with them is that they seem in a perpetual beta phase, so who knows how dependent you can be on their software. I also don't like the React Native based phone apps as they don't feel native and lack polish. I also worry about them having joined the crypto train with no reason besides being backed up by Stellar foundation. The stake from Stellar into Keybase isn't clear and may influence decision making in direction of Keybase. The chat clients do have a nifty feature of setting up a time based, self destroying message. And you can share git repos within your registered clients and peers. They also have a shared filesystem and team based chat. You can also generate a PGP key pair for identity. The feature list is vast. The main point of Keybase is also sound in my book, which is to have a network of proof such that you can prove who you are in your correspondence in whatever social media or chat you use. You can even use the encryption / decryption services of Keybase only and send the encrypted payloads however you'd like. I think with more polish on their clients and proven stability that Keybase will be a great service to depend on. But I do think they need more personnel and/or they need to step up on their social aspect because their last blog post was 200 days ago.
- wscott 8y ago
  I hear you. The blog post about Stellar made me very nervous. https://keybase.io/blog/keybase-stellar https://keybase.io/blog/keybase-stellar However, I get more nervous about use software without an obvious means of support for the developers so it would be nice if they can fill some nitch and make money as long as they don't kill the current client.
- jillesvangurp 8y ago
  Keybase is nice indeed. I think what they are doing with their network of proofs is somewhat unique in this space and makes end to end crypto usable for the masses (unlike e.g. pgp). I agree they UI is not as slick as slack or telegram but nothing that they won't be able to fix with a bit of love and attention. Fixing this is expensive, however. Hence their association with Stellar for funding. It's worth pointing out that Telegram has recently funded itself with an ICO as well. They are very well funded and they have a huge user base. IMHO investor/greed driven walled gardens have long been a problem in this space and is also the reason email is still around because despite its many flaws, it has one feature that is incompatible with running a walled garden: it is federated and decentralized from the ground up. Anybody can run a server and email clients that lock you into communicating only to users on one server went extinct in the nineties. With chat, it seems there is a pattern of perpetually recreating walled gardens with a single all powerful company at the center. This has been going on since the days of ICQ, AIM, Yahoo messenger, MSN and all those other long forgotten products that each did more or less the same thing and each tried to own your network. Strictly speaking, there's actually very little that differentiates modern day chat apps from those early chat apps in terms of what they do. Signal just got a capital injection from the whatsapp founders. I like that Signal are setup as a foundation and that their stack is intentionally completely open source end to end and yet easy to get into for on techie users. This breaks the pattern of centrally controlled for profit walled gardens as the only option. And this makes them somewhat unique in this space: they are now well funded, independent, and widely respected by people that care about communicating securely, and their mission is keeping it like that. I'm not that eager to swap out Whatsapp for Telegram. Ultimately, I don't trust either of them to do the right thing. But, arguably Whatsapp is somewhat more secure because at least it uses Signal's crypto. I use Keybase because I find their setup intriguing. And of course, I have Signal installed on principle but it seems none of the people I normally chat with are on it. I hope that they can fix that. But realistically, I seem stuck on Whatsapp, which I've never liked because it is such an inferior product compared to almost anything I've used for chat in the last 20 years (fugly UI, limited feature set, no decent desktop client, etc.). But world + dog seems to be on it so there's that.

amaccuish 8y ago

> Telegram links an account to a telephone number. > If you want to use secure and private apps, I recommend: Signal Private Messenger: https://signal.org.. https://signal.org... I feel it's wrong to criticise Telegram for using phone numbers, and then in the same breath recommend Signal.

Erlich_Bachman 8y ago
Why do all messengers keep requiring phone numbers? Is it because of the problem of spam? Couldn't this easily be prevented by for example requiring consent before sending messages to new contacts? You could for example have it work 2 ways: 1) require a phone number connected to message unknown contacts. 2) without phone number, requiring prior consent from any new unknown contact, to message them.
- nebulous1 8y ago
  Ease of use
- unicornporn 8y ago
  > Why do all messengers keep requiring phone numbers? Matrix/Riot.im and Wire doesn't. I think they're both good alternatives.
  - ekianjo 8y ago
    Wire only if you register first on a computer. from the phone if you create an account you have to use your number.
    - walterbell 8y ago
      They seem to have changed this now, you can register with an email address from mobile. It still asks for a phone number, but you can say no.
      - 8y ago

VvR-Ox 8y ago

Threema is proprietary and I think it's dangerous to recommend it as an alternative. Everything we trust should be open. Telegram is not perfect but better than WhatsApp. Also there is people who want convenience like history sync - it won't help telling them that it's unsecure. In the end at least facebook doesn't have their data. For NSA etc. it's not that important where stuff is. From the leaks we know they can do everything they want (expertise + huge money) so if you want something more secure you maybe shouldn't use one of the popular solutions at all ;-)

xashor 8y ago
It doesn't relly matter that much if Facebook has your metadata or Telegram has your metadata. What's more important: WhatsApp E2E is more secure than Telegrams self built E2E, that needs to be enabled and doesn't support group chats. Also, Telegram isn't that open source either: server side is closed source and the client side seems to be still an undocumented, mirrored mess. So for me at least, as I don't want anyone that easily to read my messages: many other solutions > WhatsApp > Telegram.
- enitihas 8y ago
  Isn't Telegram open source strictly superior than WhatsApp open source? WhatsApp has neither client side nor server side code available(server side doesn't mean much anyways, as Good luck verifying if that is the code which runs on some server).
chappi42 8y ago
> Threema is proprietary and I think it's dangerous to recommend it as an alternative. Everything we trust should be open. On the other hand, they have been audited [1], have transparency reports [2] and their servers are Swiss based [3]. Yes open source would be nice, but a relative small company with a focused business model (not dependent on advertisement, data-gathering, donations, kind [bi|mi]llionairs) has its advantages too. I'm using Threema since some years and wouldn't want anything else. [1]: https://threema.ch/en/faq/code_audit/ https://threema.ch/en/faq/code_audit/ [2]: https://threema.ch/en/transparencyreport https://threema.ch/en/transparencyreport [3]: https://en.wikipedia.org/wiki/Threema#Privacy https://en.wikipedia.org/wiki/Threema#Privacy

Gasp0de 8y ago

"Telegram provides a feature called "Links previews" that's available and on by default in not encrypted chats, anyways if you use a "Secret chat", Telegram app ask to you if you want to use "links previews" adversiting that it previews are done in the server side. How can they know what links are you writing? Can they read your messages still if you are using "Secret chats"? (Not sure but is a edge case)." They probably do pattern matching on the app, why would they need to send anything to the servers for content previews?

morrbo 8y ago
Not verified but i'd imagine the retrieval of the metadata (the cards/tags needed to show the image previews, etc.) is done by proxying via telegram servers, possible to prevent semi-doxxing someone (returning their real IP) just by sending them a message?

wtmt 8y ago

This post has some useful information, but the recommendation of other centralized platforms that rely on a phone number make this post seem like the pile of FUD that Telegram has been enduring for long. Contact theft, metadata, susceptibility to phone number for setting up or verifying an account are issues shared by the other recommendations too. [1] For someone who doesn’t know much about security, it comes down to “who can be trusted”, and that question applies to Signal and Threema too. [1]: Edit. I wasn’t aware that Threema does not require phone numbers. Thanks to dbrgn for correcting me.

dbrgn 8y ago
Threema does not rely on phone numbers. You can use it anonymously, and you can add other contacts without knowing their phone number. More details can be found in the crypto whitepaper: https://threema.ch/press-files/2_documentation/cryptography_whitepaper.pdf https://threema.ch/press-files/2_documentation/cryptography_...

tinus_hn 8y ago

So storing data remotely is now a security nightmare? It doesn’t really help to exaggerate like this.

mfwoods 8y ago
Not necessarily. But storing them in plain text on the server and all history accessible just by hijacking a phone number (or a single text message) is, considering the alternatives, don't you agree?
- jhasse 8y ago
  How do you know that it is stored in plain text on the server?
  - mfwoods 8y ago
    Because there is no end to end encryption (other than some very limited temporary one on one chats that only work between two mobile devices) which means the server can (and does) read and store all your messages. Getting access to your full chat history is as simple as intercepting a single text, because the server has access to your plain text messages. They might do some form of encryption to store the messages, but this is meaningless when they also have access to the keys and can decrypt any message whenever they want.
    - tinus_hn 8y ago
      So in essence, like about any service that performs manipulations on your files? Like a storage service that creates thumbnails of your photos?

yogthos 8y ago

So, here's the thing I'd like somebody to explain to me. Telegram encryption spec is published, and the client is open source. This means you can verify that the server is following the spec by creating a clean room client implementation. You could even create a green field server implementation if you wanted. Telegram regularly has contests to break its encryption with a reward of 300K USD https://telegram.org/blog/cryptocontest https://telegram.org/blog/cryptocontest If it's not secure, then surely people would be cashing in on that sweet money. So, why is it that we constantly see articles talking about how insecure Telegram encryption is, but nobody is showing a proof of concept attack or collecting the prize? Unless somebody puts their money where their mouth is and shows an actual exploit with code, it seems like pure FUD to me. On top of that, it appears that attacks on Telegram often come from people associated with Signal in some way. Signal is endorsed by NSA who have a history of promoting weak encryption that they have found backdoors into. I hope everybody still remembers this debacle https://golem.ph.utexas.edu/category/2014/10/new_evidence_of_nsa_weakening.html https://golem.ph.utexas.edu/category/2014/10/new_evidence_of...

xashor 8y ago
>Telegram regularly has contests to break its encryption with a reward of 300K USD https://telegram.org/blog/cryptocontest https://telegram.org/blog/cryptocontest >If it's not secure, then surely people would be cashing in on that sweet money. So, why is it that we constantly see articles talking about how insecure Telegram encryption is, but nobody is showing a proof of concept attack or collecting the prize? regulary != 2 times with limited time. Also, E2EE is not only about decrypting a message. E.g. signing messages as someone else isn't awarded. Also, you might need a lot of computation power. SHA-1 used in MTProto 1.0 for example is practically pretty secure, but not against a well funded attack. But that aside, Telegram's encryption is probably good enough. But we already have standards that are good enough. Why risk it? For example, from On the CCA (in)Security of MTProto[0]: >Telegram is a popular messaging app which supports end-to-end encrypted communication. In Spring 2015 we performed an audit of Telegram's Android source code. This short paper summarizes our findings. Our main discovery is that the symmetric encryption scheme used in Telegram -- known as MTProto -- is not IND-CCA secure, since it is possible to turn any ciphertext into a different ciphertext that decrypts to the same message. >We stress that this is a theoretical attack on the definition of security and we do not see any way of turning the attack into a full plaintext-recovery attack. At the same time, we see no reason why one should use a less secure encryption scheme when more secure (and at least as efficient) solutions exist. >The take-home message (once again) is that well-studied, provably secure encryption schemes that achieve strong definitions of security (e.g., authenticated-encryption) are to be preferred to home-brewed encryption schemes. And that aside, E2EE is not default and neither E2E group chats or E2E video calls are supported. This is the biggest security problem. [0] https://dl.acm.org/citation.cfm?id=2994468 https://dl.acm.org/citation.cfm?id=2994468

dm33tri 8y ago

Telegram is popular because of it's convenience, not security. I've tried using whatsapp and the app seemed so much inferior: no nicknames, crippled desktop client, no separate contact list. It happened so that telegram became some kind of standart for formal chatting in my country (universities, businesses, journalists, officials use it) even thought it's blocked by ISPs (still works fine most of the time), I think mainly because you don't have to expose your phone number to be contacted and you can easily use it on desktop (also bots, I know one big store chain that uses tg bots for managing your bonus programme).

qwerty456127 8y ago

> Telegram provides a feature called "Links previews" that's available and on by default in not encrypted chats, anyways if you use a "Secret chat", Telegram app ask to you if you want to use "links previews" adversiting that it previews are done in the server side. How can they know what links are you writing? Can they read your messages still if you are using "Secret chats"? (Not sure but is a edge case). It feels reasonable to assume the Telegram client detects the links (using a regexp or something) and sends them to the server side. Of course they see the links if you ask them to but this doesn't mean they also see all the text.

localguy 8y ago

https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/htmlview?sle=true https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal... Digital Communications Protocols

zelon88 8y ago

Sounds more like this guy works for a competitor than a security firm. No proof, and he apparently didn't even test his own theories. And the whole "Telegram isn't secure because nation states can abuse their telcos to break 2fa" is, while accurate, also true for about 90% of the internet. And what's with this method of disclosure? It's not ethical or responsible. It's plain defamatory.

TACIXAT 8y ago

Let me preface this by saying I work in security and use Signal. That said, the security industry can be incredibly obtuse at times. End users don't care. Full stop. Having the best encryption isn't a selling point to the masses. I'm making a chat app right now and I'm doing it exactly the same way as Telegram, unencrypted by default with an E2E private chat option. Why? Search. I don't need E2E. I use it based on principle. I do need to be able to search my conversations. As long as the chat provider is trusted, I'm happy to have my messages in plain text to be searchable and I think 99% of end users feel the same way.

nitrogen 8y ago
Why can't search be done entirely client side?
- TACIXAT 8y ago
  It could, with IndexedDB or similar, but then you have a massive conversation history being stored on user devices. Space is a precious commodity on phones.
  - xashor 8y ago
    For text? Nah. Most apps automatically store photos on your device, and that's fine. Mobile phones have several GB for storage. That is enough for hundred thousands of messages, before even noticeable. Please reconsider your E2E policy and don't make the world a more insecure place.

xte 8y ago

Telegram is insecure by nature because it's a proprietary service. It doesn't really matter much how is coded or how appear to be coded. Not to reduce the value of author's analysis of course, but just to clarify a point: no proprietary service can be considered secure, no matter how good and well intentioned it's property is.

gtirloni 8y ago
Unless you're advocating for P2P chat, I don't see how it's any different for open source solutions. At some point you have to trust the people hosting the centralized servers, OSS or proprietary.
- xte 8y ago
  Of course, we need decentralized solution at minimum, distributed at best. Also about trust: I can trust a bit certain kind of paid hosting/services, for instance companies that are in my country under my country law can be trusted in the sense that I have a certain kind of legal protection and a clear signed contract. It does not stop them do thing I can't know with my data but I have few options. Against services hosted elsewhere in the world with "not-real-contracts" and zero formal fee my possibility of action is essentially ZERO so I can't even being protected by my country's law.

fiatjaf 8y ago

All these criticisms apply to Gmail, Slack, Hangouts, Skype, whatever.

saagarjha 8y ago
None of these use “security” as their a primary component of their advertising strategy.

saagarjha 8y ago

> When registering an account with Telegram, the app helpfully uploads the entire Contacts database to Telegram's servers (optional on iOS). The Telegram iOS client has started pushing dark patterns to get me to upload my contacts: it now shows a perpetual “badge” in the app’s main tab view (so that I can’t ever miss it), as if it has an error or alert it needs to tell me about. If I tap on it Telegram will helpfully tell me, on a visually broken page, that I should please allow Telegram to access and upload all my contacts to “seamlessly find all my friends” (like I needed this).

Fins 8y ago
You my not need it, but FSB sure does.

nithinm 8y ago

The whole article is based on the fact that secret chats are not enabled by default. But i dont understand why that's a critical point, if you are so worried about privacy just start a secret chat. Also from what i can understand its a design decision telegram took. If the secret chats are always on then the private key needs to be transfered from device to device and on new devices,which is a security risk. The points about the contacts is right though. Also i am a strict no for closed-source privacy app. Even though telegrams code is open, the repo is handedly very badly. With squashed commits pushed once in few months, issues disabled.

saagarjha 8y ago
> But i dont understand why that's a critical point, if you are so worried about privacy just start a secret chat. Usability is important. The more steps you put in the way of security, the less likely people will do the right thing.

enitihas 8y ago

I think we should always remember that users want usability too and most of the times aren't willing to surrender features for the extra gain in security. If users preferred security, a lot more people would be using PGP.

grugq 8y ago

Not sure what the policy is on plagiarism, but this post plagiarized my write up. The structure is the same and the section headings are the same. It is blatant plagiarism. https://link.medium.com/cWfUtKQjgT https://link.medium.com/cWfUtKQjgT

markbnj 8y ago
I've had a couple of popular medium posts copied by a person looking to boost the visibility of his consulting company site. It's frustrating, but I think ultimately it does the thief more harm than good.
huehehue 8y ago
They added references a couple of minutes ago, I think very large chunks of their post should still be in quote blocks though. Great writeup btw, grugq https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca669c86998154c9e840f10 https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca...
- grugq 8y ago
  Thanks
rrdharan 8y ago
Author just edited it and added your post as a reference: https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca669c86998154c9e840f10 https://gitlab.com/edu4rdshl/blog/commit/2fc4d85714d2bde3aca... ... + 7 https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a https://medium.com/@thegrugq/operational-telegram-cbbaadb901... by https://twitter.com/thegrugq https://twitter.com/thegrugq
- grugq 8y ago
  He did only after I publicly called him out[0]. And it is still plagiarism. “Plagiarism is the "wrongful appropriation" and "stealing and publication" of another author's "language, thoughts, ideas, or expressions" and the representation of them as one's own original work.”[1] [0] https://twitter.com/Edu4rdSHL/status/1081971696431706113 https://twitter.com/Edu4rdSHL/status/1081971696431706113 [1] https://en.m.wikipedia.org/wiki/Plagiarism https://en.m.wikipedia.org/wiki/Plagiarism

ancarda 8y ago

Sadly switching to Signal, Wire, and other "technologically superior to Telegram" apps means a drop in user experience. For example, I tried switching to Wire recently but I found that setting up a new device means I wouldn't have access to my old messages. I understand these apps don't want to upload messages to a server, but can't messages be synced between clients? Even if I had to scan a QR code on my phone to sync with my laptop and had to stay on the same Wi-Fi network until it was done, it could then sync historical messages. I have Telegram messages from 2015 when I had a different computer, laptop, phone, and lived in a different house. This is also why I don't use the secret chat on Telegram. As soon as you add too much encryption and security you have to trade-off usability. Must it always be that way? If you have to chose between security and usability, people will always choose usability.

przmk 8y ago
This is a pretty big issues for me as well. In terms of user experience on desktop, all the other apps are complete garbage. Telegram has a native client for all major platforms written in Qt that has all the features the mobile app has (except for secret chats). Everything else feels slow, unresponsive and has poor features.
kitsunesoba 8y ago
Those other more secure chat apps also treat desktop as an afterthought or worse, which is simply not acceptable for my use case. I live at my desk, not on my phone, and expect desktop to be treated as a first class citizen. At present, the only two services that do this are iMessage and Telegram, so I use iMessage with everybody with Apple stuff and Telegram for everybody else.

john4534243 8y ago

Telegram does not store private keys only on client. On the other hand telegram splits the private key and stores in multiple severs in several countries making it legally very very hard to process requests. But this also means the founders or just some developer who has access to the servers can read the messages as they have access to private keys. Signal app is more secure.Signal app does not store private keys on the server. The following faq is from telegram site. Q: Do you process data requests? Secret chats use end-to-end encryption, thanks to which we don't have any data to disclose. To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, several court orders from different jurisdictions are required to force us to give up any data. Thanks to this structure, we can ensure that no single government or block of like-minded countries can intrude on people's privacy and freedom of expression. Telegram can be forced to give up data only if an issue is grave and universal enough to pass the scrutiny of several different legal systems around the world. To this day, we have disclosed 0 bytes of user data to third parties, including governments. ### End of Faq #### Even the secret chats in telegram are not secret because the protocol is custom developed by amateurs devs. It is not tested and have seen some articles on methods to attack, could not get the link now.