5 ms·
I see a lot of people fixating on the contest here, however you don't have to go through the contest to publish an exploit. I'm pretty sure Intel didn't hold an
by yogthos 8y ago
I see a lot of people fixating on the contest here, however you don't have to go through the contest to publish an exploit. I'm pretty sure Intel didn't hold an exploit contest for Meltdown and Spectre, yet actual legitimate researchers found a vulnerability and published how it can be exploited along with a proof of concept implementation.
When I see the equivalent done for Telegram I'll start taking the claims seriously, until then it's just noise.
- throwawaymath 8y agoI'm not fixating on anything - you were the one who highlighted the contest and its lack of winners as the first part of your argument for Telegram's security: > Telegram regularly has contests to break its encryption with a reward of 300K USD > If it's not secure, then surely people would be cashing in on that sweet money. Like I said in my first comment, all I'm doing is explaining why a contest requiring known ciphertext attacks is not evidence of cryptographic security. You originally spoke to this point, and I am responding about that point in particular because it's a topic I know intimately well. You can double down on your second point about there being no published exploits; that's not something I can confidently speak to. I think there are reasonable counterpoints citing serious vulnerabilities are not always publicized, but I'll leave it to others to discuss that point. It's not my goal to convince you that Telegram is insecure. What is important from my perspective is that you understand contests are in fact contrived and noisy, and should not be considered evidence of cryptographic security whatsoever.