4 ms·

Feel free to scrutinize Telegram's crypto and E2E implementation for secret chats. It's open source and you can find it here: https://github.com/tdlib/td https:

by GranPC 8y ago

Feel free to scrutinize Telegram's crypto and E2E implementation for secret chats. It's open source and you can find it here: https://github.com/tdlib/td https://github.com/tdlib/td

rvnx 8y ago
Yep, did it, not going to use Telegram now. Love the unsecure TLRPC objects deserialization that actually makes the native client crash and to not verify what other clients have sent: https://raw.githubusercontent.com/DrKLO/Telegram/e397bd9afdfd9315bf099f78a903f8754d297d7a/TMessagesProj/src/main/java/org/telegram/tgnet/TLRPC.java https://raw.githubusercontent.com/DrKLO/Telegram/e397bd9afdf... and the tons of magic and undocumented numbers in the code: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/jni/tgnet/Handshake.cpp#L278 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...
- empthought 8y ago
  Crashing in the face of invalid and likely malicious input is a secure approach (fail fast).
  - saagarjha 8y ago
    Depends on whether the crash is intentional :/