3 ms·

IIRC Telegram always was willing to share with security services message history from non-secret chats and groups. The problem was the idiotic requirement to gi

by fuoqi 6y ago

IIRC Telegram always was willing to share with security services message history from non-secret chats and groups. The problem was the idiotic requirement to give keys for E2EE chats.

insensible 6y ago
I read the court case in translation at the time. The opposite is true. The government acknowledged in court that keys for E2EE chats were not possible to surrender, but they had terrorists using non-E2EE groups to coordinate an attack and Telegram didn't produce those keys either.
- fuoqi 6y ago
  Can you link it? The relevant law written in a really stupid manner, it requires to give keys for decrypting communications, which in case of TLS means session keys. Of course no sane company would log them, so they have nothing to give in the first place. But refusing to share keys speaks nothing about sharing messages themselves. One justification for sharing keys could be that security services want to use data recorded by SORM (and nowadays we also have the goddamn Yarovaya law) as an evidence and to do that you have decrypt it. Luckily for us modern security frameworks are built around ephemeral keys and forward secrecy.
eitland 6y ago
Telegram say they have gone pretty far to make sure they cannot get hold of private messages - even the ones who aren't E2E-encrypted. How? As far as I understand by having the client download encrypted messages from one Telegram server and keys from another and then place those servers in different datacenters in different jurisdictions. FTR: of course I am aware that unlike E2E-encrypted messaging in this case you have to trust the vendor. If you do is up to you. I trust them more than WhatsApp (who are E2E-encrypted but backup to NSA^HGoogle and try to extract all kinds of metadata) and less than Signal (even though Signal has had at least one horribly security glitch). One more thing: Telegram are also pretty open on the fact that they take down public terrorist content.

by fuoqi 6y ago

IIRC Telegram always was willing to share with security services message history from non-secret chats and groups. The problem was the idiotic requirement to give keys for E2EE chats.

insensible 6y ago

I read the court case in translation at the time. The opposite is true. The government acknowledged in court that keys for E2EE chats were not possible to surrender, but they had terrorists using non-E2EE groups to coordinate an attack and Telegram didn't produce those keys either.

fuoqi 6y ago
Can you link it? The relevant law written in a really stupid manner, it requires to give keys for decrypting communications, which in case of TLS means session keys. Of course no sane company would log them, so they have nothing to give in the first place. But refusing to share keys speaks nothing about sharing messages themselves. One justification for sharing keys could be that security services want to use data recorded by SORM (and nowadays we also have the goddamn Yarovaya law) as an evidence and to do that you have decrypt it. Luckily for us modern security frameworks are built around ephemeral keys and forward secrecy.

eitland 6y ago

Telegram say they have gone pretty far to make sure they cannot get hold of private messages - even the ones who aren't E2E-encrypted. How? As far as I understand by having the client download encrypted messages from one Telegram server and keys from another and then place those servers in different datacenters in different jurisdictions. FTR: of course I am aware that unlike E2E-encrypted messaging in this case you have to trust the vendor. If you do is up to you. I trust them more than WhatsApp (who are E2E-encrypted but backup to NSA^HGoogle and try to extract all kinds of metadata) and less than Signal (even though Signal has had at least one horribly security glitch). One more thing: Telegram are also pretty open on the fact that they take down public terrorist content.