6 ms·

There's so much FUD here about how this must mean Telegram is now insecure, backdoored etc. I sure hope those voicing these opinions actually have used Telegram

by hnarn 6y ago

There's so much FUD here about how this must mean Telegram is now insecure, backdoored etc. I sure hope those voicing these opinions actually have used Telegram and understands how it works: - Telegram does log chats server-side if you want them to (to be able to see your chat history across devices). You don't have to. Telegram supports end-to-end encryption ("secret chats") with no logging -- as far as I know there is no proof that these chats are untrustworthy. - Telegram groups have never been sacred and they are deleted if they spread illegal information. This is not the same thing as leaking someone's personal chat history, which to my knowledge has still never been done. I'd be glad to be proven wrong on any of these counts, I use both Telegram and Signal and trust the latter more for obvious reasons (it's completely open source) -- but the fact that Telegram is not perfect in every way does not make it insecure by default.

lucideer 6y ago
> Telegram does log chats server-side if you want them to Trying to assume good faith here that this is accidental and not trying to deliberately mislead but the way this is phrased strongly implies that server-side logging is off-by-default. It is not. Nor are secret chats prompted or prominently advertised in the UI (it's the 2nd option when you go to create a new group, never seen when initiating new 1:1 conversations). I would wager most Telegram users don't know about secret chats, or if they have heard of them they probably assume they're on by default.
shanecoin 6y ago
> Telegram supports end-to-end encryption ("secret chats") with no logging -- as far as I know there is no proof that these chats are untrustworthy. The argument I've heard is that Telegram uses their own encryption protocol. The rule of thumb in cryptography is "don't roll your own crypto". The reason why that statement exists is because there are _countless_ examples of teams coming up with their own, new cryptographic mechanisms that either break (intentionally or not) or were written with a backdoor. People get incredibly clever when it comes to breaking encryption. AFAIK the only way to be on the right side of this argument is to use a time-tested encryption protocol. However, there are even instances where some protocols have been live and in production for x years before discovering that a backdoor has been in the code since day one.
- codezero 6y ago
  This is a fun phrase, that as a non-crypto person seems reasonable, but I always wonder if there's something of a confirmation bias. > The reason why that statement exists is because there are _countless_ examples of teams coming up with their own, new cryptographic mechanisms that either break... But aren't there _countless_ examples of this in crypto made by cryptographers? I'm not playing devil's advocate, I don't really have a stake here. :)
  - rodgerd 6y ago
    Not a crypto expert either, but from what I've gleaned listening to e.g. Peter Guttman describe evaluating new crypto mechanisms, you'll see that: 1. Actual cryptographers usually design with a set of constraints that make their crypto work: those might be about compute power, or memory bandwidth, or what have you, that make an algorithm difficult to brute force. 2. The algorithm will typically be peer-reviewed to try to weed out mistakes, either fundamental mathematical ones, or in the assumptions. 3. The implementation then needs to be high quality. There are certainly no shortage of examples where systems which pass 1 & 2 are undermined by failures in 3. All algorithms are susceptible to the context around 1 changing (changes in compute power or whatever). When you go it alone, you're assuming that you won't make any mistakes any of these. That seems a pretty tall order.
  - nyokodo 6y ago
    The principle is that cryptography is so hard that even the experts screw up, but non-expert chances of screwing up are so much greater.
    - saalweachter 6y ago
      I would phrase it more as "there is no margin of error in cryptography". In machine learning, a model that works 90%, 95% of the time is pretty good. A glitchy video game can still be fun as long as the glitches don't happen too often or cause a loss of too much progress. Even a filesystem that doesn't lose most people's data, most of the time, will have a lot of adherents. But if your cryptography implementation isn't completely perfect, it's frequently just 100% useless for its intended purpose.
Avamander 6y ago
> but the fact that Telegram is not perfect in every way does not make it insecure by default. It literally does though.
- ummonk 6y ago
  Right. It has the ability to opt-in to E2EE messaging, but by default it's insecure.
cookiengineer 6y ago
The Pentagons guideline for secure military conversations allowed to chose between threema, whatsapp or signal - but they explicitly forbid usage of telegram. At the time I knew about the voice call remote exploit in whatsapp due to their outdated hardfork, and I knew about the XSS RCE bug in signal’s innerHTML mess... so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted on. You can meanwhile look that information up on vault7 or snowden leaks, so it’s already publicly disclosed. Anyways, if you feel safe using a stock Android ROM that isn’t AOSP and is still using legacy 3.x or 4.x kernels... your general assumption on what is secure is wrong. Having said that, I don’t know whether palantir’s gotham has access to telegram’s servers. But given their workforce and sheer amount of RE they hire, the likeliness of telegram being a target is very high. So with all that in mind I’d recommend telegram only with AOSP head and only with secret chats. You don’t stand a chance if you are using the public clearnet routing protocols either way. And this is assuming that you don't use Windows and something like a hardened Kali or Arch-based distro that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually check every source from AUR. If you use Windows 10, you can forget security. If you use Ubuntu or Debian, you can forget security. If you use Steam, you can forget security. If you play any networked games on any of your machines, you can forget security. Joyful times where private organizations with nearly unlimited resources "hack the planet" and seemingly get away with it.
- ngz00 6y ago
  Is it really Clearnet if there is end to end encryption?
- Angeo34 6y ago
  If I run applications as a different user or in a chroot without root access how can there be security issues for any other users even if it's some game running through steam
  - cookiengineer 6y ago
    > chroot Personally I wouldn't trust chroot alone. There were some privilege escalation bugs available in the past from "forgot to sandbox the cwd" [1] to more sophisticated exploits via "nsswitch in docker" [2]. But, of course, given the amount of bugs I'd say that chroot is as secure as it can get. But always take everything with a grain of salt, chroot developers also make mistakes, like everyone. The problem with chroot is not chroot itself, but all the libraries linked in the binaries. And if I know any statement to be true, it's that game developers on Steam don't give a damn about correctly linking anything. I mean, they even don't get 64bit right. And we have 64bit architecture mainstream since 2005 or so... [1] https://github.com/aykit/chroot-privilege-escalation https://github.com/aykit/chroot-privilege-escalation [2] https://nvd.nist.gov/vuln/detail/CVE-2019-14271 https://nvd.nist.gov/vuln/detail/CVE-2019-14271
johnisgood 6y ago
- Telegram does NOT support E2E encryption on their desktop and web version of the software.[1] - Telegram requires a phone number and in my country for example it is tied to you (yes, you need to sign a contract for even a prepaid SIM card). [1] https://tsf.telegram.org/manuals/e2ee-simple https://tsf.telegram.org/manuals/e2ee-simple
- maqp 6y ago
  Also, - Telegram does NOT support E2E encryption for group chats on any platform. - Telegram does not use E2E encryption for ANYTHING by default.
maqp 6y ago
"Telegram does log chats server-side if you want them to" No. Telegram forces you to log all Windows / Linux desktop client chats and all group chats to their server. You don't have a choice with those. Also all chats in general are logged by server by default. For Signal, the server being able to eavesdrop on 100% of group messages would be complete failure, a backdoor that would cause everyone to abandon Signal. For Telegram it's the primary design principle. So Telegram is in fact bacdoored by design. >Telegram groups have never been sacred Yeah it says that right there on the front page. This "obviously" propaganda actually hurts people, and not just in the way I die a little inside from reading it > This is not the same thing as leaking someone's personal chat history This is no standard of anything. "Oh it's fine that Telegram and anyone who hacks their server spies on you, it's only problem if they intentionally leak your chat history". Screw this kind of thinking. >which to my knowledge has still never been done. I've never seen such moving of goal posts in my life. >I'd be glad to be proven wrong on any of these counts, You can't just define the context to your liking and then prance about when nobody can win the argument of your rigged rules. >but the fact that Telegram is not perfect in every way does not make it insecure by default. This is called nirvana fallacy. Signal isn't perfect either. But it's at least E2EE by default which is the norm these days. Your comment is not thoughtful at all, it's indistinguishable from shill arguments. I hope you feel ashamed. -- For profesional cryptographers and security experts, it's enough the first protocol wan't IND-CCA secure. That alone tells the professionals the app is no good to any extent. Telegram loses at that point and it'll never advance to some next round. There will never be a community based code review or stamp of approval, that ship has sailed. The developers have lost face permanently. The evidence of this is no professional cryptographer has recommended Telegram at any point. Instead, world-renowned experts like Schneier and Matt Green have adviced against using Telegram. There's nothing Telegram developers or the community can ever say that undoes expert opinion.

by hnarn 6y ago

lucideer 6y ago

> Telegram does log chats server-side if you want them to Trying to assume good faith here that this is accidental and not trying to deliberately mislead but the way this is phrased strongly implies that server-side logging is off-by-default. It is not. Nor are secret chats prompted or prominently advertised in the UI (it's the 2nd option when you go to create a new group, never seen when initiating new 1:1 conversations). I would wager most Telegram users don't know about secret chats, or if they have heard of them they probably assume they're on by default.

shanecoin 6y ago

> Telegram supports end-to-end encryption ("secret chats") with no logging -- as far as I know there is no proof that these chats are untrustworthy. The argument I've heard is that Telegram uses their own encryption protocol. The rule of thumb in cryptography is "don't roll your own crypto". The reason why that statement exists is because there are _countless_ examples of teams coming up with their own, new cryptographic mechanisms that either break (intentionally or not) or were written with a backdoor. People get incredibly clever when it comes to breaking encryption. AFAIK the only way to be on the right side of this argument is to use a time-tested encryption protocol. However, there are even instances where some protocols have been live and in production for x years before discovering that a backdoor has been in the code since day one.

codezero 6y ago
This is a fun phrase, that as a non-crypto person seems reasonable, but I always wonder if there's something of a confirmation bias. > The reason why that statement exists is because there are _countless_ examples of teams coming up with their own, new cryptographic mechanisms that either break... But aren't there _countless_ examples of this in crypto made by cryptographers? I'm not playing devil's advocate, I don't really have a stake here. :)
- rodgerd 6y ago
  Not a crypto expert either, but from what I've gleaned listening to e.g. Peter Guttman describe evaluating new crypto mechanisms, you'll see that: 1. Actual cryptographers usually design with a set of constraints that make their crypto work: those might be about compute power, or memory bandwidth, or what have you, that make an algorithm difficult to brute force. 2. The algorithm will typically be peer-reviewed to try to weed out mistakes, either fundamental mathematical ones, or in the assumptions. 3. The implementation then needs to be high quality. There are certainly no shortage of examples where systems which pass 1 & 2 are undermined by failures in 3. All algorithms are susceptible to the context around 1 changing (changes in compute power or whatever). When you go it alone, you're assuming that you won't make any mistakes any of these. That seems a pretty tall order.
- nyokodo 6y ago
  The principle is that cryptography is so hard that even the experts screw up, but non-expert chances of screwing up are so much greater.
  - saalweachter 6y ago
    I would phrase it more as "there is no margin of error in cryptography". In machine learning, a model that works 90%, 95% of the time is pretty good. A glitchy video game can still be fun as long as the glitches don't happen too often or cause a loss of too much progress. Even a filesystem that doesn't lose most people's data, most of the time, will have a lot of adherents. But if your cryptography implementation isn't completely perfect, it's frequently just 100% useless for its intended purpose.

Avamander 6y ago

> but the fact that Telegram is not perfect in every way does not make it insecure by default. It literally does though.

ummonk 6y ago
Right. It has the ability to opt-in to E2EE messaging, but by default it's insecure.

cookiengineer 6y ago

The Pentagons guideline for secure military conversations allowed to chose between threema, whatsapp or signal - but they explicitly forbid usage of telegram. At the time I knew about the voice call remote exploit in whatsapp due to their outdated hardfork, and I knew about the XSS RCE bug in signal’s innerHTML mess... so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted on. You can meanwhile look that information up on vault7 or snowden leaks, so it’s already publicly disclosed. Anyways, if you feel safe using a stock Android ROM that isn’t AOSP and is still using legacy 3.x or 4.x kernels... your general assumption on what is secure is wrong. Having said that, I don’t know whether palantir’s gotham has access to telegram’s servers. But given their workforce and sheer amount of RE they hire, the likeliness of telegram being a target is very high. So with all that in mind I’d recommend telegram only with AOSP head and only with secret chats. You don’t stand a chance if you are using the public clearnet routing protocols either way. And this is assuming that you don't use Windows and something like a hardened Kali or Arch-based distro that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually check every source from AUR. If you use Windows 10, you can forget security. If you use Ubuntu or Debian, you can forget security. If you use Steam, you can forget security. If you play any networked games on any of your machines, you can forget security. Joyful times where private organizations with nearly unlimited resources "hack the planet" and seemingly get away with it.

ngz00 6y ago
Is it really Clearnet if there is end to end encryption?
Angeo34 6y ago
If I run applications as a different user or in a chroot without root access how can there be security issues for any other users even if it's some game running through steam
- cookiengineer 6y ago
  > chroot Personally I wouldn't trust chroot alone. There were some privilege escalation bugs available in the past from "forgot to sandbox the cwd" [1] to more sophisticated exploits via "nsswitch in docker" [2]. But, of course, given the amount of bugs I'd say that chroot is as secure as it can get. But always take everything with a grain of salt, chroot developers also make mistakes, like everyone. The problem with chroot is not chroot itself, but all the libraries linked in the binaries. And if I know any statement to be true, it's that game developers on Steam don't give a damn about correctly linking anything. I mean, they even don't get 64bit right. And we have 64bit architecture mainstream since 2005 or so... [1] https://github.com/aykit/chroot-privilege-escalation https://github.com/aykit/chroot-privilege-escalation [2] https://nvd.nist.gov/vuln/detail/CVE-2019-14271 https://nvd.nist.gov/vuln/detail/CVE-2019-14271

johnisgood 6y ago

- Telegram does NOT support E2E encryption on their desktop and web version of the software.[1] - Telegram requires a phone number and in my country for example it is tied to you (yes, you need to sign a contract for even a prepaid SIM card). [1] https://tsf.telegram.org/manuals/e2ee-simple https://tsf.telegram.org/manuals/e2ee-simple

maqp 6y ago
Also, - Telegram does NOT support E2E encryption for group chats on any platform. - Telegram does not use E2E encryption for ANYTHING by default.

maqp 6y ago

"Telegram does log chats server-side if you want them to" No. Telegram forces you to log all Windows / Linux desktop client chats and all group chats to their server. You don't have a choice with those. Also all chats in general are logged by server by default. For Signal, the server being able to eavesdrop on 100% of group messages would be complete failure, a backdoor that would cause everyone to abandon Signal. For Telegram it's the primary design principle. So Telegram is in fact bacdoored by design. >Telegram groups have never been sacred Yeah it says that right there on the front page. This "obviously" propaganda actually hurts people, and not just in the way I die a little inside from reading it > This is not the same thing as leaking someone's personal chat history This is no standard of anything. "Oh it's fine that Telegram and anyone who hacks their server spies on you, it's only problem if they intentionally leak your chat history". Screw this kind of thinking. >which to my knowledge has still never been done. I've never seen such moving of goal posts in my life. >I'd be glad to be proven wrong on any of these counts, You can't just define the context to your liking and then prance about when nobody can win the argument of your rigged rules. >but the fact that Telegram is not perfect in every way does not make it insecure by default. This is called nirvana fallacy. Signal isn't perfect either. But it's at least E2EE by default which is the norm these days. Your comment is not thoughtful at all, it's indistinguishable from shill arguments. I hope you feel ashamed. -- For profesional cryptographers and security experts, it's enough the first protocol wan't IND-CCA secure. That alone tells the professionals the app is no good to any extent. Telegram loses at that point and it'll never advance to some next round. There will never be a community based code review or stamp of approval, that ship has sailed. The developers have lost face permanently. The evidence of this is no professional cryptographer has recommended Telegram at any point. Instead, world-renowned experts like Schneier and Matt Green have adviced against using Telegram. There's nothing Telegram developers or the community can ever say that undoes expert opinion.