4 ms·

The Pentagons guideline for secure military conversations allowed to chose between threema, whatsapp or signal - but they explicitly forbid usage of telegram.

The Pentagons guideline for secure military conversations allowed to chose between threema, whatsapp or signal - but they explicitly forbid usage of telegram. At the time I knew about the voice call remote exploit in whatsapp due to their outdated hardfork, and I knew about the XSS RCE bug in signal’s innerHTML mess... so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted on. You can meanwhile look that information up on vault7 or snowden leaks, so it’s already publicly disclosed. Anyways, if you feel safe using a stock Android ROM that isn’t AOSP and is still using legacy 3.x or 4.x kernels... your general assumption on what is secure is wrong. Having said that, I don’t know whether palantir’s gotham has access to telegram’s servers. But given their workforce and sheer amount of RE they hire, the likeliness of telegram being a target is very high. So with all that in mind I’d recommend telegram only with AOSP head and only with secret chats. You don’t stand a chance if you are using the public clearnet routing protocols either way. And this is assuming that you don't use Windows and something like a hardened Kali or Arch-based distro that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually check every source from AUR. If you use Windows 10, you can forget security. If you use Ubuntu or Debian, you can forget security. If you use Steam, you can forget security. If you play any networked games on any of your machines, you can forget security. Joyful times where private organizations with nearly unlimited resources "hack the planet" and seemingly get away with it.

ngz00 6y ago
Is it really Clearnet if there is end to end encryption?
Angeo34 6y ago
If I run applications as a different user or in a chroot without root access how can there be security issues for any other users even if it's some game running through steam
- cookiengineer 6y ago
  > chroot Personally I wouldn't trust chroot alone. There were some privilege escalation bugs available in the past from "forgot to sandbox the cwd" [1] to more sophisticated exploits via "nsswitch in docker" [2]. But, of course, given the amount of bugs I'd say that chroot is as secure as it can get. But always take everything with a grain of salt, chroot developers also make mistakes, like everyone. The problem with chroot is not chroot itself, but all the libraries linked in the binaries. And if I know any statement to be true, it's that game developers on Steam don't give a damn about correctly linking anything. I mean, they even don't get 64bit right. And we have 64bit architecture mainstream since 2005 or so... [1] https://github.com/aykit/chroot-privilege-escalation https://github.com/aykit/chroot-privilege-escalation [2] https://nvd.nist.gov/vuln/detail/CVE-2019-14271 https://nvd.nist.gov/vuln/detail/CVE-2019-14271
lvbu 6y ago
> If you use Ubuntu or Debian, you can forget security Why do you say so?
- cookiengineer 6y ago
  > Why do you say so? (about Debian/Ubuntu) Critical security fixing time is years, not days. Also in practice, a lot of people use PPAs to get work done, and this is a critical component in an audited system.
  - andrewshadura 6y ago
    This is absurdly untrue.
    - cookiengineer 6y ago
      > This is absurdly untrue. I’m just gonna leave these here: [1] https://security-tracker.debian.org/ https://security-tracker.debian.org/ [2] https://security.archlinux.org/ https://security.archlinux.org/ ...then everyone can compare upstream/downstream fixing times for themselves. Remember: “not yet assigned” is equivalent to “not fixed”.
hnarn 6y ago
> so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted on. This is a very strange assumption, you mean that the "Pentagons guideline for secure military conversations" is actually not a guideline for secure conversations, but exploitable conversations? Why would the Pentagon tell their own people to use exploitable communications? There's no way of knowing if you are the only one with the capability. In my eyes this information (which I haven't verified and don't have time to dig into) would rather indicate that the Pentagon believes Threema, WhatsApp and Signal to be secure while they are doubtful about Telegram -- maybe because they know something we don't, or simply because it's harder to audit.
- cookiengineer 6y ago
  The underlying question really is when the point is reached between "security through trust" and "security through audit". I'm not anyhow claiming that Telegram is secure. But given the problems that legal courts have when the FBI and other three letter agencies want to get access to Telegram data (and the fact that the company moved their HQ around Europe every time a state wanted access) seems to me much more trustworthy than say, any Facebook software. And I would also argue that given the fact that Gotham has full administrative access for anything Facebook sends and that the end-to-end encryption cannot be verified as both clients never actually connect directly would speak also contra WhatsApp when it comes to their security claims. (install a Firewall on Android and you'll see the whatsapp gateways/proxies). To be honest, I doubt that the Pentagon would trust any software without having seen its source code or at least having full access to the data that's transferred. And I think that's a fair assumption. The underlying issue is that the field of security has is actually that it's not a field of trust - but rather a field of mistrust. Currently I'm mistrusting the Pentagon more than some random dudes I've never seen; which might be the actual point of the discussion: Can we trust the Pentagon given their fuckups in the past?
j-james 6y ago
> that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually check every source from AUR. To be fair, all three of those are the defaults on any distro I've ever used. You have to say explicitly "no, I do not want to inspect this PKGBUILD file" in pretty much every AUR helper (and it's worth noting AUR helpers aren't even the supported way of building AUR packages).

ngz00 6y ago

Is it really Clearnet if there is end to end encryption?

Angeo34 6y ago

If I run applications as a different user or in a chroot without root access how can there be security issues for any other users even if it's some game running through steam

cookiengineer 6y ago
> chroot Personally I wouldn't trust chroot alone. There were some privilege escalation bugs available in the past from "forgot to sandbox the cwd" [1] to more sophisticated exploits via "nsswitch in docker" [2]. But, of course, given the amount of bugs I'd say that chroot is as secure as it can get. But always take everything with a grain of salt, chroot developers also make mistakes, like everyone. The problem with chroot is not chroot itself, but all the libraries linked in the binaries. And if I know any statement to be true, it's that game developers on Steam don't give a damn about correctly linking anything. I mean, they even don't get 64bit right. And we have 64bit architecture mainstream since 2005 or so... [1] https://github.com/aykit/chroot-privilege-escalation https://github.com/aykit/chroot-privilege-escalation [2] https://nvd.nist.gov/vuln/detail/CVE-2019-14271 https://nvd.nist.gov/vuln/detail/CVE-2019-14271

lvbu 6y ago

> If you use Ubuntu or Debian, you can forget security Why do you say so?

cookiengineer 6y ago
> Why do you say so? (about Debian/Ubuntu) Critical security fixing time is years, not days. Also in practice, a lot of people use PPAs to get work done, and this is a critical component in an audited system.
- andrewshadura 6y ago
  This is absurdly untrue.
  - cookiengineer 6y ago
    > This is absurdly untrue. I’m just gonna leave these here: [1] https://security-tracker.debian.org/ https://security-tracker.debian.org/ [2] https://security.archlinux.org/ https://security.archlinux.org/ ...then everyone can compare upstream/downstream fixing times for themselves. Remember: “not yet assigned” is equivalent to “not fixed”.

hnarn 6y ago

> so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted on. This is a very strange assumption, you mean that the "Pentagons guideline for secure military conversations" is actually not a guideline for secure conversations, but exploitable conversations? Why would the Pentagon tell their own people to use exploitable communications? There's no way of knowing if you are the only one with the capability. In my eyes this information (which I haven't verified and don't have time to dig into) would rather indicate that the Pentagon believes Threema, WhatsApp and Signal to be secure while they are doubtful about Telegram -- maybe because they know something we don't, or simply because it's harder to audit.

cookiengineer 6y ago
The underlying question really is when the point is reached between "security through trust" and "security through audit". I'm not anyhow claiming that Telegram is secure. But given the problems that legal courts have when the FBI and other three letter agencies want to get access to Telegram data (and the fact that the company moved their HQ around Europe every time a state wanted access) seems to me much more trustworthy than say, any Facebook software. And I would also argue that given the fact that Gotham has full administrative access for anything Facebook sends and that the end-to-end encryption cannot be verified as both clients never actually connect directly would speak also contra WhatsApp when it comes to their security claims. (install a Firewall on Android and you'll see the whatsapp gateways/proxies). To be honest, I doubt that the Pentagon would trust any software without having seen its source code or at least having full access to the data that's transferred. And I think that's a fair assumption. The underlying issue is that the field of security has is actually that it's not a field of trust - but rather a field of mistrust. Currently I'm mistrusting the Pentagon more than some random dudes I've never seen; which might be the actual point of the discussion: Can we trust the Pentagon given their fuckups in the past?

j-james 6y ago

> that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually check every source from AUR. To be fair, all three of those are the defaults on any distro I've ever used. You have to say explicitly "no, I do not want to inspect this PKGBUILD file" in pretty much every AUR helper (and it's worth noting AUR helpers aren't even the supported way of building AUR packages).