4 ms·

And how is Signal's protocol is not "roll their own" ? Sorry I don't know.

Mediterraneo10 6y ago
The Signal Protocol[0] is based on OTR, a technology which had already seen a number of implementations and informed scrutiny by the time Signal came along. [0] https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol
- godelski 6y ago
  Also an important aspect is that it is open sourced, meaning others can audit it. I'm a little untrusting of people that say "trust me" but also "no, you can't look at it." (unless there is a good reason to hide it, which in this case I do not believe there is)
  - jhasse 6y ago
    MTproto is also open source.
    - godelski 6y ago
      Thank you for updating. For those curious this is what I found looking for the source https://github.com/tdlib/td/tree/80c35676a2eb1e9b71db355ee217bba79fbdce31/td/mtproto https://github.com/tdlib/td/tree/80c35676a2eb1e9b71db355ee21...
  - maqp 6y ago
    The thing is, there's nothing to audit. The world's best audit of Telegram would make the following obvious findings: 1. It's not E2EE by default therefore it's not private and secure by default. 2. It's not E2EE at all for groups therefore it's not safe for use of dissident groups 3. It's not E2EE at all for desktop clients therefore it's not practical in daily messaging. Any audit of the E2EE part is meaningless when E2EE is so impractical it's not used by users at all.
- upofadown 6y ago
  It's based on the concepts of OTR but it has gone in different directions to actually implement those ideas.
  - maqp 6y ago
    (DH-ratchet is still there. 1536-bit FF-DH was replaced with X3DH etc, but the basic idea is still there. Adding hash ratchet for non-round-trip messaging was a good idea, as was pre-keys stored on server. IMO it's fair to say it's been expanded around OTR)
stinkytaco 6y ago
First of all, most of this goes back five years and things have likely changed, but basically MTProto used several non-standard and out of date security mechanisms (no AE and using SHA1 were fairly notable at the time) whereas Signal was purposing fairly standard and widely used mechanisms (OTR). It's possible that many of those failures have been addressed over the years, but I haven't followed it closely. It's worth noting that Signal has been widely vetted over time and is the underpinning of WhatsApp, whereas MTProto continues to have a poor reputation, it seems.
- maqp 6y ago
  The very fact out-of-date security mechanisms passed into first version should tell the developers don't follow their field, or that they're complete amateurs. Both are flags so red Stalin would have a problem with it.
tptacek 6y ago
Signal Protocol won the Levchin Prize at Real World Crypto, which was awarded by a panel of several of the most renowned academic cryptographers in the field (including Dan Boneh and Kenny Paterson). Other winners include Bellare, Krawczyk, and Joan Daemon. The protocol has been extensively analyzed and is the current gold standard for messaging encryption. Telegram's protocol... is not that.
- read_if_gay_ 6y ago
  But the standard we should apply to secure chat protocols isn't how many awards it won, but whether it's watertight. Obviously winning a prestigious prize means it's watertight, but the converse doesn't follow. A protocol can be safe for practical use without winning any prizes.
  - tptacek 6y ago
    Does this comment have anything to do with the question I was responding to?
    - read_if_gay_ 6y ago
      No, and obviously it doesn't have to, because I'm replying to you. You hint at Telegram's protocol being inferior based on the number of awards it won, a heuristic that isn't too relevant in practice.
  - maqp 6y ago
    It can, but given Telegram's history and professional cryptographers like Schneier[1] and Green[2] saying DO NOT USE IT, it's obvious it's _anything_ but watertight. [1] https://www.schneier.com/blog/archives/2016/06/comparing_messa.html https://www.schneier.com/blog/archives/2016/06/comparing_mes... [2] https://twitter.com/matthew_d_green/status/726428912968982529 https://twitter.com/matthew_d_green/status/72642891296898252...
    - read_if_gay_ 6y ago

The Signal Protocol[0] is based on OTR, a technology which had already seen a number of implementations and informed scrutiny by the time Signal came along. [0] https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol

godelski 6y ago
Also an important aspect is that it is open sourced, meaning others can audit it. I'm a little untrusting of people that say "trust me" but also "no, you can't look at it." (unless there is a good reason to hide it, which in this case I do not believe there is)
- jhasse 6y ago
  MTproto is also open source.
  - godelski 6y ago
    Thank you for updating. For those curious this is what I found looking for the source https://github.com/tdlib/td/tree/80c35676a2eb1e9b71db355ee217bba79fbdce31/td/mtproto https://github.com/tdlib/td/tree/80c35676a2eb1e9b71db355ee21...
- maqp 6y ago
  The thing is, there's nothing to audit. The world's best audit of Telegram would make the following obvious findings: 1. It's not E2EE by default therefore it's not private and secure by default. 2. It's not E2EE at all for groups therefore it's not safe for use of dissident groups 3. It's not E2EE at all for desktop clients therefore it's not practical in daily messaging. Any audit of the E2EE part is meaningless when E2EE is so impractical it's not used by users at all.
upofadown 6y ago
It's based on the concepts of OTR but it has gone in different directions to actually implement those ideas.
- maqp 6y ago
  (DH-ratchet is still there. 1536-bit FF-DH was replaced with X3DH etc, but the basic idea is still there. Adding hash ratchet for non-round-trip messaging was a good idea, as was pre-keys stored on server. IMO it's fair to say it's been expanded around OTR)

stinkytaco 6y ago

First of all, most of this goes back five years and things have likely changed, but basically MTProto used several non-standard and out of date security mechanisms (no AE and using SHA1 were fairly notable at the time) whereas Signal was purposing fairly standard and widely used mechanisms (OTR). It's possible that many of those failures have been addressed over the years, but I haven't followed it closely. It's worth noting that Signal has been widely vetted over time and is the underpinning of WhatsApp, whereas MTProto continues to have a poor reputation, it seems.

maqp 6y ago
The very fact out-of-date security mechanisms passed into first version should tell the developers don't follow their field, or that they're complete amateurs. Both are flags so red Stalin would have a problem with it.

tptacek 6y ago

Signal Protocol won the Levchin Prize at Real World Crypto, which was awarded by a panel of several of the most renowned academic cryptographers in the field (including Dan Boneh and Kenny Paterson). Other winners include Bellare, Krawczyk, and Joan Daemon. The protocol has been extensively analyzed and is the current gold standard for messaging encryption. Telegram's protocol... is not that.

read_if_gay_ 6y ago
But the standard we should apply to secure chat protocols isn't how many awards it won, but whether it's watertight. Obviously winning a prestigious prize means it's watertight, but the converse doesn't follow. A protocol can be safe for practical use without winning any prizes.
- tptacek 6y ago
  Does this comment have anything to do with the question I was responding to?
  - read_if_gay_ 6y ago
    No, and obviously it doesn't have to, because I'm replying to you. You hint at Telegram's protocol being inferior based on the number of awards it won, a heuristic that isn't too relevant in practice.
- maqp 6y ago
  It can, but given Telegram's history and professional cryptographers like Schneier[1] and Green[2] saying DO NOT USE IT, it's obvious it's _anything_ but watertight. [1] https://www.schneier.com/blog/archives/2016/06/comparing_messa.html https://www.schneier.com/blog/archives/2016/06/comparing_mes... [2] https://twitter.com/matthew_d_green/status/726428912968982529 https://twitter.com/matthew_d_green/status/72642891296898252...
  - read_if_gay_ 6y ago