5 ms·

I applaud the man for trying really, really, hard to make a difference, and succeeding. I look forward to the day when Signal doesn't require a phone number. Te

I applaud the man for trying really, really, hard to make a difference, and succeeding. I look forward to the day when Signal doesn't require a phone number. Telegram, while requiring a phone number doesn't require you to disclose it to receive messages. Others having your phone number opens you to all kind of other attacks, which are quite bad. Sim swapping, and SS7 attacks. SS7 vulns can disclose your real time location and more.

sdenton4 6y ago
OTOH, Telegram's crypto is... suspect. https://security.stackexchange.com/a/49802 https://security.stackexchange.com/a/49802
- emptysongglass 6y ago
  Sigh. That Stack Exchange answer is incredibly old and points to the flaws everyone knew in MTProto 1, which has been superseded by MTProto 2 for years. MTProto 2 is based on standard crypto primitives that not a single human being has found fault in. Please do your research before putting this stuff out there in the future: it spreads unnecessary fear, uncertainty and doubt.
  - akvadrako 6y ago
    Using standard crypto primitives isn’t enough. I tried to find a review of the security of telegrams new protocol a few months ago and came up empty. So asking the parent to “ do their research” isn’t helpful. And it isn’t FUD to treat an unknown system as insecure.
    - emptysongglass 6y ago
      You are welcome to develop your argument and point out where in MTProto 2 you find fault or why using standard crypto primitives isn't enough and what you'd like to see from MTProto 2 to secure it in your mind. The gp comment literally just posted a link to a deprecated comment that painted MTProto 1 as (rightfully) insecure. That was not thorough research and it attaches the FUD associated with an unused protocol to MTProto 2, which I'd again like to remind you and everyone, not a single security researcher or otherwise has found fault in.
      - garaetjjte 6y ago
        Crypto primitives aside, Telegram doesn't do E2E by default.
      - zepto 6y ago
        The point the parent is making is that ‘not a single researcher has found fault’ is not actually a valid baseline for considering cryptographic protocol to be secure. We have to assume that all protocols are insecure by default. That is standard practice. Only protocols which have withstood serious scrutiny and incentivized adversaries can be considered to have a level of security. So if you want to claim MTProto 2 to be secure, it isn’t enough to say ‘it uses standard primitives’. It also isn’t enough to say ‘nobody has found any bugs yet’. You need to demonstrate that received sufficient attention from motivated attackers before you can claim it is secure. That’s just how it is with crypto.
        emptysongglass 6y ago
        Great. Go ahead and demonstrate that Signal Protocol has received sufficient attention from motivated hackers to your satisfaction. Telegram has an open invitation to crack their protocol for 100k USD. Nobody's collecting. I guess those high-value targets using Telegram must be worth more than 100k. I don't need to demonstrate anything other than what I have already: when would we know a protocol has received significant attention from motivated hackers? I'll take a gander and say it's when that protocol is broken and is discovered by a security researcher or someone on the crisis response team. I'm not claiming MTProto 2 is secure. Neither am I claiming Signal Protocol is secure. Undoubtedly both protocols have undiscovered vulnerabilities. I am directly refuting and admonishing a user for linking to a Stack Exchange comment that addresses a previous protocol with almost nothing in common to the present one.
        zepto 6y ago
        You claimed that the reason to trust MTProto 2 because it is based on standard primitives and because no security research had yet found a bug. I was responding to that, and only that, because it an invalid security argument, and irrelevant to the ‘admonishment’ of the other commenter. The 100k bounty is a somewhat better argument. It would have been far more helpful to lead with that.

sdenton4 6y ago

OTOH, Telegram's crypto is... suspect. https://security.stackexchange.com/a/49802 https://security.stackexchange.com/a/49802

emptysongglass 6y ago
Sigh. That Stack Exchange answer is incredibly old and points to the flaws everyone knew in MTProto 1, which has been superseded by MTProto 2 for years. MTProto 2 is based on standard crypto primitives that not a single human being has found fault in. Please do your research before putting this stuff out there in the future: it spreads unnecessary fear, uncertainty and doubt.
- akvadrako 6y ago
  Using standard crypto primitives isn’t enough. I tried to find a review of the security of telegrams new protocol a few months ago and came up empty. So asking the parent to “ do their research” isn’t helpful. And it isn’t FUD to treat an unknown system as insecure.
  - emptysongglass 6y ago
    You are welcome to develop your argument and point out where in MTProto 2 you find fault or why using standard crypto primitives isn't enough and what you'd like to see from MTProto 2 to secure it in your mind. The gp comment literally just posted a link to a deprecated comment that painted MTProto 1 as (rightfully) insecure. That was not thorough research and it attaches the FUD associated with an unused protocol to MTProto 2, which I'd again like to remind you and everyone, not a single security researcher or otherwise has found fault in.
    - garaetjjte 6y ago
      Crypto primitives aside, Telegram doesn't do E2E by default.
    - zepto 6y ago
      The point the parent is making is that ‘not a single researcher has found fault’ is not actually a valid baseline for considering cryptographic protocol to be secure. We have to assume that all protocols are insecure by default. That is standard practice. Only protocols which have withstood serious scrutiny and incentivized adversaries can be considered to have a level of security. So if you want to claim MTProto 2 to be secure, it isn’t enough to say ‘it uses standard primitives’. It also isn’t enough to say ‘nobody has found any bugs yet’. You need to demonstrate that received sufficient attention from motivated attackers before you can claim it is secure. That’s just how it is with crypto.
      - emptysongglass 6y ago
        Great. Go ahead and demonstrate that Signal Protocol has received sufficient attention from motivated hackers to your satisfaction. Telegram has an open invitation to crack their protocol for 100k USD. Nobody's collecting. I guess those high-value targets using Telegram must be worth more than 100k. I don't need to demonstrate anything other than what I have already: when would we know a protocol has received significant attention from motivated hackers? I'll take a gander and say it's when that protocol is broken and is discovered by a security researcher or someone on the crisis response team. I'm not claiming MTProto 2 is secure. Neither am I claiming Signal Protocol is secure. Undoubtedly both protocols have undiscovered vulnerabilities. I am directly refuting and admonishing a user for linking to a Stack Exchange comment that addresses a previous protocol with almost nothing in common to the present one.
        zepto 6y ago
        You claimed that the reason to trust MTProto 2 because it is based on standard primitives and because no security research had yet found a bug. I was responding to that, and only that, because it an invalid security argument, and irrelevant to the ‘admonishment’ of the other commenter. The 100k bounty is a somewhat better argument. It would have been far more helpful to lead with that.