4 ms·

You are welcome to develop your argument and point out where in MTProto 2 you find fault or why using standard crypto primitives isn't enough and what you'd lik

You are welcome to develop your argument and point out where in MTProto 2 you find fault or why using standard crypto primitives isn't enough and what you'd like to see from MTProto 2 to secure it in your mind. The gp comment literally just posted a link to a deprecated comment that painted MTProto 1 as (rightfully) insecure. That was not thorough research and it attaches the FUD associated with an unused protocol to MTProto 2, which I'd again like to remind you and everyone, not a single security researcher or otherwise has found fault in.

garaetjjte 6y ago
Crypto primitives aside, Telegram doesn't do E2E by default.
zepto 6y ago
The point the parent is making is that ‘not a single researcher has found fault’ is not actually a valid baseline for considering cryptographic protocol to be secure. We have to assume that all protocols are insecure by default. That is standard practice. Only protocols which have withstood serious scrutiny and incentivized adversaries can be considered to have a level of security. So if you want to claim MTProto 2 to be secure, it isn’t enough to say ‘it uses standard primitives’. It also isn’t enough to say ‘nobody has found any bugs yet’. You need to demonstrate that received sufficient attention from motivated attackers before you can claim it is secure. That’s just how it is with crypto.
- emptysongglass 6y ago
  Great. Go ahead and demonstrate that Signal Protocol has received sufficient attention from motivated hackers to your satisfaction. Telegram has an open invitation to crack their protocol for 100k USD. Nobody's collecting. I guess those high-value targets using Telegram must be worth more than 100k. I don't need to demonstrate anything other than what I have already: when would we know a protocol has received significant attention from motivated hackers? I'll take a gander and say it's when that protocol is broken and is discovered by a security researcher or someone on the crisis response team. I'm not claiming MTProto 2 is secure. Neither am I claiming Signal Protocol is secure. Undoubtedly both protocols have undiscovered vulnerabilities. I am directly refuting and admonishing a user for linking to a Stack Exchange comment that addresses a previous protocol with almost nothing in common to the present one.
  - zepto 6y ago
    You claimed that the reason to trust MTProto 2 because it is based on standard primitives and because no security research had yet found a bug. I was responding to that, and only that, because it an invalid security argument, and irrelevant to the ‘admonishment’ of the other commenter. The 100k bounty is a somewhat better argument. It would have been far more helpful to lead with that.
    - emptysongglass 6y ago
      Now you're putting words in my mouth. I did indeed say MTProto 2 was based on standard primitives and no one has publicly claimed it insecure or vulnerable. I did not say to trust MTProto 2 any more than you would trust the Signal Protocol: that is given the information we have on known vulnerabilities one appears about as good as the other.
      - zepto 6y ago
        You said exactly what I claim you are saying: “You are welcome to develop your argument and point out where in MTProto 2 you find fault or why using standard crypto primitives isn't enough and what you'd like to see from MTProto 2 to secure it in your mind.” The only person putting words in someone’s mouth is you - I never compared MTProto 2 to signal. You keep claiming that you never said MTProto 2 is more secure than signal. I never said you did. The idea that being based on standard primitives is enough is a commonly held but dangerous piece of cryptographic reasoning.
        emptysongglass 6y ago
        > You claimed that the reason to trust MTProto 2 because it is based on standard primitives and because no security research had yet found a bug. Those are the words you put in my mouth. I don't trust MTProto 2. When did I say that I trusted MTProto 2? This whole argument was me putting bad research to shame and then challenging another user not you to develop their argument. But you wanted to back them up with something about concentrated efforts from serious adversaries which is an impossible argument to refute because neither of us has the insider knowledge to know what these protocols have endured and survived since only knowledge of their successful exploitation would be on the menu for public consumption. So please, do bring something of greater meat to the table if you have something to share.

garaetjjte 6y ago

Crypto primitives aside, Telegram doesn't do E2E by default.

zepto 6y ago

The point the parent is making is that ‘not a single researcher has found fault’ is not actually a valid baseline for considering cryptographic protocol to be secure. We have to assume that all protocols are insecure by default. That is standard practice. Only protocols which have withstood serious scrutiny and incentivized adversaries can be considered to have a level of security. So if you want to claim MTProto 2 to be secure, it isn’t enough to say ‘it uses standard primitives’. It also isn’t enough to say ‘nobody has found any bugs yet’. You need to demonstrate that received sufficient attention from motivated attackers before you can claim it is secure. That’s just how it is with crypto.

emptysongglass 6y ago
Great. Go ahead and demonstrate that Signal Protocol has received sufficient attention from motivated hackers to your satisfaction. Telegram has an open invitation to crack their protocol for 100k USD. Nobody's collecting. I guess those high-value targets using Telegram must be worth more than 100k. I don't need to demonstrate anything other than what I have already: when would we know a protocol has received significant attention from motivated hackers? I'll take a gander and say it's when that protocol is broken and is discovered by a security researcher or someone on the crisis response team. I'm not claiming MTProto 2 is secure. Neither am I claiming Signal Protocol is secure. Undoubtedly both protocols have undiscovered vulnerabilities. I am directly refuting and admonishing a user for linking to a Stack Exchange comment that addresses a previous protocol with almost nothing in common to the present one.
- zepto 6y ago
  You claimed that the reason to trust MTProto 2 because it is based on standard primitives and because no security research had yet found a bug. I was responding to that, and only that, because it an invalid security argument, and irrelevant to the ‘admonishment’ of the other commenter. The 100k bounty is a somewhat better argument. It would have been far more helpful to lead with that.
  - emptysongglass 6y ago
    Now you're putting words in my mouth. I did indeed say MTProto 2 was based on standard primitives and no one has publicly claimed it insecure or vulnerable. I did not say to trust MTProto 2 any more than you would trust the Signal Protocol: that is given the information we have on known vulnerabilities one appears about as good as the other.
    - zepto 6y ago
      You said exactly what I claim you are saying: “You are welcome to develop your argument and point out where in MTProto 2 you find fault or why using standard crypto primitives isn't enough and what you'd like to see from MTProto 2 to secure it in your mind.” The only person putting words in someone’s mouth is you - I never compared MTProto 2 to signal. You keep claiming that you never said MTProto 2 is more secure than signal. I never said you did. The idea that being based on standard primitives is enough is a commonly held but dangerous piece of cryptographic reasoning.
      - emptysongglass 6y ago
        > You claimed that the reason to trust MTProto 2 because it is based on standard primitives and because no security research had yet found a bug. Those are the words you put in my mouth. I don't trust MTProto 2. When did I say that I trusted MTProto 2? This whole argument was me putting bad research to shame and then challenging another user not you to develop their argument. But you wanted to back them up with something about concentrated efforts from serious adversaries which is an impossible argument to refute because neither of us has the insider knowledge to know what these protocols have endured and survived since only knowledge of their successful exploitation would be on the menu for public consumption. So please, do bring something of greater meat to the table if you have something to share.