5 ms·

The reason primarily is that they have rolled their own crypto, which based on a lot of reading and comments from other experts suggests is the wrong thing to d

The reason primarily is that they have rolled their own crypto, which based on a lot of reading and comments from other experts suggests is the wrong thing to do. To this end I havent seen a good explanation from Telegram as to why they have taken this route given there are so many proven & battle tested methods and algorithms. "We havent been hacked yet" doesnt seem good enough for me. 1:1 messages aren't e2e by default and group messages dont support e2e. For these reasons about encryption I dont like it but their UI/UX is the absolute best.

erikbye 6y ago
> The reason primarily is that they have rolled their own crypto, which based on a lot of reading and comments from other experts suggests is the wrong thing to do Someone has to roll crypto. Did Signal roll their own?
- thekyle 6y ago
  I believe Signal did create their own crypto (which is also used now by apps like WhatsApp). The difference is that Signal's crypto was created by a trained cryptographer and seems to be generally respected in the cryptography community while Telegrams is not.
  - karlmcguire 6y ago
    It's not clear who made Telegram's crypto but it was probably Nikolai Durov who is a genius mathematician and engineer, so it's not like it's some guy in a garage.
    - ClumsyPilot 6y ago
      O thought a garage gives you street cred, now ot works against you? Kids these days, can't keep up with fashion
    - shakna 6y ago
      Signal's crypto has also been independently audited [0], with pretty encouraging results, and as it is open source, can continually be audited. Telegram's on the other hand, can't be continually audited, but the MTProto scheme they put together has been found to have a number of flaws [1], and that hasn't changed. They also haven't really allowed third-party audit of their actual code, so there may or may not be extra bugs waiting to bite you. [0] https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf [1] https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf
      - varispeed 6y ago
        Being open source it does not mean that the same code is running on their servers.
        shakna 6y ago
        This is true, but thankfully the security of Signal's double ratchet scheme means that you only need to verify your client to ensure the encryption remains intact. The server can't peek inside.
    - bjoli 6y ago
      I remember he was pretty cocky here on HN about it. Half a year later it was shown to be thoroughly broken because the server could provide shit entropy to the client which it for some godforsaken reason used to generate the encryption keys. So, yes. He (or any of the other 6 world champion coders that were bragged about) designed a broken protocol. Broken, as in "trivial access to the plain text by the server", which is pretty damn awful. When people say that telegram rolled their own crypto that mean that they chose weird crypto primitives, weird key handling and generation and combined them in a way that made people go "whoa! That looks weird" and defended it by refering to their own world championship victories, by extension saying that people were to stupid to understand. And 6 months later their protocol was shown to be broken. Use telegram all you like. Don't say that their encryption is even close to being the gold standard.
ffpip 6y ago
> To this end I havent seen a good explanation from Telegram as to why they have taken this route given .. They say it is for speed. Looking at how fast Telegram is, I can say it worked for them. It is the most reliable app that works on slow internet for me. https://core.telegram.org/techfaq#q-why-did-you-go-for-a-custom-protocol https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
- bjoli 6y ago
  Their protocol is not encrypted by default, which is an odd choice. And on any smartphone made in the last 10 years encryption should not be a bottleneck in any other way than maybe compression size, which is pretty irrelevant since most of the larger things you are sending will be heavily compressed before encryption (video and images come to mind).
  - ffpip 6y ago
    > And on any smartphone made in the last 10 years encryption should not be a bottleneck in any other way.. Telegram is the fastest messenger on my 3 year old phone and is significantly faster than the other 6 messengers on it (some of them are e2ee and some only TLS encrypted.
    - bjoli 6y ago
      Which probably has nothing to do with encryption. The TLS messengers are using AES as well (and unless you are using secret chats for all your communication Telegram is in this camp as well). What you are experiencing is probably "just" UI.
      - ffpip 6y ago
        Yes, but signal has another layer of encryption. Even if the server is compromised or TLS is broken, singal chats shouldn't leak.
  - SpaceRaccoon 6y ago
    > Their protocol is not encrypted by default, which is an odd choice. That's because end-to-end encrypted chats are only available on a single device, since the e2e keys are not shared between devices. Most users switch between devices and like to have everything stored in the cloud, so having that as the default is the obvious convenience. Anybody who is concerned about e2e can easily start a secret chat for that purposes, at the expense of cloud functionality.
pkulak 6y ago
It's not end to end. Getting data to a server encrypted is a solved problem. But if you're just going to store it there in plain text forever, what's the point?

erikbye 6y ago

> The reason primarily is that they have rolled their own crypto, which based on a lot of reading and comments from other experts suggests is the wrong thing to do Someone has to roll crypto. Did Signal roll their own?

thekyle 6y ago
I believe Signal did create their own crypto (which is also used now by apps like WhatsApp). The difference is that Signal's crypto was created by a trained cryptographer and seems to be generally respected in the cryptography community while Telegrams is not.
- karlmcguire 6y ago
  It's not clear who made Telegram's crypto but it was probably Nikolai Durov who is a genius mathematician and engineer, so it's not like it's some guy in a garage.
  - ClumsyPilot 6y ago
    O thought a garage gives you street cred, now ot works against you? Kids these days, can't keep up with fashion
  - shakna 6y ago
    Signal's crypto has also been independently audited [0], with pretty encouraging results, and as it is open source, can continually be audited. Telegram's on the other hand, can't be continually audited, but the MTProto scheme they put together has been found to have a number of flaws [1], and that hasn't changed. They also haven't really allowed third-party audit of their actual code, so there may or may not be extra bugs waiting to bite you. [0] https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf [1] https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf
    - varispeed 6y ago
      Being open source it does not mean that the same code is running on their servers.
      - shakna 6y ago
        This is true, but thankfully the security of Signal's double ratchet scheme means that you only need to verify your client to ensure the encryption remains intact. The server can't peek inside.
  - bjoli 6y ago
    I remember he was pretty cocky here on HN about it. Half a year later it was shown to be thoroughly broken because the server could provide shit entropy to the client which it for some godforsaken reason used to generate the encryption keys. So, yes. He (or any of the other 6 world champion coders that were bragged about) designed a broken protocol. Broken, as in "trivial access to the plain text by the server", which is pretty damn awful. When people say that telegram rolled their own crypto that mean that they chose weird crypto primitives, weird key handling and generation and combined them in a way that made people go "whoa! That looks weird" and defended it by refering to their own world championship victories, by extension saying that people were to stupid to understand. And 6 months later their protocol was shown to be broken. Use telegram all you like. Don't say that their encryption is even close to being the gold standard.

ffpip 6y ago

> To this end I havent seen a good explanation from Telegram as to why they have taken this route given .. They say it is for speed. Looking at how fast Telegram is, I can say it worked for them. It is the most reliable app that works on slow internet for me. https://core.telegram.org/techfaq#q-why-did-you-go-for-a-custom-protocol https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...

bjoli 6y ago
Their protocol is not encrypted by default, which is an odd choice. And on any smartphone made in the last 10 years encryption should not be a bottleneck in any other way than maybe compression size, which is pretty irrelevant since most of the larger things you are sending will be heavily compressed before encryption (video and images come to mind).
- ffpip 6y ago
  > And on any smartphone made in the last 10 years encryption should not be a bottleneck in any other way.. Telegram is the fastest messenger on my 3 year old phone and is significantly faster than the other 6 messengers on it (some of them are e2ee and some only TLS encrypted.
  - bjoli 6y ago
    Which probably has nothing to do with encryption. The TLS messengers are using AES as well (and unless you are using secret chats for all your communication Telegram is in this camp as well). What you are experiencing is probably "just" UI.
    - ffpip 6y ago
      Yes, but signal has another layer of encryption. Even if the server is compromised or TLS is broken, singal chats shouldn't leak.
- SpaceRaccoon 6y ago
  > Their protocol is not encrypted by default, which is an odd choice. That's because end-to-end encrypted chats are only available on a single device, since the e2e keys are not shared between devices. Most users switch between devices and like to have everything stored in the cloud, so having that as the default is the obvious convenience. Anybody who is concerned about e2e can easily start a secret chat for that purposes, at the expense of cloud functionality.

pkulak 6y ago

It's not end to end. Getting data to a server encrypted is a solved problem. But if you're just going to store it there in plain text forever, what's the point?