4 ms·

Link.

by ffpip 6y ago

Link.

coolspot 6y ago
Best I can find with keywords “telegram” and “backdoor” is this article: https://socialbarrel.com/telegram-founder-makes-shocking-backdoor-claim-about-whatsapp/123202/ https://socialbarrel.com/telegram-founder-makes-shocking-bac... Which discusses how Telegram was banned in many countries for refusing cooperation while WhatsApp suspiciously was never banned, which could mean that WhatsApp gives governments everything they demand.
- beagle3 6y ago
  I suspect the Google/Facebook deal for "free backup of WhatsApp chats on your Google account" is exactly that. WhatsApp had perfectly usable encrypted backup - which took up space on your Google backup. And then, all of a sudden, it wasn't encrypted and didn't take up space. But you don't have access to it yourself - only Google does (and WhatsApp if it is recovering). This is a perfect way to provide all the data to various governments for 99.9% of users, without killing the E2E encryption.
  - coolspot 6y ago
    Same situation with the iCloud backup on Apple iOS, AFAIK. WhatsApp backup in iCloud is not encrypted.
    - beagle3 6y ago
      Is it user accessible at least? The Android backup is not.
bjoli 6y ago
They didn't backdoor it. It was back in 2013 when they were new. Everyone was going "whoa, your encryption is weird" and they were defending themselves by saying "we have 6 world champion programmers". Anyways, something like 6 months after launch a Russian guy found that they were seeding their secret chat keys with entropy from the server, meaning the server could trivially MITM any secret chat. Pretty embarrassing. Iirc it got quite little publicity since most of the discussion was in Russian, and the disclosure was in a forum post in an obscure forum.
- ryanlol 6y ago
  If you look at their implementation the balance of probabilities definitely leans heavily towards “backdoor” rather than “not a backdoor”. You aren’t going to find any cryptographers anywhere who’d be willing to repeat your “They didn’t backdoor it” lie. If it looks like a backdoor, swims like a backdoor, quacks like a backdoor, then it probably is a backdoor.
ryanlol 6y ago
https://m.habr.com/ru/post/206900/ https://m.habr.com/ru/post/206900/ FiloSottile described it as “The most backdoor-looking bug I’ve ever seen” https://twitter.com/filosottile/status/987376021589692416?s=21 https://twitter.com/filosottile/status/987376021589692416?s=...
- ffpip 6y ago
  That was the month telegram launched? It's been 7 years. It was a new app. The same bug is still being used against it? Do you have any recent bugs? Or 'backdoors'? All their official apps are open source and reproducible. Must be easy to find bugs for security researchers. They even offer much larger bounties compared to other apps. Anything? I want to believe people saying bad crypto, but it looks like there's no actual proof. Here's something that says it is good, published more recently. https://web.archive.org/web/20180727070936/https://www.susanka.eu/files/telegram-article.pdf https://web.archive.org/web/20180727070936/https://www.susan... https://kryptera.se/assets/uploads/2015/12/Telegram-cryptanalysis.pdf https://kryptera.se/assets/uploads/2015/12/Telegram-cryptana...
  - ryanlol 6y ago
    It’s really obvious this wasn’t a bug, but a backdoor. It proves that Telegram is an actively hostile adversary, the fact that their encryption scheme hasn’t been publicly broken since then doesn’t change that. > Or 'backdoors'? You might argue that their deliberate decision to not encrypt most chats is exactly that, more of a front door really. Telegram is a bad actor.

Link.

by ffpip 6y ago

Link.

Best I can find with keywords “telegram” and “backdoor” is this article: https://socialbarrel.com/telegram-founder-makes-shocking-backdoor-claim-about-whatsapp/123202/ https://socialbarrel.com/telegram-founder-makes-shocking-bac... Which discusses how Telegram was banned in many countries for refusing cooperation while WhatsApp suspiciously was never banned, which could mean that WhatsApp gives governments everything they demand.

beagle3 6y ago
I suspect the Google/Facebook deal for "free backup of WhatsApp chats on your Google account" is exactly that. WhatsApp had perfectly usable encrypted backup - which took up space on your Google backup. And then, all of a sudden, it wasn't encrypted and didn't take up space. But you don't have access to it yourself - only Google does (and WhatsApp if it is recovering). This is a perfect way to provide all the data to various governments for 99.9% of users, without killing the E2E encryption.
- coolspot 6y ago
  Same situation with the iCloud backup on Apple iOS, AFAIK. WhatsApp backup in iCloud is not encrypted.
  - beagle3 6y ago
    Is it user accessible at least? The Android backup is not.

bjoli 6y ago

They didn't backdoor it. It was back in 2013 when they were new. Everyone was going "whoa, your encryption is weird" and they were defending themselves by saying "we have 6 world champion programmers". Anyways, something like 6 months after launch a Russian guy found that they were seeding their secret chat keys with entropy from the server, meaning the server could trivially MITM any secret chat. Pretty embarrassing. Iirc it got quite little publicity since most of the discussion was in Russian, and the disclosure was in a forum post in an obscure forum.

ryanlol 6y ago
If you look at their implementation the balance of probabilities definitely leans heavily towards “backdoor” rather than “not a backdoor”. You aren’t going to find any cryptographers anywhere who’d be willing to repeat your “They didn’t backdoor it” lie. If it looks like a backdoor, swims like a backdoor, quacks like a backdoor, then it probably is a backdoor.

ryanlol 6y ago

https://m.habr.com/ru/post/206900/ https://m.habr.com/ru/post/206900/ FiloSottile described it as “The most backdoor-looking bug I’ve ever seen” https://twitter.com/filosottile/status/987376021589692416?s=21 https://twitter.com/filosottile/status/987376021589692416?s=...

ffpip 6y ago
That was the month telegram launched? It's been 7 years. It was a new app. The same bug is still being used against it? Do you have any recent bugs? Or 'backdoors'? All their official apps are open source and reproducible. Must be easy to find bugs for security researchers. They even offer much larger bounties compared to other apps. Anything? I want to believe people saying bad crypto, but it looks like there's no actual proof. Here's something that says it is good, published more recently. https://web.archive.org/web/20180727070936/https://www.susanka.eu/files/telegram-article.pdf https://web.archive.org/web/20180727070936/https://www.susan... https://kryptera.se/assets/uploads/2015/12/Telegram-cryptanalysis.pdf https://kryptera.se/assets/uploads/2015/12/Telegram-cryptana...
- ryanlol 6y ago
  It’s really obvious this wasn’t a bug, but a backdoor. It proves that Telegram is an actively hostile adversary, the fact that their encryption scheme hasn’t been publicly broken since then doesn’t change that. > Or 'backdoors'? You might argue that their deliberate decision to not encrypt most chats is exactly that, more of a front door really. Telegram is a bad actor.