4 ms·
> - It doesn't do e2ee by default. When creating a 1 to 1 chat, it's one of the default buttons. In Android, you click a {pencil} icon, then "new chat" (encry
by skrowl 6y ago
> - It doesn't do e2ee by default.
When creating a 1 to 1 chat, it's one of the default buttons. In Android, you click a {pencil} icon, then "new chat" (encrypted in transit and at rest like your bank website) or "new secret chat" (end to end encrypted)
> - It is not an open protocol.
The protocol is fully open source and audited. https://telegram.org/apps https://telegram.org/apps scroll down to source code.
> - It is not open source.
As above https://telegram.org/apps https://telegram.org/apps . The client apps are fully open source and reproducible.
> - It has a history of extremely poor cryptography
practices.
People pointed out the security issues in MTProto v1, and they were all addressed in MTProto v2 over 3 years ago.
You may be recalling some FUD spread by the author of what eventually became Signal, but none of what you said above is factual.
- deleted 6y ago[deleted]
- faitswulff 6y agoI don't have a security or crypto background, but I saw an interesting bug story about Telegram, provocatively entitled "Cryptography Dispatches: The Most Backdoor-Looking Bug I’ve Ever Seen." "Now, normally the two sides would compute the shared key as (g^a)^b mod p and (g^b)^a mod p. Instead, the original version of MTProto computed it as (g^a)^b mod p XOR nonce where nonce was an arbitrary, supposedly random value sent by the server along with the peer’s public contribution. This was a completely non-standard and useless addition, and all it did was let the server perform an undetected Person-in-the-Middle attack." https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/ https://buttondown.email/cryptography-dispatches/archive/cry...
- snvzz 6y ago>When creating a 1 to 1 chat, it's one of the default buttons. (...) That's a really long way to say e2ee requires special steps: Deliberately selecting "new secret chat". If there's ANY barriers to e2ee such as this one, then non-e2ee ends up being used. That's just how it is, how non-technical people are, and why we should steer everybody away from Telegram.