4 ms·

There are no known attacks against Telegram. The problem is entirely that its cryptography was sketchy and just plain weird to begin with. It wasn't wrong, per

There are no known attacks against Telegram. The problem is entirely that its cryptography was sketchy and just plain weird to begin with. It wasn't wrong, per se, but raised some eyebrows. And then some of the questionable choices were silently fixed removing the ability to MITM, etc, but with no real notice. It's not FUD.

vetinari 6y ago
Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD. Shouldn't we have the same standard for all claims?
- xenocratus 6y ago
  So you're saying we should have the same standard while literally giving two different types of allegations that are thrown at Signal and Telegram respectively? We either consider the funding of both and decide how the funding COULD ultimately impact the product, or we could look at the source code of the applications and the cryptographic theory supporting them and talk about that. If crypto experts aren't finding holes in Signal's protocols [1], I don't think random people on the internet yelling "bUt It WaS fUnDeD bY ..." will make it less secure. [1] https://eprint.iacr.org/2016/1013 https://eprint.iacr.org/2016/1013
- tablespoon 6y ago
  > Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD. > Shouldn't we have the same standard for all claims? Huh? Telegram's protocol has been criticized by cryptographers for making specific "odd" cryptographic choices (see See https://crypto.stackexchange.com/questions/31418/signal-vs-telegram-in-terms-of-protocols https://crypto.stackexchange.com/questions/31418/signal-vs-t...). It's not FUD to bring that up. However, it is FUD to imply something concrete based for vague, indirect reasons.
sascha_sl 6y ago
More than one red flag there, there was the claim of it being secure just because the spec was out there and nobody had broken it yet.
jackbravo 6y ago
and telegram does not used encrypted e2e messages by default. Only on the special secret messages that no ones uses.
lxgr 6y ago
> There are no known attacks against Telegram. Because there isn't anything to meaningfully attack. Chats and chat backups are not encrypted by default.

vetinari 6y ago

Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD. Shouldn't we have the same standard for all claims?

xenocratus 6y ago
So you're saying we should have the same standard while literally giving two different types of allegations that are thrown at Signal and Telegram respectively? We either consider the funding of both and decide how the funding COULD ultimately impact the product, or we could look at the source code of the applications and the cryptographic theory supporting them and talk about that. If crypto experts aren't finding holes in Signal's protocols [1], I don't think random people on the internet yelling "bUt It WaS fUnDeD bY ..." will make it less secure. [1] https://eprint.iacr.org/2016/1013 https://eprint.iacr.org/2016/1013
tablespoon 6y ago
> Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD. > Shouldn't we have the same standard for all claims? Huh? Telegram's protocol has been criticized by cryptographers for making specific "odd" cryptographic choices (see See https://crypto.stackexchange.com/questions/31418/signal-vs-telegram-in-terms-of-protocols https://crypto.stackexchange.com/questions/31418/signal-vs-t...). It's not FUD to bring that up. However, it is FUD to imply something concrete based for vague, indirect reasons.

sascha_sl 6y ago

More than one red flag there, there was the claim of it being secure just because the spec was out there and nobody had broken it yet.

jackbravo 6y ago

and telegram does not used encrypted e2e messages by default. Only on the special secret messages that no ones uses.

lxgr 6y ago

> There are no known attacks against Telegram. Because there isn't anything to meaningfully attack. Chats and chat backups are not encrypted by default.