20 ms·

Cryptographers unearth vulnerabilities in Telegram's encryption protocol

378 points by wglb 5y ago

egberts 5y ago
Wow, zero protection against character transposition. That’s like an intentional weakening of “secured-ness”.
- lucb1e 5y ago
  Where do you read character transposition?
  - egberts 5y ago
    swapping words is a form of character transposition but on a larger scale.
    - karpierz 5y ago
      It's not swapping words, it's swapping message ordering. To swap words, each word would need to be sent in a separate message.
ilrwbwrkhv 5y ago
Telegram is still the fastest,easiest to use,secure messaging platform today and its only getting better.
- atatatat 5y ago
  Dunno about all that, but I still haven't seen someone decrypt a message.
- 0xdeadb00f 5y ago
  Lol
- IntelMiner 5y ago
  Telegram is definitely the most convenient one with mass adoption, especially among the furry community But let's not mistake ease of use for security
- eingaeKaiy8ujie 5y ago
  It's not even possible to use it without a phone number.
  - theshrike79 5y ago
    You can't use Signal or Whatsapp without a phone number either. But what's different is that Telegram doesn't share your phone number to everyone on the same group chat.
    - hirako2000 5y ago
      And the phone number is shared with the provider and if I lose my phone number it can be a serious pain to recover stuff quickly. Signal, telegram and WhatsApp are abomignities. Matrix doesn't tie accounts to cellular numbers (God we still are in a world where those cellular are a requirement to sign up to most things). The matrix network is as transparent as it can be, Element is a decent client that runs on iOS, Android and a Web browser. Element is such a good alternative that the app store appears to be stubly demoting it in the search result, and never seem to show it as a related messaging client. Strange world we live in. Edit: furthermore, Matrix tech both for the server and clients is entirely open source, and one can spin up its own network.
    - maqp 5y ago
      Whataboutism. Also, 1) you generally don't need end-to-end encryption with people you're afraid to share your phone number to, and 2) Signal is already working on usernames.
      - theshrike79 5y ago
        What I don't want is everyone in the school parents group to know my personal phone number thank you very much. I don't care if the chat is encrypted or not, if some malicious actor intercepts our plans for the bake-sale I think we can live with the consequences. Also like 95% of my Telegram group chats moved over from IRC, which also had zero encryption. What we wanted was feature parity (moderation and bots).
- maqp 5y ago
  But that's just the thing now is it. It's NOT secure, that's the problem. * It leaks 100% of messages to server by default. * It leaks 100% of Win/Linux desktop chats with no chance to opt out * It leaks 100% of group message content with no chance to opt out. * It leaks 100% of metadata with no chance to opt out. * It always leaks the intention to hide messages from telegram chats, Telegram knows with whom you are sending secret chats, it knows when, it knows the message size etc. This metadata is extremely valuable Telegram is not in the process of fixing these, thus its security isn't reaching the bare minimum. Thus every feature it is implementing is another way for the company to collect data about you. It's just another Facebook, masquerading itself as "private app for the people". It's run by the man who is literally called "The Mark Zuckerberg of Russia". That man has military education on information warfare / disinformation: He knows how to create a literal cult around his product. There's almost nothing we know about the company like who it employs, how it makes money, what it does with its data. Journalists who tried to get an interview with Durov travelled to Dubai, only to find empty offices. The office workers next door said they had never seen anyone enter Telegram offices. They suspected Telegram was using the office for tax evasion, which is not a good sign. Telegram's been very enthusiastic about a story where they're evading foreign intelligence. If that's the threat model, why is their security strategy "store all messages on one server" (like the NSA et. al. didn't have zero day exploits); The claims about how the data stored on servers is protected, are outright lies a first year computer science student whose taken Computer Organization 101 can disprove[0] Telegram is a dumpster fire and I'd LOVE to be able to say it's security is getting better, but it's NOT. They just implemented group video calls, are those end-to-end encrypted? No, they f'n aren't. Not even NEW features in Telegram are secure by default. You know, the features no-one asked for, that they were in no rush to deploy. It's especially condemnable as the major competition like Zoom, Signal and Jitsi all have end-to-end encrypted group video chats. Telegram staff don't care about me, you or any other user one bit. The only thing they seem to be interested in is "move fast break things" or "move fast f** security". No matter how you put it, Schneier is right when he says data is a toxic asset[1]. Telegram can't give any guarantees data that sits in their server is forever protected, so they shouldn't be collecting it in the first place. WhatsApp is in the process of deploying client-side encrypted cloud backups. This completely shreds Durov's BS claim that Telegram has to have access to your data. There can only be two reasons they collect it: Either they don't care about your security, or they are actually interested in your data. [0] https://security.stackexchange.com/questions/238562/how-does-telegrams-secret-splitting-scheme-work https://security.stackexchange.com/questions/238562/how-does... [1] https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
raziel2p 5y ago
The Telegram team's response to this isn't very encouraging: https://telegra.ph/LoU-ETH-4a-proof-07-16 https://telegra.ph/LoU-ETH-4a-proof-07-16 They don't seem to go into technical details, relying on analogies like bags of sand - maybe this is comforting enough to the general public, but I'm skeptical. I didn't read the technical details of the exploits though, so Telegram might be entirely in the right to be so dismissive.
- capableweb 5y ago
  Here is the comments from the Telegram team for the technically inclined: https://core.telegram.org/techfaq/UoL-ETH-4a-proof https://core.telegram.org/techfaq/UoL-ETH-4a-proof Linked in the third paragraph of the submission: > The researchers also highlighted several traits of MTProto that were changed as the result of our discussions before the paper was published. This document provides an accessible overview of these changes. For more technical details, see here.
- eitland 5y ago
  I don't like the way they communicate regarding security, but for context: So far there has been an extreme amount of FUD thrown their way from people who pushed WhatsApp and Signal.
  - teawrecks 5y ago
    > from people who pushed WhatsApp So Facebook?
    - eitland 5y ago
      No, I'm thinking about well meaning security people who focused a bit too much on E2E-encryption and forgot that WhatsApp sent metadata in bulk to Facebook and uploaded backups unencrypted to Google and/or iCloud.
      - Ar-Curunir 5y ago
        As opposed to Telegram, where chats are unencrypted by default, and synced to the cloud?
gerdesj 5y ago
This is pretty short and to the point: https://mtpsym.github.io/ https://mtpsym.github.io/
krick 5y ago
Given how bashing on MTProto is a favourite cryptographers' activity from the day-0, I'm actually kinda encouraged by the fact that's all they found. It's especially nice, that htey could fix all of them without breaking back-compatibility, which isn't really a given for crypto protocols. Would appreciate more technical and less dumbed down responses from the Telegram team, though. I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean. (Also, it's funny, but being accustomed to SMS and such I always somehow assumed Telegram messages can be reordered by chance too, if I send them fast. I never really thought about it, obviously, but simply didn't expect it to be otherwise.)
- ufmace 5y ago
  That's my takeaway here as well - no serious issues found, and Telegram actively worked with them to fix their minor theoretical issues, and did all of the fixes before the paper was published and without breaking any clients.
- maqp 5y ago
  >I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean.' They have been doing this since the beginning. Their strategy of downplaying every attack against their protocol serves to mask the fact their team has absolutely no qualifications to implement cryptography. Like the original article stated, Telegram did not even file for CVEs, simply because they look bad. CVEs have been filed for much smaller things than these. Their security game isn't on the side of secure-by-design, but grass-roots-damage-control to justify protocol designed by the owner's brother (who is a geometrician, not a cryptographer) and insecure-by-default. The nepotism and Russian pride should never go before the users' security. But they've never cared about it. Slightly related, you should see /r/telegram on Reddit, that outright censors articles that criticizes the app or discuss its vulnerabilities. From the looks of it, Telegram is more a cult these days than a collective of users. Its users are willing to spend hours arguing over semantics, and Telegram shamelessly makes use of them having no life, by recruiting them to something known as Telegram Support Force https://tsf.telegram.org/ https://tsf.telegram.org/
  - 5y ago
lucb1e 5y ago
Do Signal, Wire, or Matrix do this transcript consistency thing, or is there some other way by which they prevent message reordering? From what I know, encrypted messengers almost never implement that. At least in Wire I noticed reordering at some point and it uses an implementation of what is now called the Signal protocol. And that's the most severe vulnerability from the article. The second one is "mostly of theoretical interest" according to the researchers themselves, the third requires "an attacker [to] send many carefully crafted messages to a target, on the order of millions of messages", and the fourth "requires sending billions of messages to a Telegram server within minutes". So while this is not bad research, not at all (it's really great that people take this close a look!), the title sounds rather more severe and people will obviously jump to the conclusion that "See, MTproto is bad like we said all along!" without reading anything. Good research, bad article? «Obligatory notice in Telegram comment threads: the real issue in Telegram is that end-to-end encryption is optional and made extremely inconvenient to use: no implementation at all in TDesktop, can't use it across multiple devices, doesn't work for group chats at all... That is the main reason Telegram isn't secure: they can read all your chats except when you use this stupid inconvenient mode.»
- okdjnfweonfe 5y ago
  https://signal.org/docs/specifications/doubleratchet/#out-of-order-messages https://signal.org/docs/specifications/doubleratchet/#out-of...
  - lucb1e 5y ago
    i.e. messages can be out of order, so no transcript consistency, is that what you're saying?
    - deleted 5y ago
      [deleted]
    - baby 5y ago
      transcript consistency is usually something that matters in group chat, and signal/matrix/and pretty much all group chat apps rely on a trusted server to order messages.
strogonoff 5y ago
It doesn't matter much what vulnerabilities there are when a large chunk of your users don't even use e2e encryption. For a while recently I had used Telegram to communicate with a few people, and as an experiment I did not turn on e2e myself. Well, neither did any of my counterparts (even the more security conscious ones). I suspect people are inclined to use it only in special cases, as the UX rather gives off the vibe of pulling your counterpart into the cover of a dark side alley at night (rather than being the default of a presumably secure messenger).
- noxer 5y ago
  It has severe drawbacks if you use e2e. The default is without because that's what most people want.
  - strogonoff 5y ago
    Part of my point. I use WhatsApp and Signal, both using the Signal protocol, and experience no drawbacks whatsoever. In any case, for a messenger that advertises as secure, placing security after convenience seems pretty unusual.
    - Laarlf 5y ago
      No drawbacks? Whatsapp requires your phone to be on and have Whatsapp running in the background if you want to use it over Whatsapp Web. Also the amount of Messages and Media that Telegram delivers to me would not fit on my Phone. Also let's not forget what a bad user experience Whatsapp offers apart from that. No bots, no channels, no hiding your phone number, no polls, limited permission system in groups,... i could continue for 20 minutes. But what is most infuriating to me is the backup system. It never works and you can only store it in iCloud/Google Drive.
      - beermonster 5y ago
        See https://www.theverge.com/2021/7/14/22577594/whatsapp-multi-device-e2e-facebook https://www.theverge.com/2021/7/14/22577594/whatsapp-multi-d...
JanisErdmanis 5y ago
Being in the academia and kn knowing it's culture I will help to translate. The cryptographers studied the Telegram protocol and did not find practical vulnerabilities. So to pay their "academic debts" they published a paper on a vulnerability which can mess up senders messages in a random way.
- martinralbrecht 5y ago
  Since you know the culture in academia so well you may also be familiar with that custom where you glance over the actual paper before making assertions about it. Not even asking you to read it, just glance at it.
  - JanisErdmanis 5y ago
    Yes, I am guilty about it. The original source [1] is indeed much more nuanced and humble than I thought it would be. [1]:https://mtpsym.github.io https://mtpsym.github.io
- maqp 5y ago
  Were you in the academia, you'd know Telegram should've hired a cryptographer when they started, almost a decade ago. They have never done that, because to them pride is more important than doing things right. You, an academic, spending your Sunday defending some random messaging app company online a, and doing it for free, is almost as stupid as the parent company's decisions to favor grass-roots damage control over secure-by-default design.
  - dijit 5y ago
    You seem to have a chip on your shoulder regarding telegram. I’ve seen your comments up and down this thread and they do not merit rebuttal because they’re so dearly held opinions. But let me be clear: all cryptography is “untested” or “unused” at some point. There’s nothing inherently wrong with making a new cryptographic method. Criticisms I would agree with are: 1) Advertising as a secure messenger (or: the most secure) as it is stupid to say “most” and the security is untested. 2) bug bounties on the protocol as a marketing method to show that it’s not broken. 3) being of russian origin (which, obviously they can’t control, but if this was a US company doing this it wouldn’t have gotten so much negative press). —- What we might forget, especially as telegram marketing is so slick and the art so good: building things is hard, we might not always make the right move- it’s fair to criticise but I doubt any of us would do markedly better, we’d just make different trade offs; and some other forum for “accessibility design” would be lambasting us for making our own keyboard or something.
_huayra_ 5y ago
I'm really curious how Telegram makes money. Signal had (has?) their crypto thing, Whatsapp snarfs up the user graph / interactions, but Telegram just supposedly shows adds on large groups. I really don't know how that is enough to support half a billion users, just in terms of hardware cost. Are they spying on some group of crypto whales to get insider info?
- owlbynight 5y ago
  It took me like 5 seconds to get an answer for this with a search. Please don't posit wildly speculative scenarios in public forums.
  - tester756 5y ago
    ? Article 1: >How does Telegram make money? >Telegram doesn’t make money, or at least it doesn’t generate revenues, as of 2019. Durov pointed out on a blog post that he “believes in fast and secure messaging that is also 100% free.” >On the same blog, post, Telegram notes that if it were to run out of money, it might introduce “non-essential paid options” to supplement developers’ salaries. Article 2: >All the features that are currently free will stay free. We will add some new features for business teams or power users. Some of these features will require more resources and will be paid for by these premium users. Regular users will be able to keep enjoying Telegram – for free, forever. >In addition to its messaging component, Telegram has a social networking dimension. Our massive public one-to-many channels can have millions of subscribers each and are more like Twitter feeds. In many markets the owners of such channels display ads to earn money, sometimes using third-party ad platforms. The ads they post look like regular messages, and are often intrusive. We will fix this by introducing our own Ad Platform for public one-to-many channels – one that is user-friendly, respects privacy and allows us to cover the costs of servers and traffic. >If Telegram starts earning money, the community should also benefit. For example, If we monetize large public one-to-many channels via the Ad Platform, the owners of these channels will receive free traffic in proportion to their size. Or, if Telegram introduces premium stickers with additional expressive features, the artists who make stickers of this new type will also get a part of the profit. We want millions of Telegram-based creators and small businesses to thrive, enriching the experience of all our users. so... they don't?
templarchamp 5y ago
One day, as the nature of hardware changes, these cryptos will be exposed.
kiryin 5y ago
I would avoid Telegram even not having read this. Their homegrown encryption and secretive nature of the back-end creep me out. The irrational part of me is also wary of the developers' background. At the same time I also can not bring myself to trust the other popular options either. Whatsapp should be a pretty obvious case of facebookiness, and signal suffers from the same lack of back-end transparency and decentralization as Telegram. And, believe me I don't want to bring this up, but Moxie is just such an incredibly untrustworthy figure I wouldn't be able to sleep at night trusting his thing. The only option with any real adoption (still not at the scale of the previously mentioned though) is Matrix. Having familiarized myself with Olm and their implementation of it for the purpose of building clone for educational purposes, I feel safe trusting it. You can't go much more open and transparent than Matrix does.
- deleted 5y ago
  [deleted]
- tester756 5y ago
  Maybe this reddit comment will make you less worried /s >The lead Telegram dev is a 3x International Math Olympiad gold medalist, won another gold in the informatiks olympiad, went on to earn two Ph.D.'s in algebraic geometry, all while working full-time as a programmer? >Him rolling his own encryption algorithm is not the same as your copy-paste StackOverflow code monkey who scraped by with C's at his community college rearranging the alphabet letters in a caesar cipher.
  - maqp 5y ago
    >The lead Telegram dev is a 3x International Math Olympiad gold medalist The lead dev * doesn't have ANY qualifications as a cryptographer (he got his position through nothing other than nepotism) and thus * thought AES-IGE was best practice * used SHA-1 10 years after SHA256 was published * didn't understand the importance of DH parameter pinning * left in a 64-bit pre-computation MITM attack vector * initially implemented crappy QR-code like fingerprint for secret chats without understanding the need for hex-decimals that could be compared over authenticated channels * couldn't implement IND-CCA secure protocol * didn't prevent these FOUR new vulnerabilities But most importantly: * doesn't have the know-how on how to implement E2EE for groups * doesn't have the know-how on how to implement E2EE for 1:1 on Win/Linux desktop clients * doesn't understand E2EE needs to be enabled by default They are literally just winging it. Their Russian Pride would take too large a hit from publishing a CVE wrt the most recent issues, thus they downplayed the issues and wiggled out to maintain the prestigious image in front of the cult that is their users.
isatty 5y ago
While bashing on Telegram is basically HNs favorite past time, there aren't many other alternatives that work just as well in the area that I care the most about: being a great chat app. Telegram is fast, has native clients instead of a garbage web ui (or electron based app), has better stickers than the alternatives, is easy to write bots for and has a larger user base where I'm at than any of the alternatives other than WhatsApp.
- Laarlf 5y ago
  Matrix or IRC if you hate yourself.
  - isatty 5y ago
    I'm a long time user of IRC, but none of my irl friends are on it (anymore).
    - Laarlf 5y ago
      IRC for me is a way to seek support for OSS projects and nothing else. It is not really designed to be a IM for phones...
  - theshrike79 5y ago
    IRC is really hard to do well, since it requires a consistent TCP connection to really be useful :/
    - joecool1029 5y ago
      Combine the parent's suggestions and use IRC over a Matrix bridge. It checks all the boxes when it works and as their comment mentioned you'll learn to hate things when it doesn't!
    - Siira 5y ago
      I use a self-hosted web client (thelounge). It's still not good for casual IM usage IMO, but it's pretty painless.
Amin699 5y ago
Good job
martinralbrecht 5y ago
This is a write-up of our research presented here: https://mtpsym.github.io/paper.pdf https://mtpsym.github.io/paper.pdf We give a high-level overview of what we found here: https://mtpsym.github.io/ https://mtpsym.github.io/ We also include a discussion of how to interpret our attacks.
tyrion 5y ago
It is tiring that this keeps happening. These media outlet publish misleading titles and abstracts implying that Telegram is not secure, knowing very well that most people don't even read the articles. I assumed good faith for the first ~100 times, but it is always the same :D Anyway, wouldn't it be better to link to the academic source ( https://mtpsym.github.io/ https://mtpsym.github.io/ ), or at least to remove click bait titles?
- maqp 5y ago
  It's tiring to see people claim Telegram is Secure e.g. "because it hasn't been hacked yet" :D These people don't realize Telegram is front doored by design, it leaks 100% of your chats to Mark Zuckerberg of Russia, just like Facebook Messeger leaks 100% of its messages to Mark Zuckerberg of USA.
  - tyrion 5y ago
    I did not claim Telegram to be secure. It has nothing to do with what I said. Moreover, saying that something "is secure" does not make too much sense, without specifying secure against what. Assuming you are in good faith, I will try to explain better: The title of the article states there are vulnerabilities in the encryption protocol. According to RFC 4949 a vulnerability is: > A flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy. Clearly stating that there are vulnerabilities in Telegram's encryption protocol raises concerns, a lot of confirmation bias among Telegram haters, and leaves people who only read the titles with the feeling that Telegram encryption is vulnerable to attacks. However, among the 4 flaws reported by the researchers, 3 are not exploitable ("This attack is mostly of theoretical interest", "Luckily, it is almost impossible to carry out in practice", "Luckily, this attack is also quite difficult to carry out, as it requires sending billions of messages to a Telegram server within minutes") and the other one is about reordering encrypted messages. Therefore, a more fair headline which would undoubtedly raise less interest could be "Researchers found a way to change the order of your Telegram messages, even if they still cannot read them", or "Researchers found some purely theoretical or almost impossible to carry out vulnerabilities in Telegram's encryption protocol". And don't even get me started about the fact that literally everybody, including expert security researchers, feel entitled to bash Telegram for having rolled their own crypto at every chance they get.
deleted 5y ago
[deleted]
traveler01 5y ago
People here failed to realize Telegram made a clear choice between usability and security. Cloud messages make it very useful and their groups are awesome. And you can always turn on E2E if you really want to use it. It works only on smartphones (probably they should add an option...) but it's there and works pretty fine.
- traveler01 5y ago
  And let's not forget. People are studying their encryption protocol and they're not finding anything special. It's not like you can actually decrypt messages.
  - maqp 5y ago
    There is nothing to break when the cloud chats are a backdoor by design. Imagine a vendor selling bullet proof glass. They're arguing the glass itself is extremely durable. These jabs at Telegram protocol are like attempts to break the glass. Here's the problem, that glass has a three meter hole in the middle of it. That hole is called cloud encryption. Telegram leaks * 100% of messages by default to server. This is the same as if Signal had a backdoor for all of its messages. * 100% of group messages with no chance to opt out. This is the same as Signal had backdoor for all of its group messages. * 100% of all messages for Windows/Linux desktop clients. This is the same if Signal desktop client for Windows / Linux had a backdoor that leaked all messages to Moxie. Telegram's strategy is to exploit that three meter hole. They published a bounty for 100,000 dollars for anyone who could break the glass. But the competition didn't award any points for pointing at the massive hole in the glass. So no, nobody's finding anything special in Telegram's encryption, because EVERYONE got bored of pointing at the hole back in 2013 when Telegram was released. Telegram's backdoor is the front door. It's so absurdly obvious it's insane anyone would ever have to point it out. But it's right there, if you just bother to look.
    - traveler01 5y ago
      As I said, easily fixed by just using secret chats... Worse things it's that they don't work with group messages and etc. They gave people the choice though. You can use however you feel like it. Basically what you're doing is what Apple does for its users: patronizing. You just think what's great for everyone. Also, they explain in their FAQs that they don't have the encryption key in the same datacenter, that they have those keys in different datacenters in different jurisdictions so law enforcement can't force them to decrypt the messages.
andy_ppp 5y ago
I often wonder if it’s just easier to crack at the phone level and just get data from memory as it’s unencrypted on the device rather than the quite good protocols that may have some problems. Are we all looking in the wrong place? Personally I’m sure if state actors want they can read your messages, one way or another.
upofadown 5y ago
Who would possibly care that their instant messages might be made to arrive out of order? You could even claim it as some sort of feature. If you get confronted about something you said just claim that you said it in a different order. Plausible deniability though forgeable ordering. Which strikes me as sort of funny because deniability is something that often gets promoted as a critical feature but has no practical implications for anyone either.
motohagiography 5y ago
Reading just the article and going out on a limb, it sounds like they are exploiting the window of valid sequence numbers in a session to enable out of order delivery. I'd speculate the basic problem in the protocol is that session sequence numbers (counters) can be incremented by sending invalid messages, and there is a window of n plus or minus x, where x is how much the counter/sequence number on a valid message can be off-by and still be processed. Flooding the session to increment the counter above the valid window would yield undefined behavior in a few ways. When a peer gets desynched, either the client or server may kill the session and require a new negotiation handshake with the peer (a DoS vulnerability) - or it attempts to recalculate the window of counter values it will accept based on its last known good message, which sounds like it effectively causes the valid messages in that chain to "fold" back on themselves in their order. I'd suspect this was a design decision and understood by the protocol architects. If you aren't using an CMAC, a ratchet function (or a kdf based on hashing) which proves deterministically what the current sequence of messages is, instead of using a sliding window, you are going to have a similar or analogous sequence number "window" problems in your protocol. Some message sequence schemes use an obfuscated counter where instead of say, integers, you use some function over a field. (hence GCM, as I loosely apprehend it) But even the seed for that function just becomes another secret to manage (imo), so protocols that depend on counters earn extra scrutiny. The reason to use sequence numbers (counters) instead of ratcheting or hashing is because sometimes you're just substituting the managability of a sequence number counter window problem with another key management problem that has has a different set of known vulnerabilities, and you make the call based on your threat model. Perhaps the researchers' actual findings are more complex than this, and it isn't just a gotcha criticism of a design decision that had clear trade offs, which few are equipped to object to.

378 points by wglb 5y ago

egberts 5y ago

Wow, zero protection against character transposition. That’s like an intentional weakening of “secured-ness”.

lucb1e 5y ago
Where do you read character transposition?
- egberts 5y ago
  swapping words is a form of character transposition but on a larger scale.
  - karpierz 5y ago
    It's not swapping words, it's swapping message ordering. To swap words, each word would need to be sent in a separate message.

ilrwbwrkhv 5y ago

Telegram is still the fastest,easiest to use,secure messaging platform today and its only getting better.

atatatat 5y ago
Dunno about all that, but I still haven't seen someone decrypt a message.
0xdeadb00f 5y ago
Lol
IntelMiner 5y ago
Telegram is definitely the most convenient one with mass adoption, especially among the furry community But let's not mistake ease of use for security
eingaeKaiy8ujie 5y ago
It's not even possible to use it without a phone number.
- theshrike79 5y ago
  You can't use Signal or Whatsapp without a phone number either. But what's different is that Telegram doesn't share your phone number to everyone on the same group chat.
  - hirako2000 5y ago
    And the phone number is shared with the provider and if I lose my phone number it can be a serious pain to recover stuff quickly. Signal, telegram and WhatsApp are abomignities. Matrix doesn't tie accounts to cellular numbers (God we still are in a world where those cellular are a requirement to sign up to most things). The matrix network is as transparent as it can be, Element is a decent client that runs on iOS, Android and a Web browser. Element is such a good alternative that the app store appears to be stubly demoting it in the search result, and never seem to show it as a related messaging client. Strange world we live in. Edit: furthermore, Matrix tech both for the server and clients is entirely open source, and one can spin up its own network.
  - maqp 5y ago
    Whataboutism. Also, 1) you generally don't need end-to-end encryption with people you're afraid to share your phone number to, and 2) Signal is already working on usernames.
    - theshrike79 5y ago
      What I don't want is everyone in the school parents group to know my personal phone number thank you very much. I don't care if the chat is encrypted or not, if some malicious actor intercepts our plans for the bake-sale I think we can live with the consequences. Also like 95% of my Telegram group chats moved over from IRC, which also had zero encryption. What we wanted was feature parity (moderation and bots).
maqp 5y ago
But that's just the thing now is it. It's NOT secure, that's the problem. * It leaks 100% of messages to server by default. * It leaks 100% of Win/Linux desktop chats with no chance to opt out * It leaks 100% of group message content with no chance to opt out. * It leaks 100% of metadata with no chance to opt out. * It always leaks the intention to hide messages from telegram chats, Telegram knows with whom you are sending secret chats, it knows when, it knows the message size etc. This metadata is extremely valuable Telegram is not in the process of fixing these, thus its security isn't reaching the bare minimum. Thus every feature it is implementing is another way for the company to collect data about you. It's just another Facebook, masquerading itself as "private app for the people". It's run by the man who is literally called "The Mark Zuckerberg of Russia". That man has military education on information warfare / disinformation: He knows how to create a literal cult around his product. There's almost nothing we know about the company like who it employs, how it makes money, what it does with its data. Journalists who tried to get an interview with Durov travelled to Dubai, only to find empty offices. The office workers next door said they had never seen anyone enter Telegram offices. They suspected Telegram was using the office for tax evasion, which is not a good sign. Telegram's been very enthusiastic about a story where they're evading foreign intelligence. If that's the threat model, why is their security strategy "store all messages on one server" (like the NSA et. al. didn't have zero day exploits); The claims about how the data stored on servers is protected, are outright lies a first year computer science student whose taken Computer Organization 101 can disprove[0] Telegram is a dumpster fire and I'd LOVE to be able to say it's security is getting better, but it's NOT. They just implemented group video calls, are those end-to-end encrypted? No, they f'n aren't. Not even NEW features in Telegram are secure by default. You know, the features no-one asked for, that they were in no rush to deploy. It's especially condemnable as the major competition like Zoom, Signal and Jitsi all have end-to-end encrypted group video chats. Telegram staff don't care about me, you or any other user one bit. The only thing they seem to be interested in is "move fast break things" or "move fast f** security". No matter how you put it, Schneier is right when he says data is a toxic asset[1]. Telegram can't give any guarantees data that sits in their server is forever protected, so they shouldn't be collecting it in the first place. WhatsApp is in the process of deploying client-side encrypted cloud backups. This completely shreds Durov's BS claim that Telegram has to have access to your data. There can only be two reasons they collect it: Either they don't care about your security, or they are actually interested in your data. [0] https://security.stackexchange.com/questions/238562/how-does-telegrams-secret-splitting-scheme-work https://security.stackexchange.com/questions/238562/how-does... [1] https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

raziel2p 5y ago

The Telegram team's response to this isn't very encouraging: https://telegra.ph/LoU-ETH-4a-proof-07-16 https://telegra.ph/LoU-ETH-4a-proof-07-16 They don't seem to go into technical details, relying on analogies like bags of sand - maybe this is comforting enough to the general public, but I'm skeptical. I didn't read the technical details of the exploits though, so Telegram might be entirely in the right to be so dismissive.

capableweb 5y ago
Here is the comments from the Telegram team for the technically inclined: https://core.telegram.org/techfaq/UoL-ETH-4a-proof https://core.telegram.org/techfaq/UoL-ETH-4a-proof Linked in the third paragraph of the submission: > The researchers also highlighted several traits of MTProto that were changed as the result of our discussions before the paper was published. This document provides an accessible overview of these changes. For more technical details, see here.
eitland 5y ago
I don't like the way they communicate regarding security, but for context: So far there has been an extreme amount of FUD thrown their way from people who pushed WhatsApp and Signal.
- teawrecks 5y ago
  > from people who pushed WhatsApp So Facebook?
  - eitland 5y ago
    No, I'm thinking about well meaning security people who focused a bit too much on E2E-encryption and forgot that WhatsApp sent metadata in bulk to Facebook and uploaded backups unencrypted to Google and/or iCloud.
    - Ar-Curunir 5y ago
      As opposed to Telegram, where chats are unencrypted by default, and synced to the cloud?

gerdesj 5y ago

This is pretty short and to the point: https://mtpsym.github.io/ https://mtpsym.github.io/

krick 5y ago

Given how bashing on MTProto is a favourite cryptographers' activity from the day-0, I'm actually kinda encouraged by the fact that's all they found. It's especially nice, that htey could fix all of them without breaking back-compatibility, which isn't really a given for crypto protocols. Would appreciate more technical and less dumbed down responses from the Telegram team, though. I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean. (Also, it's funny, but being accustomed to SMS and such I always somehow assumed Telegram messages can be reordered by chance too, if I send them fast. I never really thought about it, obviously, but simply didn't expect it to be otherwise.)

ufmace 5y ago
That's my takeaway here as well - no serious issues found, and Telegram actively worked with them to fix their minor theoretical issues, and did all of the fixes before the paper was published and without breaking any clients.
maqp 5y ago
>I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean.' They have been doing this since the beginning. Their strategy of downplaying every attack against their protocol serves to mask the fact their team has absolutely no qualifications to implement cryptography. Like the original article stated, Telegram did not even file for CVEs, simply because they look bad. CVEs have been filed for much smaller things than these. Their security game isn't on the side of secure-by-design, but grass-roots-damage-control to justify protocol designed by the owner's brother (who is a geometrician, not a cryptographer) and insecure-by-default. The nepotism and Russian pride should never go before the users' security. But they've never cared about it. Slightly related, you should see /r/telegram on Reddit, that outright censors articles that criticizes the app or discuss its vulnerabilities. From the looks of it, Telegram is more a cult these days than a collective of users. Its users are willing to spend hours arguing over semantics, and Telegram shamelessly makes use of them having no life, by recruiting them to something known as Telegram Support Force https://tsf.telegram.org/ https://tsf.telegram.org/
- 5y ago

lucb1e 5y ago

Do Signal, Wire, or Matrix do this transcript consistency thing, or is there some other way by which they prevent message reordering? From what I know, encrypted messengers almost never implement that. At least in Wire I noticed reordering at some point and it uses an implementation of what is now called the Signal protocol. And that's the most severe vulnerability from the article. The second one is "mostly of theoretical interest" according to the researchers themselves, the third requires "an attacker [to] send many carefully crafted messages to a target, on the order of millions of messages", and the fourth "requires sending billions of messages to a Telegram server within minutes". So while this is not bad research, not at all (it's really great that people take this close a look!), the title sounds rather more severe and people will obviously jump to the conclusion that "See, MTproto is bad like we said all along!" without reading anything. Good research, bad article? «Obligatory notice in Telegram comment threads: the real issue in Telegram is that end-to-end encryption is optional and made extremely inconvenient to use: no implementation at all in TDesktop, can't use it across multiple devices, doesn't work for group chats at all... That is the main reason Telegram isn't secure: they can read all your chats except when you use this stupid inconvenient mode.»

okdjnfweonfe 5y ago
https://signal.org/docs/specifications/doubleratchet/#out-of-order-messages https://signal.org/docs/specifications/doubleratchet/#out-of...
- lucb1e 5y ago
  i.e. messages can be out of order, so no transcript consistency, is that what you're saying?
  - deleted 5y ago
    [deleted]
  - baby 5y ago
    transcript consistency is usually something that matters in group chat, and signal/matrix/and pretty much all group chat apps rely on a trusted server to order messages.

strogonoff 5y ago

It doesn't matter much what vulnerabilities there are when a large chunk of your users don't even use e2e encryption. For a while recently I had used Telegram to communicate with a few people, and as an experiment I did not turn on e2e myself. Well, neither did any of my counterparts (even the more security conscious ones). I suspect people are inclined to use it only in special cases, as the UX rather gives off the vibe of pulling your counterpart into the cover of a dark side alley at night (rather than being the default of a presumably secure messenger).

noxer 5y ago
It has severe drawbacks if you use e2e. The default is without because that's what most people want.
- strogonoff 5y ago
  Part of my point. I use WhatsApp and Signal, both using the Signal protocol, and experience no drawbacks whatsoever. In any case, for a messenger that advertises as secure, placing security after convenience seems pretty unusual.
  - Laarlf 5y ago
    No drawbacks? Whatsapp requires your phone to be on and have Whatsapp running in the background if you want to use it over Whatsapp Web. Also the amount of Messages and Media that Telegram delivers to me would not fit on my Phone. Also let's not forget what a bad user experience Whatsapp offers apart from that. No bots, no channels, no hiding your phone number, no polls, limited permission system in groups,... i could continue for 20 minutes. But what is most infuriating to me is the backup system. It never works and you can only store it in iCloud/Google Drive.
    - beermonster 5y ago
      See https://www.theverge.com/2021/7/14/22577594/whatsapp-multi-device-e2e-facebook https://www.theverge.com/2021/7/14/22577594/whatsapp-multi-d...

JanisErdmanis 5y ago

Being in the academia and kn knowing it's culture I will help to translate. The cryptographers studied the Telegram protocol and did not find practical vulnerabilities. So to pay their "academic debts" they published a paper on a vulnerability which can mess up senders messages in a random way.

martinralbrecht 5y ago
Since you know the culture in academia so well you may also be familiar with that custom where you glance over the actual paper before making assertions about it. Not even asking you to read it, just glance at it.
- JanisErdmanis 5y ago
  Yes, I am guilty about it. The original source [1] is indeed much more nuanced and humble than I thought it would be. [1]:https://mtpsym.github.io https://mtpsym.github.io
maqp 5y ago
Were you in the academia, you'd know Telegram should've hired a cryptographer when they started, almost a decade ago. They have never done that, because to them pride is more important than doing things right. You, an academic, spending your Sunday defending some random messaging app company online a, and doing it for free, is almost as stupid as the parent company's decisions to favor grass-roots damage control over secure-by-default design.
- dijit 5y ago
  You seem to have a chip on your shoulder regarding telegram. I’ve seen your comments up and down this thread and they do not merit rebuttal because they’re so dearly held opinions. But let me be clear: all cryptography is “untested” or “unused” at some point. There’s nothing inherently wrong with making a new cryptographic method. Criticisms I would agree with are: 1) Advertising as a secure messenger (or: the most secure) as it is stupid to say “most” and the security is untested. 2) bug bounties on the protocol as a marketing method to show that it’s not broken. 3) being of russian origin (which, obviously they can’t control, but if this was a US company doing this it wouldn’t have gotten so much negative press). —- What we might forget, especially as telegram marketing is so slick and the art so good: building things is hard, we might not always make the right move- it’s fair to criticise but I doubt any of us would do markedly better, we’d just make different trade offs; and some other forum for “accessibility design” would be lambasting us for making our own keyboard or something.

_huayra_ 5y ago

I'm really curious how Telegram makes money. Signal had (has?) their crypto thing, Whatsapp snarfs up the user graph / interactions, but Telegram just supposedly shows adds on large groups. I really don't know how that is enough to support half a billion users, just in terms of hardware cost. Are they spying on some group of crypto whales to get insider info?

owlbynight 5y ago
It took me like 5 seconds to get an answer for this with a search. Please don't posit wildly speculative scenarios in public forums.
- tester756 5y ago
  ? Article 1: >How does Telegram make money? >Telegram doesn’t make money, or at least it doesn’t generate revenues, as of 2019. Durov pointed out on a blog post that he “believes in fast and secure messaging that is also 100% free.” >On the same blog, post, Telegram notes that if it were to run out of money, it might introduce “non-essential paid options” to supplement developers’ salaries. Article 2: >All the features that are currently free will stay free. We will add some new features for business teams or power users. Some of these features will require more resources and will be paid for by these premium users. Regular users will be able to keep enjoying Telegram – for free, forever. >In addition to its messaging component, Telegram has a social networking dimension. Our massive public one-to-many channels can have millions of subscribers each and are more like Twitter feeds. In many markets the owners of such channels display ads to earn money, sometimes using third-party ad platforms. The ads they post look like regular messages, and are often intrusive. We will fix this by introducing our own Ad Platform for public one-to-many channels – one that is user-friendly, respects privacy and allows us to cover the costs of servers and traffic. >If Telegram starts earning money, the community should also benefit. For example, If we monetize large public one-to-many channels via the Ad Platform, the owners of these channels will receive free traffic in proportion to their size. Or, if Telegram introduces premium stickers with additional expressive features, the artists who make stickers of this new type will also get a part of the profit. We want millions of Telegram-based creators and small businesses to thrive, enriching the experience of all our users. so... they don't?

templarchamp 5y ago

One day, as the nature of hardware changes, these cryptos will be exposed.

kiryin 5y ago

I would avoid Telegram even not having read this. Their homegrown encryption and secretive nature of the back-end creep me out. The irrational part of me is also wary of the developers' background. At the same time I also can not bring myself to trust the other popular options either. Whatsapp should be a pretty obvious case of facebookiness, and signal suffers from the same lack of back-end transparency and decentralization as Telegram. And, believe me I don't want to bring this up, but Moxie is just such an incredibly untrustworthy figure I wouldn't be able to sleep at night trusting his thing. The only option with any real adoption (still not at the scale of the previously mentioned though) is Matrix. Having familiarized myself with Olm and their implementation of it for the purpose of building clone for educational purposes, I feel safe trusting it. You can't go much more open and transparent than Matrix does.

deleted 5y ago
[deleted]
tester756 5y ago
Maybe this reddit comment will make you less worried /s >The lead Telegram dev is a 3x International Math Olympiad gold medalist, won another gold in the informatiks olympiad, went on to earn two Ph.D.'s in algebraic geometry, all while working full-time as a programmer? >Him rolling his own encryption algorithm is not the same as your copy-paste StackOverflow code monkey who scraped by with C's at his community college rearranging the alphabet letters in a caesar cipher.
- maqp 5y ago
  >The lead Telegram dev is a 3x International Math Olympiad gold medalist The lead dev * doesn't have ANY qualifications as a cryptographer (he got his position through nothing other than nepotism) and thus * thought AES-IGE was best practice * used SHA-1 10 years after SHA256 was published * didn't understand the importance of DH parameter pinning * left in a 64-bit pre-computation MITM attack vector * initially implemented crappy QR-code like fingerprint for secret chats without understanding the need for hex-decimals that could be compared over authenticated channels * couldn't implement IND-CCA secure protocol * didn't prevent these FOUR new vulnerabilities But most importantly: * doesn't have the know-how on how to implement E2EE for groups * doesn't have the know-how on how to implement E2EE for 1:1 on Win/Linux desktop clients * doesn't understand E2EE needs to be enabled by default They are literally just winging it. Their Russian Pride would take too large a hit from publishing a CVE wrt the most recent issues, thus they downplayed the issues and wiggled out to maintain the prestigious image in front of the cult that is their users.

isatty 5y ago

While bashing on Telegram is basically HNs favorite past time, there aren't many other alternatives that work just as well in the area that I care the most about: being a great chat app. Telegram is fast, has native clients instead of a garbage web ui (or electron based app), has better stickers than the alternatives, is easy to write bots for and has a larger user base where I'm at than any of the alternatives other than WhatsApp.

Laarlf 5y ago
Matrix or IRC if you hate yourself.
- isatty 5y ago
  I'm a long time user of IRC, but none of my irl friends are on it (anymore).
  - Laarlf 5y ago
    IRC for me is a way to seek support for OSS projects and nothing else. It is not really designed to be a IM for phones...
- theshrike79 5y ago
  IRC is really hard to do well, since it requires a consistent TCP connection to really be useful :/
  - joecool1029 5y ago
    Combine the parent's suggestions and use IRC over a Matrix bridge. It checks all the boxes when it works and as their comment mentioned you'll learn to hate things when it doesn't!
  - Siira 5y ago
    I use a self-hosted web client (thelounge). It's still not good for casual IM usage IMO, but it's pretty painless.

Amin699 5y ago

Good job

martinralbrecht 5y ago

This is a write-up of our research presented here: https://mtpsym.github.io/paper.pdf https://mtpsym.github.io/paper.pdf We give a high-level overview of what we found here: https://mtpsym.github.io/ https://mtpsym.github.io/ We also include a discussion of how to interpret our attacks.

tyrion 5y ago

It is tiring that this keeps happening. These media outlet publish misleading titles and abstracts implying that Telegram is not secure, knowing very well that most people don't even read the articles. I assumed good faith for the first ~100 times, but it is always the same :D Anyway, wouldn't it be better to link to the academic source ( https://mtpsym.github.io/ https://mtpsym.github.io/ ), or at least to remove click bait titles?

maqp 5y ago
It's tiring to see people claim Telegram is Secure e.g. "because it hasn't been hacked yet" :D These people don't realize Telegram is front doored by design, it leaks 100% of your chats to Mark Zuckerberg of Russia, just like Facebook Messeger leaks 100% of its messages to Mark Zuckerberg of USA.
- tyrion 5y ago
  I did not claim Telegram to be secure. It has nothing to do with what I said. Moreover, saying that something "is secure" does not make too much sense, without specifying secure against what. Assuming you are in good faith, I will try to explain better: The title of the article states there are vulnerabilities in the encryption protocol. According to RFC 4949 a vulnerability is: > A flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy. Clearly stating that there are vulnerabilities in Telegram's encryption protocol raises concerns, a lot of confirmation bias among Telegram haters, and leaves people who only read the titles with the feeling that Telegram encryption is vulnerable to attacks. However, among the 4 flaws reported by the researchers, 3 are not exploitable ("This attack is mostly of theoretical interest", "Luckily, it is almost impossible to carry out in practice", "Luckily, this attack is also quite difficult to carry out, as it requires sending billions of messages to a Telegram server within minutes") and the other one is about reordering encrypted messages. Therefore, a more fair headline which would undoubtedly raise less interest could be "Researchers found a way to change the order of your Telegram messages, even if they still cannot read them", or "Researchers found some purely theoretical or almost impossible to carry out vulnerabilities in Telegram's encryption protocol". And don't even get me started about the fact that literally everybody, including expert security researchers, feel entitled to bash Telegram for having rolled their own crypto at every chance they get.

deleted 5y ago

[deleted]

traveler01 5y ago

People here failed to realize Telegram made a clear choice between usability and security. Cloud messages make it very useful and their groups are awesome. And you can always turn on E2E if you really want to use it. It works only on smartphones (probably they should add an option...) but it's there and works pretty fine.

traveler01 5y ago
And let's not forget. People are studying their encryption protocol and they're not finding anything special. It's not like you can actually decrypt messages.
- maqp 5y ago
  There is nothing to break when the cloud chats are a backdoor by design. Imagine a vendor selling bullet proof glass. They're arguing the glass itself is extremely durable. These jabs at Telegram protocol are like attempts to break the glass. Here's the problem, that glass has a three meter hole in the middle of it. That hole is called cloud encryption. Telegram leaks * 100% of messages by default to server. This is the same as if Signal had a backdoor for all of its messages. * 100% of group messages with no chance to opt out. This is the same as Signal had backdoor for all of its group messages. * 100% of all messages for Windows/Linux desktop clients. This is the same if Signal desktop client for Windows / Linux had a backdoor that leaked all messages to Moxie. Telegram's strategy is to exploit that three meter hole. They published a bounty for 100,000 dollars for anyone who could break the glass. But the competition didn't award any points for pointing at the massive hole in the glass. So no, nobody's finding anything special in Telegram's encryption, because EVERYONE got bored of pointing at the hole back in 2013 when Telegram was released. Telegram's backdoor is the front door. It's so absurdly obvious it's insane anyone would ever have to point it out. But it's right there, if you just bother to look.
  - traveler01 5y ago
    As I said, easily fixed by just using secret chats... Worse things it's that they don't work with group messages and etc. They gave people the choice though. You can use however you feel like it. Basically what you're doing is what Apple does for its users: patronizing. You just think what's great for everyone. Also, they explain in their FAQs that they don't have the encryption key in the same datacenter, that they have those keys in different datacenters in different jurisdictions so law enforcement can't force them to decrypt the messages.

andy_ppp 5y ago

I often wonder if it’s just easier to crack at the phone level and just get data from memory as it’s unencrypted on the device rather than the quite good protocols that may have some problems. Are we all looking in the wrong place? Personally I’m sure if state actors want they can read your messages, one way or another.

upofadown 5y ago

Who would possibly care that their instant messages might be made to arrive out of order? You could even claim it as some sort of feature. If you get confronted about something you said just claim that you said it in a different order. Plausible deniability though forgeable ordering. Which strikes me as sort of funny because deniability is something that often gets promoted as a critical feature but has no practical implications for anyone either.

motohagiography 5y ago

Reading just the article and going out on a limb, it sounds like they are exploiting the window of valid sequence numbers in a session to enable out of order delivery. I'd speculate the basic problem in the protocol is that session sequence numbers (counters) can be incremented by sending invalid messages, and there is a window of n plus or minus x, where x is how much the counter/sequence number on a valid message can be off-by and still be processed. Flooding the session to increment the counter above the valid window would yield undefined behavior in a few ways. When a peer gets desynched, either the client or server may kill the session and require a new negotiation handshake with the peer (a DoS vulnerability) - or it attempts to recalculate the window of counter values it will accept based on its last known good message, which sounds like it effectively causes the valid messages in that chain to "fold" back on themselves in their order. I'd suspect this was a design decision and understood by the protocol architects. If you aren't using an CMAC, a ratchet function (or a kdf based on hashing) which proves deterministically what the current sequence of messages is, instead of using a sliding window, you are going to have a similar or analogous sequence number "window" problems in your protocol. Some message sequence schemes use an obfuscated counter where instead of say, integers, you use some function over a field. (hence GCM, as I loosely apprehend it) But even the seed for that function just becomes another secret to manage (imo), so protocols that depend on counters earn extra scrutiny. The reason to use sequence numbers (counters) instead of ratcheting or hashing is because sometimes you're just substituting the managability of a sequence number counter window problem with another key management problem that has has a different set of known vulnerabilities, and you make the call based on your threat model. Perhaps the researchers' actual findings are more complex than this, and it isn't just a gotcha criticism of a design decision that had clear trade offs, which few are equipped to object to.