5 ms·

>I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean.' They have been doing this since the beginning. Their strategy of dow

by maqp 5y ago

>I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean.' They have been doing this since the beginning. Their strategy of downplaying every attack against their protocol serves to mask the fact their team has absolutely no qualifications to implement cryptography. Like the original article stated, Telegram did not even file for CVEs, simply because they look bad. CVEs have been filed for much smaller things than these. Their security game isn't on the side of secure-by-design, but grass-roots-damage-control to justify protocol designed by the owner's brother (who is a geometrician, not a cryptographer) and insecure-by-default. The nepotism and Russian pride should never go before the users' security. But they've never cared about it. Slightly related, you should see /r/telegram on Reddit, that outright censors articles that criticizes the app or discuss its vulnerabilities. From the looks of it, Telegram is more a cult these days than a collective of users. Its users are willing to spend hours arguing over semantics, and Telegram shamelessly makes use of them having no life, by recruiting them to something known as Telegram Support Force https://tsf.telegram.org/ https://tsf.telegram.org/

dogorman 5y ago
Russia has been mentioned 7 times in this discussion now, every time by you. I don't have any stake in this fight; I don't use or recommend any of these applications. But you do seem to have a bone to pick.
- tester756 5y ago
  In Russia it's "legal" to hack other countries or their citizens, so it's not weird take.
  - dogorman 5y ago
    The weird part is being the only guy bringing it up half a dozen times in one conversation.
  - hda2 5y ago
    It's also "legal" to do so in other countries. I think it's better to focus on Telegram's open specification and implementation instead of bashing it because the developers happen to be born somewhere you don't like.
- maqp 5y ago
  With Russia? No it's just useful to remember Durov's background, and since he's Russian, there aren't many countries he'd be secretly collaborating with. When the vendor is intentionally collecting and defending the collection of such vast amounts of data, you have to ask, who might benefit if Telegram was a front. I'm not specifically against Russia or US, I'm just someone who'd prefer people to have the right to their privacy. Mass surveillance isn't healthy for society, and Telegram is enabling it with their silo of user data. So ultimately, it doesn't matter if Durov is directly playing for any big party, the problem is there's not enough tech in place to prove he isn't and when that's the case, Telegram servers and the user data that sits there, is a free for all. A server in UK is not legally, (or technically) protected from the NSA, CCA, Fancy Bear, Unit 8200, Iranian Cyber Army etc. The only bone to pick here is any vendor who'd claim to be fighting for privacy when their privacy-by-design architecture is indistinguishable from honey pots and surveillance capitalistic companies.
  - Dah00n 5y ago
    >A server in UK is not legally, (or technically) protected <snip> a free for all So exactly like servers from Facebook, Signal, Google, German police, etc. anywhere on earth. Just ask NSA (or Snowden). This is the whole China debate over again: Who would you rather that have access to all your old data the day something you did years ago suddenly become a danger to you because some fascist person became a dictator? China, who likely cannot touch you if you are outside Mainland China or the US, who will happily kidnap you from almost any place on earth if they dislike you enough (often with local help)? I'd rather put my eggs in a Chinese (or Russian) basket than a US/UK one if I had to pick only between those options.
    - maqp 5y ago
      What are you talking about :D This isn't about who's basket you'd dump your eggs into. The point is, Telegram isn't deploying end-to-end encryption, therefore there is a basket in the first place. Had they used E2EE, it wouldn't matter where the server is located, because the server never ever built a massive trove of messages, regardless of where the server is physically located. I'm equally against everyone reading my private messages. I don't want to have to choose a country who has my messages, I choose my computer, and the computer of my peer, where ever they are.
Dah00n 5y ago
If they have "absolutely no qualifications to implement cryptography" then they are doing an insanely amazing job since such few vulnerabilities were found. All that other crap of russia, censorship, reddit threads, russia, cult, russia, is beside the point here. It makes no difference on the quality of the cryptography. If they suck at cryptography then post code that show why at least (and a fix).
- maqp 5y ago
  >then they are doing an insanely amazing job since such few vulnerabilities were found. If they are doing amazing job, then 1. Why isn't desktop chats end-to-end encrypted? 2. Why aren't group chats end-to-end encrypted? 3. Why isn't any chat end-to-end encrypted by default? If they're so good, why does SO MANY vendors like Signal, Element, Wire, WhatsApp, Session, Threema, Briar, Cwtch manage to pull ubiquitous end-to-end encryption off? They have the money, why can't they pay a cryptographer to design protocol with best practices, and modern primitives? >cult, russia, is beside the point here. It They're not beside the point. When the E2EE is practically non-existent, the project becomes practically indistinguishable from honeypots like the recent Anom, you have to ask whose honey pot operation would it be. As for the cult aspect, if you're not part of the cult fanbase, surely you can stop defending a random company, and take a rational stance and condemn Telegram for not deploying ubiquitous E2EE? It's not like them doing so would hurt you in any way? Surely they in their infinite wisdom can implement it? Also, I don't need to fix their crappy protocol to be able to criticize it. I don't need to show you the line of code for you to agree there is no E2EE for group chats etc. As for my job, I managed to implement ubiquitous end-to-end encryption for my project, TFC, even for groups, on an extremely constrained split TCB HW architecture. If a CS major can pull it off in such circumstances, why the f can't a multi-millionare with award winning mathematicians?
  - gsich 5y ago
    My guess for 1 and 3: because they haven't figuered out a way to sync this to all devices. For 2, maybe scaling issues? Some groups tend to be like public IRC channels.
maqp 5y ago
I was wrong about the CVE numbers not being there at all, the original article did state Telegram didn't prioritize them but here we go https://nvd.nist.gov/vuln/detail/CVE-2021-36769 https://nvd.nist.gov/vuln/detail/CVE-2021-36769

by maqp 5y ago

dogorman 5y ago

Russia has been mentioned 7 times in this discussion now, every time by you. I don't have any stake in this fight; I don't use or recommend any of these applications. But you do seem to have a bone to pick.

tester756 5y ago
In Russia it's "legal" to hack other countries or their citizens, so it's not weird take.
- dogorman 5y ago
  The weird part is being the only guy bringing it up half a dozen times in one conversation.
- hda2 5y ago
  It's also "legal" to do so in other countries. I think it's better to focus on Telegram's open specification and implementation instead of bashing it because the developers happen to be born somewhere you don't like.
maqp 5y ago
With Russia? No it's just useful to remember Durov's background, and since he's Russian, there aren't many countries he'd be secretly collaborating with. When the vendor is intentionally collecting and defending the collection of such vast amounts of data, you have to ask, who might benefit if Telegram was a front. I'm not specifically against Russia or US, I'm just someone who'd prefer people to have the right to their privacy. Mass surveillance isn't healthy for society, and Telegram is enabling it with their silo of user data. So ultimately, it doesn't matter if Durov is directly playing for any big party, the problem is there's not enough tech in place to prove he isn't and when that's the case, Telegram servers and the user data that sits there, is a free for all. A server in UK is not legally, (or technically) protected from the NSA, CCA, Fancy Bear, Unit 8200, Iranian Cyber Army etc. The only bone to pick here is any vendor who'd claim to be fighting for privacy when their privacy-by-design architecture is indistinguishable from honey pots and surveillance capitalistic companies.
- Dah00n 5y ago
  >A server in UK is not legally, (or technically) protected <snip> a free for all So exactly like servers from Facebook, Signal, Google, German police, etc. anywhere on earth. Just ask NSA (or Snowden). This is the whole China debate over again: Who would you rather that have access to all your old data the day something you did years ago suddenly become a danger to you because some fascist person became a dictator? China, who likely cannot touch you if you are outside Mainland China or the US, who will happily kidnap you from almost any place on earth if they dislike you enough (often with local help)? I'd rather put my eggs in a Chinese (or Russian) basket than a US/UK one if I had to pick only between those options.
  - maqp 5y ago
    What are you talking about :D This isn't about who's basket you'd dump your eggs into. The point is, Telegram isn't deploying end-to-end encryption, therefore there is a basket in the first place. Had they used E2EE, it wouldn't matter where the server is located, because the server never ever built a massive trove of messages, regardless of where the server is physically located. I'm equally against everyone reading my private messages. I don't want to have to choose a country who has my messages, I choose my computer, and the computer of my peer, where ever they are.

Dah00n 5y ago

If they have "absolutely no qualifications to implement cryptography" then they are doing an insanely amazing job since such few vulnerabilities were found. All that other crap of russia, censorship, reddit threads, russia, cult, russia, is beside the point here. It makes no difference on the quality of the cryptography. If they suck at cryptography then post code that show why at least (and a fix).

maqp 5y ago
>then they are doing an insanely amazing job since such few vulnerabilities were found. If they are doing amazing job, then 1. Why isn't desktop chats end-to-end encrypted? 2. Why aren't group chats end-to-end encrypted? 3. Why isn't any chat end-to-end encrypted by default? If they're so good, why does SO MANY vendors like Signal, Element, Wire, WhatsApp, Session, Threema, Briar, Cwtch manage to pull ubiquitous end-to-end encryption off? They have the money, why can't they pay a cryptographer to design protocol with best practices, and modern primitives? >cult, russia, is beside the point here. It They're not beside the point. When the E2EE is practically non-existent, the project becomes practically indistinguishable from honeypots like the recent Anom, you have to ask whose honey pot operation would it be. As for the cult aspect, if you're not part of the cult fanbase, surely you can stop defending a random company, and take a rational stance and condemn Telegram for not deploying ubiquitous E2EE? It's not like them doing so would hurt you in any way? Surely they in their infinite wisdom can implement it? Also, I don't need to fix their crappy protocol to be able to criticize it. I don't need to show you the line of code for you to agree there is no E2EE for group chats etc. As for my job, I managed to implement ubiquitous end-to-end encryption for my project, TFC, even for groups, on an extremely constrained split TCB HW architecture. If a CS major can pull it off in such circumstances, why the f can't a multi-millionare with award winning mathematicians?
- gsich 5y ago
  My guess for 1 and 3: because they haven't figuered out a way to sync this to all devices. For 2, maybe scaling issues? Some groups tend to be like public IRC channels.

maqp 5y ago

I was wrong about the CVE numbers not being there at all, the original article did state Telegram didn't prioritize them but here we go https://nvd.nist.gov/vuln/detail/CVE-2021-36769 https://nvd.nist.gov/vuln/detail/CVE-2021-36769