16 ms·

It says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted? Either way looks

It says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted? Either way looks like Signal wins by a lot. The size of it spot is so small, it seems almost squeezed in. But only because they have nothing to share.

to11mtm 5y ago
I don't know whether Telegram is E2EE by default (probably not.) When you do a call on telegram you are given a series of emoji and they are supposed to match what the person on the other side has, and that's supposed to indicate E2EE for that call.
- RL_Quine 5y ago
  Verification in band seems pretty meaningless, approaching security theatre.
  - nitrogen 5y ago
    For voice? It's hard to fake the voice of someone you know.
    - Muromec 5y ago
      you don't have to fake the voice, just mitm and record cleartext
      - ajsnigrutin 5y ago
        But they have to fake the voice, if I call the other person and say "my emoji sequence is this, this and that" for the other person to verify and vice-versa.
        wizzwizz4 5y ago
        Person A calls you. I intercept the call, so person A is calling me, and then I call you (spoofing so I look like Person A). When you pick up, I pick up, then I transmit what you're saying to Person A (and vice versa). How do you know I'm intercepting the transmission? Does the emoji sequence verify the call, perhaps?
        summm 5y ago
        Both connections would show different emojis on both sides then. So you would need to somehow deep fake the voice of the one telling their emojis to the other one.
        tshaddox 5y ago
        The emoji sequence is a hash of the secret key values generated as part of a modified/extended version of the Diffie-Hellman key exchange. The emoji sequence is generated and displayed independently on both devices before the final necessary key exchange message is transmitted over the wire, so a man-in-the-middle has no way of modifying messages in flight to ensure that both parties end up generating the same emoji sequence. I'm not a cryptographer, but that's what I glean from their explanation: https://core.telegram.org/api/end-to-end/video-calls#key-verification https://core.telegram.org/api/end-to-end/video-calls#key-ver...
        marcan_42 5y ago
        The emoji sequence represents the secret key exchange between you and the other party. If you intercept the call, you are making one key exchange with person A, and another key exchange with person B. Due to the mathematics involved, there is no way for you to force both key exchanges to yield the same result. For a "standard" DH key exchange it would be possible to brute force the emoji sequence to be the same (since it's too short to be resistant to brute forcing), but the protocol that Telegram uses specifically defends against that by having both sides commit to their share of the key ahead of time, so they cannot try different numbers. https://core.telegram.org/api/end-to-end/video-calls#key-verification https://core.telegram.org/api/end-to-end/video-calls#key-ver... So person A and person B are going to see different emojis no matter what you do. To fake a phone verification while performing a main-in-the-middle attack you'd also have to fake their voices to each other. That's hard.
  - Andrew_nenakhov 5y ago
    Real privacy is too burdensome for most users, so they feel just fine if the service owner promises in a stern voice that their chats are really secure. It is not necessary to provide real security, do fingerprint verification, etc if the users are already happy with the level of security they are promised.
    - marcan_42 5y ago
      The emoji comparison thing is mathematically solid. Assuming the clients aren't backdoored (and the Telegram client is open source, so that's not that easy), there is no way for an attacker to make both sides show the same emoji. If they want to convince two users that they have en E2EE connection while performing a man in the middle attack, they'd have to fake their voices to each other to change what emoji sequence they each read out. That's hard, and therefore this is real, meaningful privacy.
      - Andrew_nenakhov 5y ago
        Telegram can potentially perform mitm at any time and generate matching emoji images for both sides of conversation, since you can't really trust the app code to be the same they put on GitHub. If you've built it yourself, that'd reduce the risk, but nobody does that because blind trust is much more easy.
        to11mtm 5y ago
        This is true, and IMHO somewhere that App-Stores could potentially assist in building trust for OSS Apps being distributed. What I'm envisioning is a 'build hash' that is reproducible based on the public source code with a given set of compiler settings (i.e. same used for publish.) The systems app-management widget could then display this build hash in the app-check menu. This would likely require more care in packaging, as well as some form of secure config API that allows companies to provide certain bits of configuration (i.e. remote servers to contact) without impacting the build output. This would mean that yes, people would still need to audit the code, but at least it's easy for anyone to canary out to the internet that the hashes are mismatching, same for when someone does find something on an audit. OTOH, I'm sure Telegram's competitors in the chat space would love a reason to de-legitimize them, so it wouldn't surprise me if -someone- out there was already doing some sort of compare on published builds.
- tptacek 5y ago
  It is not, by default, and none of the group chats are.
vadfa 5y ago
That is correct. By default all messages sent over Telegram are stored permanently in their servers unencrypted.
- Borgz 5y ago
  Not exactly. Non-secret chats are stored encrypted on Telegram's servers, and separately from keys. The goal seems to be to require multiple jurisdictions to issue a court order before data can be decrypted. https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/faq#q-do-you-process-data-requests https://telegram.org/faq#q-do-you-process-data-requests
  - anon11302100 5y ago
    "Not exactly" means "completely incorrect" now? Telegram doesn't store your messages forever and they are encrypted and seizing the servers won't allow you to decrypt them unless you also seize the correct servers from another country
    - vadfa 5y ago
      Of course they store your messages forever... They've kept all of my messages for over 7 years now.
      - deleted 5y ago
        [deleted]
    - deleted 5y ago
      [deleted]
  - vadfa 5y ago
    If you really think that kind of shit will float...
- skrowl 5y ago
  Source for Telegram storing the information unencrypted at rest?
nimbius 5y ago
for signal users this means the messages of course do exist on your phone, which will be the first thing these agencies seek to abscond with once youre detained as its infinitely more crackable in their hands. as a casual reminder: The fifth amendment protects your speech, not your biometrics. do not use face or fingerprint to secure your phone. use a strong passphrase, and if in doubt, power down the phone (android) as this offers the greatest protection against offline bruteforce and sidechannel attacks used currently to exploit running processes in the phone.
- timbit42 5y ago
  Signal recently added 'disappearing messages' which lets you specify how long a chat you initiate remains before being deleted.
  - noasaservice 5y ago
    And a screenshot, or another camera, or a rooted phone can easily defeat that. The analog hole ALWAYS exists. Pretending it doesnt is ridiculous.
    - wizzwizz4 5y ago
      > And a screenshot, or another camera, or a rooted phone can easily defeat that. Not if the message has already been deleted. Auto-deleting messages are so the recipient doesn't have to delete them manually, not so the recipient can't possibly keep a copy.
      - summm 5y ago
        Exactly this. Even more: Auto-deleting messages are also that the sender doesn't have to delete them manually. Most people do not understand this. I even had a discussion with an open source chat app implementer who insisted on not implementing disappearing messages because they couldn't be really enforced.
    - deleted 5y ago
      [deleted]
makeworld 5y ago
> the FBI's ability to legally access secure content Maybe there are laws preventing legal access to message content? Maybe related to wherever Telegram is incorporated.
- officeplant 5y ago
  It helps Telegram is HQ'd in the UK and the operational center is in Dubai.
  - rootsudo 5y ago
    Does it? UK and Dubai are USA partners in Intelligence gathering and work together several times. Biggest example as of late: https://www.bbc.com/news/world-middle-east-58558690 https://www.bbc.com/news/world-middle-east-58558690
- inetknght 5y ago
  > Maybe there are laws preventing legal access to message content? Well sure. A lot of laws require a court order. In the U.S. that's usually not too difficult.
skrowl 5y ago
Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone. Lots of FUD out there there about Telegram not being encrypted that's just not true. There's nothing either side can to do send a message in clear text / unencrypted.
- 542458 5y ago
  For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? Does the former mean that telegram itself can read non-private-chat messages if it so chooses?
  - Gigachad 5y ago
    Pretty much. End to end uses the encryption keys of both _users_ to send. Over the wire has both sides use the platforms keys so the platform decrypts, stores in plain text, and sends it encrypted again to the other side. Over the wire is basically just HTTPS.
  - Daegalus 5y ago
    over the wire is when its encrypted during transmission between the User and Telegram's servers. HTTPS or SSL/TLS, etc. At Rest is when its encrypted in their DBs or hard drives, etc. Theoretically, Telegram can still read the contents if they wished to do so if they setup the appropriate code, or tools inbetween these steps. E2EE means that the users exchange encryption keys, and they encrypt the data at the client, so that only the other client can decrypt it. Meaning Telegram can never inspect the data if they wanted to.
    - Andrew_nenakhov 5y ago
      I very much doubt that Telegram really does encrypt messages "at rest": their server side full text search works extremely fast.
      - Daegalus 5y ago
racingmars 5y ago
This chart is showing what messaging providers are willing to give to law enforcement, not a reflection of the technical capabilities of the messaging provider. I assume what they're showing for Telegram (basically no data except IP/phone data if Telegram decides it's for a legit counter-terrorism activity) is a matter of Telegram business policy. Signal gives the limited information they do because I assume they are subject to warrants from U.S. courts. Telegram is run, to my understanding, from jurisdictions where enforcing a U.S. court order would be difficult-to-impossible, and they keep the private keys to decrypt their stored message content split between servers in relatively non-overlapping legal jurisdictions, so even a successful seizure of data in one wouldn't be enough to decrypt message content. That's all well and good -- and I appreciate Telegram for setting things up that way -- but that means at any time Telegram could make a policy decision to cooperate with law enforcement and provide much more than what is shown on this chart. Signal, on the other hand, could choose to cooperate as much as they want but not have the technical capability to provide more information. (Barring them updating their client to intentionally build in a backdoor, etc., but I'm basing this on what the current implementation is.) The other important thing about this chart: this is the unclassified version. Is there another classified document out there which says "we have a secret relationship with Telegram/whomever and they give us all the message content we want" but they don't advertise to the law enforcement community at large? They secretly use it to aid in parallel construction so they don't ever have to reveal that a messaging vendor is giving them message content in court? We have no idea. tl;dr: Telegram looks great on this chart because of policy, not technology. I love Telegram, but I'm under no illusions that it's appropriate for talking about things I wouldn't want law enforcement to have access to. Luckily, I haven't found myself needing to talk to my friends about illegal activity.
- godelski 5y ago
  TLDR: Telegram depends on trusting Telegram. Signal is trustless.
- MertsA 5y ago
  >Telegram looks great on this chart because of policy, not technology. This is what puzzles me about Apple, they absolutely have the capability to mitm iMessage pretty discreetly. Because Apple just completely hand waves away key distribution and they can silently add and remove keys at their leisure it's largely only policy that underpins their security. They're not Telegram, they aren't structured to be in a position to be able to ignore demands from the justice system to assist with some agent's latest fishing expidition. How are they getting away with not providing stuff that they obviously have access to? The PDF lists "Pen Register: no capability"
sgjohnson 5y ago
Telegram isn’t E2EE by default. My bet is on the fact that they are based in Russia, so they don’t give a shit about a US warrant or subpoena.
- keraf 5y ago
  Telegram isn't based in Russia (anymore). The company is incorporated in Dubai since 2017 [0]. They opposed Russian warrants in the past, resulting in the blocking of the app in the territory for some time [1]. [0] https://www.bloomberg.com/news/articles/2017-12-12/cryptic-russian-crusader-says-his-5-billion-app-can-t-be-bought https://www.bloomberg.com/news/articles/2017-12-12/cryptic-r... [1] https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia

to11mtm 5y ago

I don't know whether Telegram is E2EE by default (probably not.) When you do a call on telegram you are given a series of emoji and they are supposed to match what the person on the other side has, and that's supposed to indicate E2EE for that call.

RL_Quine 5y ago
Verification in band seems pretty meaningless, approaching security theatre.
- nitrogen 5y ago
  For voice? It's hard to fake the voice of someone you know.
  - Muromec 5y ago
    you don't have to fake the voice, just mitm and record cleartext
    - ajsnigrutin 5y ago
      But they have to fake the voice, if I call the other person and say "my emoji sequence is this, this and that" for the other person to verify and vice-versa.
      - wizzwizz4 5y ago
        Person A calls you. I intercept the call, so person A is calling me, and then I call you (spoofing so I look like Person A). When you pick up, I pick up, then I transmit what you're saying to Person A (and vice versa). How do you know I'm intercepting the transmission? Does the emoji sequence verify the call, perhaps?
        summm 5y ago
        Both connections would show different emojis on both sides then. So you would need to somehow deep fake the voice of the one telling their emojis to the other one.
        tshaddox 5y ago
        The emoji sequence is a hash of the secret key values generated as part of a modified/extended version of the Diffie-Hellman key exchange. The emoji sequence is generated and displayed independently on both devices before the final necessary key exchange message is transmitted over the wire, so a man-in-the-middle has no way of modifying messages in flight to ensure that both parties end up generating the same emoji sequence. I'm not a cryptographer, but that's what I glean from their explanation: https://core.telegram.org/api/end-to-end/video-calls#key-verification https://core.telegram.org/api/end-to-end/video-calls#key-ver...
        marcan_42 5y ago
        The emoji sequence represents the secret key exchange between you and the other party. If you intercept the call, you are making one key exchange with person A, and another key exchange with person B. Due to the mathematics involved, there is no way for you to force both key exchanges to yield the same result. For a "standard" DH key exchange it would be possible to brute force the emoji sequence to be the same (since it's too short to be resistant to brute forcing), but the protocol that Telegram uses specifically defends against that by having both sides commit to their share of the key ahead of time, so they cannot try different numbers. https://core.telegram.org/api/end-to-end/video-calls#key-verification https://core.telegram.org/api/end-to-end/video-calls#key-ver... So person A and person B are going to see different emojis no matter what you do. To fake a phone verification while performing a main-in-the-middle attack you'd also have to fake their voices to each other. That's hard.
- Andrew_nenakhov 5y ago
  Real privacy is too burdensome for most users, so they feel just fine if the service owner promises in a stern voice that their chats are really secure. It is not necessary to provide real security, do fingerprint verification, etc if the users are already happy with the level of security they are promised.
  - marcan_42 5y ago
    The emoji comparison thing is mathematically solid. Assuming the clients aren't backdoored (and the Telegram client is open source, so that's not that easy), there is no way for an attacker to make both sides show the same emoji. If they want to convince two users that they have en E2EE connection while performing a man in the middle attack, they'd have to fake their voices to each other to change what emoji sequence they each read out. That's hard, and therefore this is real, meaningful privacy.
    - Andrew_nenakhov 5y ago
      Telegram can potentially perform mitm at any time and generate matching emoji images for both sides of conversation, since you can't really trust the app code to be the same they put on GitHub. If you've built it yourself, that'd reduce the risk, but nobody does that because blind trust is much more easy.
      - to11mtm 5y ago
        This is true, and IMHO somewhere that App-Stores could potentially assist in building trust for OSS Apps being distributed. What I'm envisioning is a 'build hash' that is reproducible based on the public source code with a given set of compiler settings (i.e. same used for publish.) The systems app-management widget could then display this build hash in the app-check menu. This would likely require more care in packaging, as well as some form of secure config API that allows companies to provide certain bits of configuration (i.e. remote servers to contact) without impacting the build output. This would mean that yes, people would still need to audit the code, but at least it's easy for anyone to canary out to the internet that the hashes are mismatching, same for when someone does find something on an audit. OTOH, I'm sure Telegram's competitors in the chat space would love a reason to de-legitimize them, so it wouldn't surprise me if -someone- out there was already doing some sort of compare on published builds.
tptacek 5y ago
It is not, by default, and none of the group chats are.

vadfa 5y ago

That is correct. By default all messages sent over Telegram are stored permanently in their servers unencrypted.

Borgz 5y ago
Not exactly. Non-secret chats are stored encrypted on Telegram's servers, and separately from keys. The goal seems to be to require multiple jurisdictions to issue a court order before data can be decrypted. https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/faq#q-do-you-process-data-requests https://telegram.org/faq#q-do-you-process-data-requests
- anon11302100 5y ago
  "Not exactly" means "completely incorrect" now? Telegram doesn't store your messages forever and they are encrypted and seizing the servers won't allow you to decrypt them unless you also seize the correct servers from another country
  - vadfa 5y ago
    Of course they store your messages forever... They've kept all of my messages for over 7 years now.
    - deleted 5y ago
      [deleted]
  - deleted 5y ago
    [deleted]
- vadfa 5y ago
  If you really think that kind of shit will float...
skrowl 5y ago
Source for Telegram storing the information unencrypted at rest?

nimbius 5y ago

for signal users this means the messages of course do exist on your phone, which will be the first thing these agencies seek to abscond with once youre detained as its infinitely more crackable in their hands. as a casual reminder: The fifth amendment protects your speech, not your biometrics. do not use face or fingerprint to secure your phone. use a strong passphrase, and if in doubt, power down the phone (android) as this offers the greatest protection against offline bruteforce and sidechannel attacks used currently to exploit running processes in the phone.

timbit42 5y ago
Signal recently added 'disappearing messages' which lets you specify how long a chat you initiate remains before being deleted.
- noasaservice 5y ago
  And a screenshot, or another camera, or a rooted phone can easily defeat that. The analog hole ALWAYS exists. Pretending it doesnt is ridiculous.
  - wizzwizz4 5y ago
    > And a screenshot, or another camera, or a rooted phone can easily defeat that. Not if the message has already been deleted. Auto-deleting messages are so the recipient doesn't have to delete them manually, not so the recipient can't possibly keep a copy.
    - summm 5y ago
      Exactly this. Even more: Auto-deleting messages are also that the sender doesn't have to delete them manually. Most people do not understand this. I even had a discussion with an open source chat app implementer who insisted on not implementing disappearing messages because they couldn't be really enforced.
  - deleted 5y ago
    [deleted]

makeworld 5y ago

> the FBI's ability to legally access secure content Maybe there are laws preventing legal access to message content? Maybe related to wherever Telegram is incorporated.

officeplant 5y ago
It helps Telegram is HQ'd in the UK and the operational center is in Dubai.
- rootsudo 5y ago
  Does it? UK and Dubai are USA partners in Intelligence gathering and work together several times. Biggest example as of late: https://www.bbc.com/news/world-middle-east-58558690 https://www.bbc.com/news/world-middle-east-58558690
inetknght 5y ago
> Maybe there are laws preventing legal access to message content? Well sure. A lot of laws require a court order. In the U.S. that's usually not too difficult.

skrowl 5y ago

Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone. Lots of FUD out there there about Telegram not being encrypted that's just not true. There's nothing either side can to do send a message in clear text / unencrypted.

542458 5y ago
For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? Does the former mean that telegram itself can read non-private-chat messages if it so chooses?
- Gigachad 5y ago
  Pretty much. End to end uses the encryption keys of both _users_ to send. Over the wire has both sides use the platforms keys so the platform decrypts, stores in plain text, and sends it encrypted again to the other side. Over the wire is basically just HTTPS.
- Daegalus 5y ago
  over the wire is when its encrypted during transmission between the User and Telegram's servers. HTTPS or SSL/TLS, etc. At Rest is when its encrypted in their DBs or hard drives, etc. Theoretically, Telegram can still read the contents if they wished to do so if they setup the appropriate code, or tools inbetween these steps. E2EE means that the users exchange encryption keys, and they encrypt the data at the client, so that only the other client can decrypt it. Meaning Telegram can never inspect the data if they wanted to.
  - Andrew_nenakhov 5y ago
    I very much doubt that Telegram really does encrypt messages "at rest": their server side full text search works extremely fast.
    - Daegalus 5y ago

racingmars 5y ago

This chart is showing what messaging providers are willing to give to law enforcement, not a reflection of the technical capabilities of the messaging provider. I assume what they're showing for Telegram (basically no data except IP/phone data if Telegram decides it's for a legit counter-terrorism activity) is a matter of Telegram business policy. Signal gives the limited information they do because I assume they are subject to warrants from U.S. courts. Telegram is run, to my understanding, from jurisdictions where enforcing a U.S. court order would be difficult-to-impossible, and they keep the private keys to decrypt their stored message content split between servers in relatively non-overlapping legal jurisdictions, so even a successful seizure of data in one wouldn't be enough to decrypt message content. That's all well and good -- and I appreciate Telegram for setting things up that way -- but that means at any time Telegram could make a policy decision to cooperate with law enforcement and provide much more than what is shown on this chart. Signal, on the other hand, could choose to cooperate as much as they want but not have the technical capability to provide more information. (Barring them updating their client to intentionally build in a backdoor, etc., but I'm basing this on what the current implementation is.) The other important thing about this chart: this is the unclassified version. Is there another classified document out there which says "we have a secret relationship with Telegram/whomever and they give us all the message content we want" but they don't advertise to the law enforcement community at large? They secretly use it to aid in parallel construction so they don't ever have to reveal that a messaging vendor is giving them message content in court? We have no idea. tl;dr: Telegram looks great on this chart because of policy, not technology. I love Telegram, but I'm under no illusions that it's appropriate for talking about things I wouldn't want law enforcement to have access to. Luckily, I haven't found myself needing to talk to my friends about illegal activity.

godelski 5y ago
TLDR: Telegram depends on trusting Telegram. Signal is trustless.
MertsA 5y ago
>Telegram looks great on this chart because of policy, not technology. This is what puzzles me about Apple, they absolutely have the capability to mitm iMessage pretty discreetly. Because Apple just completely hand waves away key distribution and they can silently add and remove keys at their leisure it's largely only policy that underpins their security. They're not Telegram, they aren't structured to be in a position to be able to ignore demands from the justice system to assist with some agent's latest fishing expidition. How are they getting away with not providing stuff that they obviously have access to? The PDF lists "Pen Register: no capability"

sgjohnson 5y ago

Telegram isn’t E2EE by default. My bet is on the fact that they are based in Russia, so they don’t give a shit about a US warrant or subpoena.

keraf 5y ago
Telegram isn't based in Russia (anymore). The company is incorporated in Dubai since 2017 [0]. They opposed Russian warrants in the past, resulting in the blocking of the app in the territory for some time [1]. [0] https://www.bloomberg.com/news/articles/2017-12-12/cryptic-russian-crusader-says-his-5-billion-app-can-t-be-bought https://www.bloomberg.com/news/articles/2017-12-12/cryptic-r... [1] https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia