5 ms·

Actually Pavel Durov made some very rough accusations against Signal and other "secure" apps for using the standard encryption method. For what he says, he does

Actually Pavel Durov made some very rough accusations against Signal and other "secure" apps for using the standard encryption method. For what he says, he doesn't trust others encryption protocols because he believes NSA made some pretty well hidden backdoors in them to easily decrypt them. Meanwhile I'm just here thinking, what's the matter if you're messager is super duper safe if your device OS running them is plagged with backdoors?

lucb1e 5y ago
Kleptographic backdoors in the Signal protocol is FUD. I work as a security consultant, which is definitely not a cryptographer, but I do get around and "NSA made some pretty well hidden backdoors in them to easily decrypt them" is definitely false. > what [if your] mess[en]ger is super duper safe if your device OS running them is plag[u]ed with backdoors This is more relevant. Bugdoors more than backdoors, or perhaps just stupid bugs and enough budget to find them, but yeah basically that's how messages are decrypted these days (e.g. NSO group).
ju-st 5y ago
Wouldn't it be a good idea to use two chained encryption methods? AES+whatever Telegram is using? This would be resistant against a AES backdoor and against bugs/backdoor in the Telegram encryption method. Similar to TrueCrypt where you can select AES+Serpent+Twofish to encrypt your files.
- lucb1e 5y ago
  That would work, but historically this hasn't proven necessary and double encryption means double the CPU power (or more, if one of them has CPU extensions and the other encryption method does not). Doing group calls in Wire is already very taxing on nowadays' energy-efficient laptops or not-high-end phones. For example, people have been using Russian GOST algorithms as a hedge against the USA stuff, but it's falling out of style because it just hasn't proven necessary in the decades since the AES and SHA families came into existence. Any bugs we found, for example in SHA-1, affected everyone equally and did not create a backdoor as with Dual-EC (in which flaws were identified before release and which went unaddressed, very much unlike other common algorithms).
TheMadMad 5y ago
TheMadMadYT 5y ago
Idk about its security, but proxies' security is much low that owner of the proxy (Domain of the proxy) can see your messages sending while using his proxy, and it backups your messages. For me, I usually use telegram, it's better and more comfortable than whatsapp. I dont judge about its general security, but the proxies security is shit as possible. btw I live in Iran and I have only two ways to connect to telegram, VPNs or Proxies. But with these conditions, I rather using telegram instead of shitty whatsapp

lucb1e 5y ago

Kleptographic backdoors in the Signal protocol is FUD. I work as a security consultant, which is definitely not a cryptographer, but I do get around and "NSA made some pretty well hidden backdoors in them to easily decrypt them" is definitely false. > what [if your] mess[en]ger is super duper safe if your device OS running them is plag[u]ed with backdoors This is more relevant. Bugdoors more than backdoors, or perhaps just stupid bugs and enough budget to find them, but yeah basically that's how messages are decrypted these days (e.g. NSO group).

ju-st 5y ago

Wouldn't it be a good idea to use two chained encryption methods? AES+whatever Telegram is using? This would be resistant against a AES backdoor and against bugs/backdoor in the Telegram encryption method. Similar to TrueCrypt where you can select AES+Serpent+Twofish to encrypt your files.

lucb1e 5y ago
That would work, but historically this hasn't proven necessary and double encryption means double the CPU power (or more, if one of them has CPU extensions and the other encryption method does not). Doing group calls in Wire is already very taxing on nowadays' energy-efficient laptops or not-high-end phones. For example, people have been using Russian GOST algorithms as a hedge against the USA stuff, but it's falling out of style because it just hasn't proven necessary in the decades since the AES and SHA families came into existence. Any bugs we found, for example in SHA-1, affected everyone equally and did not create a backdoor as with Dual-EC (in which flaws were identified before release and which went unaddressed, very much unlike other common algorithms).

TheMadMad 5y ago

TheMadMadYT 5y ago

Idk about its security, but proxies' security is much low that owner of the proxy (Domain of the proxy) can see your messages sending while using his proxy, and it backups your messages. For me, I usually use telegram, it's better and more comfortable than whatsapp. I dont judge about its general security, but the proxies security is shit as possible. btw I live in Iran and I have only two ways to connect to telegram, VPNs or Proxies. But with these conditions, I rather using telegram instead of shitty whatsapp