5 ms·

> Very much of what Telegram has done security wise is very well thought out and has improved over time This is not my understanding of the situation at all. T

> Very much of what Telegram has done security wise is very well thought out and has improved over time This is not my understanding of the situation at all. There's no end-to-end encryption by default [0], and the end-to-end encryption they do have received significant controversy at launch [1] for being essentially a "roll your own" crypto solution which indeed ended up being found to have some issues [2]. They disable the OS backup and instead they effectively store all their user's contacts, messages, media, etc. directly on their servers except for the conversations that the users directly opt out of by turning on e2e. They've promised since 2014 to open source everything but the backend, which stores all this data, is still closed source. For small group or individual messaging, whatsapp, signal, or matrix are far better choices. I think it's worth acknowledging that telegram has a much bigger focus on large groups and therefore has to make different security tradeoffs, so I think if we consider telegram a social media service it's pretty good -- but is not the best messenger. [0]: https://www.howtogeek.com/710344/psa-telegram-chats-arent-end-to-end-encrypted-by-default/ https://www.howtogeek.com/710344/psa-telegram-chats-arent-en... [1]: https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-your-own-crypto https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-you... [2]: https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf

upofadown 5y ago
Last I heard there is nothing wrong with the E2EE in Telegram at this point in time. OTTOMH, the stuff that people were complaining about wasn't anything that anyone would realistically care about, particularly for something not really that secureable like instant messaging on a smartphone.
- chrisfosterelli 5y ago
  The current version has no publicly known issues, but suspicion is the only valid response when an entity rolls their own cryptography for production when such well-studied and secure options already exist.
  - diebeforei485 5y ago
    > suspicion is the only valid response when an entity rolls their own cryptography for production Strong disagree. I would rather have multiple solutions in production, and Telegram's is also well-studied.
    - chrisfosterelli 5y ago
      Most established approaches were well studied before they were put in production, while Telegram has had the luxury of beta testing their protocol in real time on their 500 million users, and the work isn't yet done with issues discovered as recently as this year: > But ultimately they prove that the four key issues “could be done better, more securely and in a more trustworthy manner with a standard approach to cryptography,” said ETH Zurich Professor Kenny Paterson, who was part of the team that uncovered the flaw. https://www.cyberscoop.com/telegram-app-security-encryption/ https://www.cyberscoop.com/telegram-app-security-encryption/
      - diebeforei485 5y ago
        I'd suggest you actually read the paper[1] you're referring to, because it's actually a lot less critical of Telegram's approach than you make it out to be. We are better off that Telegram exists as an alternative. We don't need Signal's protocol (also used in Whatsapp etc) to be a potential SPOF. To quote: The central result of this work is a proof that the use of symmetric encryption in Telegram’s MTProto 2.0 can achieve the security of a robust bidirectional channel if small modifications are made. 1. https://mtpsym.github.io/paper.pdf https://mtpsym.github.io/paper.pdf
        chrisfosterelli 5y ago
        I have read this paper. Not sure where you feel I mischaracterized it. The section you just quoted goes on to discuss caveats, including a recommendation that they swap out their low level cryptographic implementation with one that uses a standard and well-vetted library, and then criticizes them for not having e2e on by default.
skinkestek 5y ago
You are very precise in your criticism, have my upvote! A couple of things: 1. the crypto has been improved significantly after the launch as far as I know. That release was back in the dark ages about half a year after WhatsApp got caught sending data unencrypted (and I'm using that word in its original meaning). 2. Can we agree to stop recommending WhatsApp soon?
- chrisfosterelli 5y ago
  Thanks! That's kind to say. I shared some notes on crypto issues more recently in another post above, but I would concede its generally more battle tested than the first version released at this point. The choice to start with home rolled crypto at all continues to concern me, but more importantly the fact that it's not default is now my biggest sticking point if I'm honest. I think WhatsApp comes with an asterisk in that I'd certainly recommend signal over it, but most non-technical people have never heard of signal so given the choice between WhatsApp and Telegram I'd personally opt for WhatsApp based on their e2e encryption by default, but I could understand if someone personally gave more weight to a distrust of Meta (even if encrypted) than they do to Telegram and made use of Telegram's secret chats.
janeroe 5y ago
> For small group or individual messaging, whatsapp ... [is] far better choice. The whatsapp that leaks your data to the FBI in real time [1], or do you mean some other whatsapp? [1]: https://news.ycombinator.com/item?id=29381917 https://news.ycombinator.com/item?id=29381917
- Barrin92 5y ago
  as the first response to that post says the only thing that the FBI got was metadata if icloud backups were enabled, it's impossible for whatsapp to leak your actual messages because they're on device encrypted. These comments on whatsapp, which appear with regularity by the way, are misleading and just inflammatory.
  - janeroe 5y ago
    > it's impossible for whatsapp to leak your actual messages because they're on device encrypted Have you seen the source code to claim there are no backdoors? Wait, you haven't because it's a proprietary piece of crap produced by the worst corp in existence - Facebook aka Meta. The same entity that's shamelessly involved into Putin's Russia level political censorship and yet we are to trust it according to the parent comment. Right...
- Egrodo 5y ago
  This is entirely false, stop spreading disinformation.
  - janeroe 5y ago
    Facebook shills are strong here, I see. Here you are: https://propertyofthepeople.org/document-detail/?doc-id=21114562 https://propertyofthepeople.org/document-detail/?doc-id=2111... Excerpt from the FBI report: > Pen Register: Sent every 15 minutes, provides source and destination of every message. [without a warrant of any kind] (And who knows what other three letter agencies can get.) BuT ThAt'S jUsT mEtAdAta, wE hAvE nOtHinG tO hIdE. Then keep using it, but don't spread your bullshit to others.
MomoXenosaga 5y ago
An advantage of Telegram is that they attract less attention from the authorities. Also Telegram seems to have a more, shall we say, lax attitude about criminal activity.
nicce 5y ago
> for being essentially a "roll your own" crypto solution This is technically incorrect. They use well known cryptografic algorithms for encryption and authentication. However, their protocol is unique combination of these cryptografic algorithms to provide specific purpose. It is different thing and different perspective than ”normal” use case for saying ”don’t roll your own crypto.”
- chrisfosterelli 5y ago
  "roll your own" has no official definition I'm aware of, so I'm not sure what you mean by "technically" incorrect. This could quickly become a discussion of semantics unfortunately. To be specific with what I mean, it is "roll your own" in the sense that 1) their protocol combines cryptographic primitives in unrecommended ways with no particular justification and in the sense that 2) they literally have invented and written many of these primitives themselves. As a concrete example, the IGE mode used by Telegram for AES is not "well known", in fact to the best of my knowledge Telegram is the only popular software in existence that uses this mode. IGE is avoided by all modern cryptographers because the authentication is broken, however Telegram uses this mode but not the authentication. There's no particular justification for this decision over just using an AES mode that everyone uses, but there's a lot of potential pitfalls if not done carefully. When you ask what type of authenticated encryption scheme Telegram uses, their answer is "none of them". Normally this would be a huge problem. However, they have solved this with their own custom "security checks". These are also not "well known" because Telegram invented them. When you ask what type of PKCS they use for padding, the answer is "we came up with our own padding algorithm". This was not "well known" because Telegram invented it. The padding issue they fixed in v2, since it turned out to introduce a vulnerability, but I assume you get what I mean by this point. Contrast this with Signal, which is also ultimately a unique protocol but is one that was implemented using robust, tested primitives in recommended combinations with boring standard choices for all of the details.

upofadown 5y ago

Last I heard there is nothing wrong with the E2EE in Telegram at this point in time. OTTOMH, the stuff that people were complaining about wasn't anything that anyone would realistically care about, particularly for something not really that secureable like instant messaging on a smartphone.

chrisfosterelli 5y ago
The current version has no publicly known issues, but suspicion is the only valid response when an entity rolls their own cryptography for production when such well-studied and secure options already exist.
- diebeforei485 5y ago
  > suspicion is the only valid response when an entity rolls their own cryptography for production Strong disagree. I would rather have multiple solutions in production, and Telegram's is also well-studied.
  - chrisfosterelli 5y ago
    Most established approaches were well studied before they were put in production, while Telegram has had the luxury of beta testing their protocol in real time on their 500 million users, and the work isn't yet done with issues discovered as recently as this year: > But ultimately they prove that the four key issues “could be done better, more securely and in a more trustworthy manner with a standard approach to cryptography,” said ETH Zurich Professor Kenny Paterson, who was part of the team that uncovered the flaw. https://www.cyberscoop.com/telegram-app-security-encryption/ https://www.cyberscoop.com/telegram-app-security-encryption/
    - diebeforei485 5y ago
      I'd suggest you actually read the paper[1] you're referring to, because it's actually a lot less critical of Telegram's approach than you make it out to be. We are better off that Telegram exists as an alternative. We don't need Signal's protocol (also used in Whatsapp etc) to be a potential SPOF. To quote: The central result of this work is a proof that the use of symmetric encryption in Telegram’s MTProto 2.0 can achieve the security of a robust bidirectional channel if small modifications are made. 1. https://mtpsym.github.io/paper.pdf https://mtpsym.github.io/paper.pdf
      - chrisfosterelli 5y ago
        I have read this paper. Not sure where you feel I mischaracterized it. The section you just quoted goes on to discuss caveats, including a recommendation that they swap out their low level cryptographic implementation with one that uses a standard and well-vetted library, and then criticizes them for not having e2e on by default.

skinkestek 5y ago

You are very precise in your criticism, have my upvote! A couple of things: 1. the crypto has been improved significantly after the launch as far as I know. That release was back in the dark ages about half a year after WhatsApp got caught sending data unencrypted (and I'm using that word in its original meaning). 2. Can we agree to stop recommending WhatsApp soon?

chrisfosterelli 5y ago
Thanks! That's kind to say. I shared some notes on crypto issues more recently in another post above, but I would concede its generally more battle tested than the first version released at this point. The choice to start with home rolled crypto at all continues to concern me, but more importantly the fact that it's not default is now my biggest sticking point if I'm honest. I think WhatsApp comes with an asterisk in that I'd certainly recommend signal over it, but most non-technical people have never heard of signal so given the choice between WhatsApp and Telegram I'd personally opt for WhatsApp based on their e2e encryption by default, but I could understand if someone personally gave more weight to a distrust of Meta (even if encrypted) than they do to Telegram and made use of Telegram's secret chats.

janeroe 5y ago

> For small group or individual messaging, whatsapp ... [is] far better choice. The whatsapp that leaks your data to the FBI in real time [1], or do you mean some other whatsapp? [1]: https://news.ycombinator.com/item?id=29381917 https://news.ycombinator.com/item?id=29381917

Barrin92 5y ago
as the first response to that post says the only thing that the FBI got was metadata if icloud backups were enabled, it's impossible for whatsapp to leak your actual messages because they're on device encrypted. These comments on whatsapp, which appear with regularity by the way, are misleading and just inflammatory.
- janeroe 5y ago
  > it's impossible for whatsapp to leak your actual messages because they're on device encrypted Have you seen the source code to claim there are no backdoors? Wait, you haven't because it's a proprietary piece of crap produced by the worst corp in existence - Facebook aka Meta. The same entity that's shamelessly involved into Putin's Russia level political censorship and yet we are to trust it according to the parent comment. Right...
Egrodo 5y ago
This is entirely false, stop spreading disinformation.
- janeroe 5y ago
  Facebook shills are strong here, I see. Here you are: https://propertyofthepeople.org/document-detail/?doc-id=21114562 https://propertyofthepeople.org/document-detail/?doc-id=2111... Excerpt from the FBI report: > Pen Register: Sent every 15 minutes, provides source and destination of every message. [without a warrant of any kind] (And who knows what other three letter agencies can get.) BuT ThAt'S jUsT mEtAdAta, wE hAvE nOtHinG tO hIdE. Then keep using it, but don't spread your bullshit to others.

MomoXenosaga 5y ago

An advantage of Telegram is that they attract less attention from the authorities. Also Telegram seems to have a more, shall we say, lax attitude about criminal activity.

nicce 5y ago

> for being essentially a "roll your own" crypto solution This is technically incorrect. They use well known cryptografic algorithms for encryption and authentication. However, their protocol is unique combination of these cryptografic algorithms to provide specific purpose. It is different thing and different perspective than ”normal” use case for saying ”don’t roll your own crypto.”

chrisfosterelli 5y ago
"roll your own" has no official definition I'm aware of, so I'm not sure what you mean by "technically" incorrect. This could quickly become a discussion of semantics unfortunately. To be specific with what I mean, it is "roll your own" in the sense that 1) their protocol combines cryptographic primitives in unrecommended ways with no particular justification and in the sense that 2) they literally have invented and written many of these primitives themselves. As a concrete example, the IGE mode used by Telegram for AES is not "well known", in fact to the best of my knowledge Telegram is the only popular software in existence that uses this mode. IGE is avoided by all modern cryptographers because the authentication is broken, however Telegram uses this mode but not the authentication. There's no particular justification for this decision over just using an AES mode that everyone uses, but there's a lot of potential pitfalls if not done carefully. When you ask what type of authenticated encryption scheme Telegram uses, their answer is "none of them". Normally this would be a huge problem. However, they have solved this with their own custom "security checks". These are also not "well known" because Telegram invented them. When you ask what type of PKCS they use for padding, the answer is "we came up with our own padding algorithm". This was not "well known" because Telegram invented it. The padding issue they fixed in v2, since it turned out to introduce a vulnerability, but I assume you get what I mean by this point. Contrast this with Signal, which is also ultimately a unique protocol but is one that was implemented using robust, tested primitives in recommended combinations with boring standard choices for all of the details.