5 ms·

The first time I got on a telegram call using their Android client, the call had a string of 4 emojis and said something along the lines of "if you and the othe

The first time I got on a telegram call using their Android client, the call had a string of 4 emojis and said something along the lines of "if you and the other person see the same emojis, this call is secure". I thought that was pretty neat!

pndy 3y ago
Matrix clients use similar way to verify login sessions
- llamaInSouth 3y ago
  but they only show a green check-mark... not sure how it works
jonhohle 3y ago
If you see the same emojis as others, this comment is secure: <HN doesn’t support emoji>
- CharlesW 3y ago
  (╯°□°)╯︵ ┻━┻
  - lucb1e 3y ago
    In case anyone doesn't know: these code points are legit (Japanese) characters, whereas so-called emojis are a range of code points specifically for graphics. That's why I imagine HN software allows this to be posted even though emoji code points are removed
    - CharlesW 3y ago
      I've informally referred to this as "ASCIImoji", but TIL that its proper name is "Kaomoji": https://en.wikipedia.org/wiki/Kaomoji https://en.wikipedia.org/wiki/Kaomoji
      - NooneAtAll3 3y ago
        these were called emoticons for forever https://en.wikipedia.org/wiki/Emoticon https://en.wikipedia.org/wiki/Emoticon
        FoeNyx 3y ago
        Aren't kaomoji a subset of emoticons? most western old emoticons are turned 90° CCW, whereas kaomoji are mostly horizontal and often using CJK characters.
      - hunter2_ 3y ago
        I've understood a subset of those, but apparently I've totally misunderstood this bit: > The emphasis on the eyes in this style is reflected in the common usage of emoticons that use only the eyes, e.g. ^^ I always interpreted "^^" as equivalent to "this" or "ditto" -- arrows pointing at the immediately prior message. In hindsight, it could just as easily have been happy eyes!
        lucb1e 3y ago
        > I always interpreted "^^" as equivalent to "this" or "ditto" -- arrows pointing at the immediately prior message. That's... a good thing to be aware of as a heavy ^^ user myself! Thanks for sharing
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
csdvrx 3y ago
I don't get it. Can you explain me why it is, and what the emojis represent? Do you have the projection of some binary string in the unicode emoji space? (then you'd need to chunk it and possibly use many emojis)
- vecter 3y ago
  It's just a fingerprint for their chat. It's almost the same as a random four-letter code to verify that you're both seeing the ame thing.
  - stavros 3y ago
    This is for calls, not chat. It's probably ZRTP (hash commitment) with emojis instead of letters.
- progval 3y ago
  I don't know about Telegram, but it is indeed how Matrix does it. Here is the encoding they use: https://spec.matrix.org/v1.8/client-server-api/#sas-method-emoji https://spec.matrix.org/v1.8/client-server-api/#sas-method-e...
  - csdvrx 3y ago
    I read https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-calculation https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-cal... So is it the representation in emojis of a server controlled shared secret? That'd make 2 clients talking to eachother through the server vulnerable to tampering at the server level (ex:MITM) Shouldn't the 2 clients not involve the server for the secret? This would require each of them being able to access the other public key fingerprint without trusting what the server says. But if they see eachother fingerprint projected into the unicode emoji space, they would see different emojis. I think I may be missing something obvious. I just don't understand this trick.
    - bloopernova 3y ago
      As far as I know, if the 2 clients talk directly, their IP addresses are exposed to each other.
spencerchubb 3y ago
How would you know what emojis the other person is seeing?
- anamexis 3y ago
  By asking them
  - 0xDEAFBEAD 3y ago
    I think you'd need to do it out of band though, otherwise you're vulnerable to MITM? (That's the primary attack this is meant to protect against, I think?)
    - webappguy 3y ago
      OLVID App by the French Government asks users to swap a 4 digit PIN. App is great for OpSec check it out.
      - FoeNyx 3y ago
        > OLVID App by the French Government Recently the French Government required its members to use it, but it's made by a French startup, AFAIK.
    - theamk 3y ago
      if this is voice chat, in-band might be good enough. There is no technology (yet?) which can real-time recognize spoken emoji description like "weird cucumber with mouth.. wait I think its an alligator or maybe even a crocodile?" and then retroactively replace it with a different one while keeping the timing correct.
    - tjoff 3y ago
      The man in the middle would need to spoof the voice (with current microphone+environment etc.) in ~real time, probably both parties as well. And with the awareness to detect which words to replace in the middle of a normal conversation. With the demos we've seen feels absolutely doable, but for now requires quite some effort.
deleted 3y ago
[deleted]
fsckboy 3y ago
if you and the other person see the same emojis, this call is secure. sincerely, the man in the middle ps confirming this out of band will not add to your security
- deleted 3y ago
  [deleted]

pndy 3y ago

Matrix clients use similar way to verify login sessions

llamaInSouth 3y ago
but they only show a green check-mark... not sure how it works

jonhohle 3y ago

If you see the same emojis as others, this comment is secure: <HN doesn’t support emoji>

CharlesW 3y ago
(╯°□°)╯︵ ┻━┻
- lucb1e 3y ago
  In case anyone doesn't know: these code points are legit (Japanese) characters, whereas so-called emojis are a range of code points specifically for graphics. That's why I imagine HN software allows this to be posted even though emoji code points are removed
  - CharlesW 3y ago
    I've informally referred to this as "ASCIImoji", but TIL that its proper name is "Kaomoji": https://en.wikipedia.org/wiki/Kaomoji https://en.wikipedia.org/wiki/Kaomoji
    - NooneAtAll3 3y ago
      these were called emoticons for forever https://en.wikipedia.org/wiki/Emoticon https://en.wikipedia.org/wiki/Emoticon
      - FoeNyx 3y ago
        Aren't kaomoji a subset of emoticons? most western old emoticons are turned 90° CCW, whereas kaomoji are mostly horizontal and often using CJK characters.
    - hunter2_ 3y ago
      I've understood a subset of those, but apparently I've totally misunderstood this bit: > The emphasis on the eyes in this style is reflected in the common usage of emoticons that use only the eyes, e.g. ^^ I always interpreted "^^" as equivalent to "this" or "ditto" -- arrows pointing at the immediately prior message. In hindsight, it could just as easily have been happy eyes!
      - lucb1e 3y ago
        > I always interpreted "^^" as equivalent to "this" or "ditto" -- arrows pointing at the immediately prior message. That's... a good thing to be aware of as a heavy ^^ user myself! Thanks for sharing
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

csdvrx 3y ago

I don't get it. Can you explain me why it is, and what the emojis represent? Do you have the projection of some binary string in the unicode emoji space? (then you'd need to chunk it and possibly use many emojis)

vecter 3y ago
It's just a fingerprint for their chat. It's almost the same as a random four-letter code to verify that you're both seeing the ame thing.
- stavros 3y ago
  This is for calls, not chat. It's probably ZRTP (hash commitment) with emojis instead of letters.
progval 3y ago
I don't know about Telegram, but it is indeed how Matrix does it. Here is the encoding they use: https://spec.matrix.org/v1.8/client-server-api/#sas-method-emoji https://spec.matrix.org/v1.8/client-server-api/#sas-method-e...
- csdvrx 3y ago
  I read https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-calculation https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-cal... So is it the representation in emojis of a server controlled shared secret? That'd make 2 clients talking to eachother through the server vulnerable to tampering at the server level (ex:MITM) Shouldn't the 2 clients not involve the server for the secret? This would require each of them being able to access the other public key fingerprint without trusting what the server says. But if they see eachother fingerprint projected into the unicode emoji space, they would see different emojis. I think I may be missing something obvious. I just don't understand this trick.
  - bloopernova 3y ago
    As far as I know, if the 2 clients talk directly, their IP addresses are exposed to each other.

spencerchubb 3y ago

How would you know what emojis the other person is seeing?

anamexis 3y ago
By asking them
- 0xDEAFBEAD 3y ago
  I think you'd need to do it out of band though, otherwise you're vulnerable to MITM? (That's the primary attack this is meant to protect against, I think?)
  - webappguy 3y ago
    OLVID App by the French Government asks users to swap a 4 digit PIN. App is great for OpSec check it out.
    - FoeNyx 3y ago
      > OLVID App by the French Government Recently the French Government required its members to use it, but it's made by a French startup, AFAIK.
  - theamk 3y ago
    if this is voice chat, in-band might be good enough. There is no technology (yet?) which can real-time recognize spoken emoji description like "weird cucumber with mouth.. wait I think its an alligator or maybe even a crocodile?" and then retroactively replace it with a different one while keeping the timing correct.
  - tjoff 3y ago
    The man in the middle would need to spoof the voice (with current microphone+environment etc.) in ~real time, probably both parties as well. And with the awareness to detect which words to replace in the middle of a normal conversation. With the demos we've seen feels absolutely doable, but for now requires quite some effort.

deleted 3y ago

[deleted]

fsckboy 3y ago

if you and the other person see the same emojis, this call is secure. sincerely, the man in the middle ps confirming this out of band will not add to your security

deleted 3y ago
[deleted]