6 ms·

> jpost.com > • 5 hours ago > Pavel Durov, Telegram founder, arrested by France following warrant - The Jerusalem Post > The alleged offenses include: terro

> jpost.com > • 5 hours ago > Pavel Durov, Telegram founder, arrested by France following warrant - The Jerusalem Post > The alleged offenses include: terrorism, narcotic supply, fraud, money laundering and receiving stolen goods. For those unaware, all channel on telegram are NOT ENCRYPTED. They are stored in plaintext on telegram servers. All chats that are not 'secret chat' mode (single device to single device) are NOT ENCRYPTED (stored in plaintext on server). This is not about encryption, it is about the plaintext data and the organized crime happening in these channels. Signal group chats ARE ENCRYPTED by default. It is actually not possible to send an unencrypted message on signal. This will not pivot into an E2E issue, and will not affect signal which has set itself up to not store unencrypted content on it's servers. EDIT: Also possibly this may be a factor in the decision to arrest: > finance.yahoo.com > • 2 weeks ago > Telegram adds new ways for creators to earn money on its platform > Today's announcement comes as Telegram reached 950 million active users last month, and aims to cross the 1 billion mark this year. Earlier this year, Telegram founder Pavel Durov said the company expects to hit profitability next year and is considering going public.

ilrwbwrkhv 2y ago
This is misinformation that Telegram stores chat data in plaintext on their servers. It stores it encrypted with encryption keys split across the globe. Not perfect, but multiple legal jurisdictions would have to be subpoenad for Telegram to read your non-secret chats.
- mlyle 2y ago
  This is effectively plaintext, in that one entity has all of those secrets for everyone. That's one entity to subpoena. If that entity doesn't comply, governments will get upset and charge your executives with crimes if they get the chance. Different jurisdictions makes it harder to kick down the doors and get the keys, but it doesn't change the fundamental problem. "Nuh-uh, I put all those records in a box in Switzerland, you can't have them" does not work well for US citizens, unless the government fails to even notice the box.
  - NayamAmarshe 2y ago
    > This is effectively plaintext Everything's effectively plaintext then. Plaintext: refers to data that is transmitted or stored unencrypted. None of which Telegram does.
    - mlyle 2y ago
      Data that is transmitted or stored along with the keys is effectively plaintext, which Telegram does. The data is effectively plaintext on my device, at Telegram, and on the group members' devices, even if it is not plaintext in-between. Data I send to a website over TLS is effectively plaintext on my computer and on the other side; in transit, it is not. It all comes down to your threat model. Encryption does not protect information from entities who hold the keys to decrypt that information.
      - NayamAmarshe 2y ago
        > stored along with the keys It's not. They use a split-key encryption system so it's not exactly the same as storing the keys where the data is. > It all comes down to your threat model. Encryption does not protect information from entities who hold the keys to decrypt that information. I agree, which is why I'll say that the bottom line is: Are auditable E2EE algorithms stronger in security than cloud encryption? Yes. Is MTProto 2.0 Cloud Encryption plaintext? No.
        deleted 2y ago
        [deleted]
        mlyle 2y ago
        > It's not. They use a split-key encryption system so it's not exactly the same as storing the keys where the data is. Yes, again, it all comes down to your threat model. No one can kick down the door and get to the keys. But Telegram can get to all the keys, and thus can be legally expected to. The data is effectively plaintext to Telegram. > Is MTProto 2.0 Cloud Encryption plaintext? No. Just to note: "effectively plaintext" has been in use for a couple of decades as a term of art. We don't say it's plaintext, because it's not. It means there's effectively no security properties lent by the encryption. For example, my web browser encrypts a few passwords for me and stores them on disk, but doesn't need a cryptographic secret from me to decrypt them; they're effectively plaintext, because no one has to break any encryption to read them. Indeed, here's a thread on HN from 2013, where Durov is participating, where people are using "effectively plaintext" in exactly this way to describe exactly what we're talking about: https://news.ycombinator.com/item?id=6937097 https://news.ycombinator.com/item?id=6937097
- speedgoose 2y ago
  It could be worth a try to extract the keys of one server with a liquid nitrogen can and a cold boot attack. Or something more advanced that isn’t documented on Wikipedia.
  - Jerrrrrrry 2y ago
    That is so 2009. RAM can be XOR'd with little latency with hardware acceleration with a key in a slightly - separated secure enclave that will degrade if upset too rapidly, similar to a virtual da Vinci cryptex. radio/bluetooth/em/sensitive/proximity warning switches to unmount virtualized volumes all in a quasi-state-sanctioned-"contact center" in middle Ukraine. They are trying their best to prevent the inevitable; the ungovernable, untaxable, uncensorable, un-surveillable commerce and communication platform that will eventually arise from the amalgamation of human's pesky technology and its crossroads with the human condition. The hate for all things labeled "crypto" (convenient poising the well/doublespeak) was a (partially) government sigh op astro-fabri-exagerated to sway public opinion against anything "crypto" so that an ungovernable, decentralized, general trust-less computation protocol/escrow/rep using zkp+ and hormophic encryption was not able to be realized before the alfabit bois got a chance to mole into the development pipeline and backdoor the inevitable Merchanti Ultimatum; anything less would be a massive national security threat globally.
    - deleted 2y ago
      [deleted]
- lxgr 2y ago
  > It stores it encrypted with encryption keys split across the globe. The physical storage location is completely irrelevant. What matters is access, and they have that. Telegram has full operational control over these keys, as demonstrated by the fact that anyone that can perform SMS verification is able to access past messages on an account, and SMS-OTP can in principle not involve any cryptographic operation, as there is absolutely no user input.
- KaiserPro 2y ago
  > Not perfect, but multiple legal jurisdictions would have to be subpoenad for Telegram to read your non-secret chats. Thats not how legal works. for example if I am an EU based judge and I issue a warrant for getting data from a company in a case related to something important (your values may vary, but lets say its not about parking fines) then if your company wants to continue to operate in the EU, you need to pony up the data, or tell them why your can't comply, rather than won't Having your data stored with keys that you control isn't an excuse.
- HDThoreaun 2y ago
  > multiple legal jurisdictions would have to be subpoenad for Telegram to read your non-secret chats. Or they could just arrest the founder and make him give them the data + keys...
NayamAmarshe 2y ago
> They are stored in plaintext on telegram servers FYI, this is a totally misleading and false claim. Telegram uses the MTProto 2.0 Cloud algorithm for non-secret chats[1][2]. In fact, it uses a split-key encryption system and the servers are all stored in multiple jurisdictions. So even Telegram employees can't decrypt the chats, because you'd need to compromise all the servers at the same time. Telegram's algorithm has been independently audited multiple times. Compared to other apps like WhatsApp with claims of E2EE and no body of verification and validation.[3] [1]: https://core.telegram.org/mtproto#general-description https://core.telegram.org/mtproto#general-description [2]: https://core.telegram.org/mtproto/AJiEAwIYFoAsBGJBjZwYoQIwFMAm%2F2-0 https://core.telegram.org/mtproto/AJiEAwIYFoAsBGJBjZwYoQIwFM... [3]: https://arxiv.org/pdf/2012.03141 https://arxiv.org/pdf/2012.03141
- jeroenhd 2y ago
  > So even Telegram employees can't decrypt the chats I very much doubt that. If Durov wanted to, they could decrypt all of those messages. That fancy encryption system is worthless when someone can hijack the session of any of the users in a chosen group. This is a risk in many crypto messengers, but those usually come with optional key verification whereas Telegram doesn't have that outside of encrypted one-on-one chats.
  - NayamAmarshe 2y ago
    Because of the nature of the encryption, it allows more convenience compared to WhatsApp and Signal. For example, on Telegram you can (and we do) have a million people in a group without exposing their phone numbers. This has proven itself to be extremely useful to protestors. Signal failed massively, you couldn't add too many people and you always had the risk of exposing the phone numbers. Along with that, you can use Telegram on as many devices as you want. The chats instantly appear after login. WhatsApp and Signal both are lacking here. So there are always tradeoffs when it comes to encryption and convenience. Telegram's focus has been on the convenience side and providing assurance using a clean record of protecting user-data from governments, which is why Telegram was created in the first place. Can the encryption be improved? Of course yes! I'd love to! but I think much of the criticism by the WhatsApp loving crowd is not only disingenuous, but also harmful.
matheusmoreira 2y ago
Yeah. I have no idea how Telegram got this reputation for privacy. I'd like to point out WhatsApp chats are also end-to-end encrypted, just like in Signal. People aren't wrong to distrust Meta but I'd like to point out that WhatsApp encryption often makes judges here seethe to the point they order nation wide blocks of WhatsApp out of spite. The fact everyone I know uses something this secure makes me very happy. It's not perfect but since network effects makes alternatives unusable I'll take what I can get.
- negus 2y ago
  See my comment above about the unencrypted backup. It's basically a UX tradeoff: You can not promote default E2E + no autobackups -- people in mass are not ready to lose their data when losing the device. Nor they are ready to store the key separately in a confidential manner. Nor they are ready to manually transfer the key among different devices. All this UX situation is defined by Moxie (the author of Signal and Whatsapp encryption) in his blog post about PGP/WoT concept meeting the reality https://moxie.org/2015/02/24/gpg-and-me.html https://moxie.org/2015/02/24/gpg-and-me.html So in fact as the average user you have either: 1) E2E + unenctypted autobackup (Whatsapp) or 2) no e2e by default and separate e2e secret chats (Telegram) that are available only on a specific device. In the first scenario all your chats inclusing the most sensitive are available by the law enforcement by issuing a warrant to your file storage provider. In the second scenario you potentially can spill some sensitive information in default non-encrypted chats. What is worse? I don't know. But I use both Telegram and Whatsapp with backups turned off. So I'm losing all the Whatsapp chat history when using a new device while losing only secret chats In Telegram (not a problem for me since I delete them often manually or set a self-destruct timer anyway)
  - matheusmoreira 2y ago
    Backups are encrypted now. Looks like they improved it. I get it. I'm a privacy and free and open source software enthusiast. It's not perfect. It certainly is better than alternatives though. We know for a fact that it pisses off judges and authorities. That's a major sign that its working. You should be concerned when they stop complaining about it, it means they got in.
negus 2y ago
And non E2E chats by default is an intentional design desision. Pavel previously gave comments about these tradeoffs: In some sense it is better design than Whatsapp's e2e by default BUT 99%+ users have an automated backup to an un-e2encrypted storage such as Google Drive.
kkfx 2y ago
This Signal you trust? https://kitklarenberg.substack.com/p/signal-facing-collapse-after-cia https://kitklarenberg.substack.com/p/signal-facing-collapse-... Anyway, while it's possible to activate a Telegram account without a physical phone (using some temporary number services) or using an (relatively) anonymous SIM card 99% of users use it via Android or iOS and that's means there is no need to grab data from Telegram, USA gov. as well as Apple or Alphabet could simply milk them from their OSes, virtual keyboards and so on. It's really cloying how many do focus on the service instead of weighting the ecosystem...
- stefan_ 2y ago
  It's Kit Klarenberg of Grayzone. If he claims X, you should believe the opposite with much better than even odds. It could have been a hint to you when the news source of your choice attributes everything in the world to the CIA.
  - flan1058 2y ago
    [dead]

ilrwbwrkhv 2y ago

This is misinformation that Telegram stores chat data in plaintext on their servers. It stores it encrypted with encryption keys split across the globe. Not perfect, but multiple legal jurisdictions would have to be subpoenad for Telegram to read your non-secret chats.

mlyle 2y ago
This is effectively plaintext, in that one entity has all of those secrets for everyone. That's one entity to subpoena. If that entity doesn't comply, governments will get upset and charge your executives with crimes if they get the chance. Different jurisdictions makes it harder to kick down the doors and get the keys, but it doesn't change the fundamental problem. "Nuh-uh, I put all those records in a box in Switzerland, you can't have them" does not work well for US citizens, unless the government fails to even notice the box.
- NayamAmarshe 2y ago
  > This is effectively plaintext Everything's effectively plaintext then. Plaintext: refers to data that is transmitted or stored unencrypted. None of which Telegram does.
  - mlyle 2y ago
    Data that is transmitted or stored along with the keys is effectively plaintext, which Telegram does. The data is effectively plaintext on my device, at Telegram, and on the group members' devices, even if it is not plaintext in-between. Data I send to a website over TLS is effectively plaintext on my computer and on the other side; in transit, it is not. It all comes down to your threat model. Encryption does not protect information from entities who hold the keys to decrypt that information.
    - NayamAmarshe 2y ago
      > stored along with the keys It's not. They use a split-key encryption system so it's not exactly the same as storing the keys where the data is. > It all comes down to your threat model. Encryption does not protect information from entities who hold the keys to decrypt that information. I agree, which is why I'll say that the bottom line is: Are auditable E2EE algorithms stronger in security than cloud encryption? Yes. Is MTProto 2.0 Cloud Encryption plaintext? No.
      - deleted 2y ago
        [deleted]
      - mlyle 2y ago
        > It's not. They use a split-key encryption system so it's not exactly the same as storing the keys where the data is. Yes, again, it all comes down to your threat model. No one can kick down the door and get to the keys. But Telegram can get to all the keys, and thus can be legally expected to. The data is effectively plaintext to Telegram. > Is MTProto 2.0 Cloud Encryption plaintext? No. Just to note: "effectively plaintext" has been in use for a couple of decades as a term of art. We don't say it's plaintext, because it's not. It means there's effectively no security properties lent by the encryption. For example, my web browser encrypts a few passwords for me and stores them on disk, but doesn't need a cryptographic secret from me to decrypt them; they're effectively plaintext, because no one has to break any encryption to read them. Indeed, here's a thread on HN from 2013, where Durov is participating, where people are using "effectively plaintext" in exactly this way to describe exactly what we're talking about: https://news.ycombinator.com/item?id=6937097 https://news.ycombinator.com/item?id=6937097
speedgoose 2y ago
It could be worth a try to extract the keys of one server with a liquid nitrogen can and a cold boot attack. Or something more advanced that isn’t documented on Wikipedia.
- Jerrrrrrry 2y ago
  That is so 2009. RAM can be XOR'd with little latency with hardware acceleration with a key in a slightly - separated secure enclave that will degrade if upset too rapidly, similar to a virtual da Vinci cryptex. radio/bluetooth/em/sensitive/proximity warning switches to unmount virtualized volumes all in a quasi-state-sanctioned-"contact center" in middle Ukraine. They are trying their best to prevent the inevitable; the ungovernable, untaxable, uncensorable, un-surveillable commerce and communication platform that will eventually arise from the amalgamation of human's pesky technology and its crossroads with the human condition. The hate for all things labeled "crypto" (convenient poising the well/doublespeak) was a (partially) government sigh op astro-fabri-exagerated to sway public opinion against anything "crypto" so that an ungovernable, decentralized, general trust-less computation protocol/escrow/rep using zkp+ and hormophic encryption was not able to be realized before the alfabit bois got a chance to mole into the development pipeline and backdoor the inevitable Merchanti Ultimatum; anything less would be a massive national security threat globally.
  - deleted 2y ago
    [deleted]
lxgr 2y ago
> It stores it encrypted with encryption keys split across the globe. The physical storage location is completely irrelevant. What matters is access, and they have that. Telegram has full operational control over these keys, as demonstrated by the fact that anyone that can perform SMS verification is able to access past messages on an account, and SMS-OTP can in principle not involve any cryptographic operation, as there is absolutely no user input.
KaiserPro 2y ago
> Not perfect, but multiple legal jurisdictions would have to be subpoenad for Telegram to read your non-secret chats. Thats not how legal works. for example if I am an EU based judge and I issue a warrant for getting data from a company in a case related to something important (your values may vary, but lets say its not about parking fines) then if your company wants to continue to operate in the EU, you need to pony up the data, or tell them why your can't comply, rather than won't Having your data stored with keys that you control isn't an excuse.
HDThoreaun 2y ago
> multiple legal jurisdictions would have to be subpoenad for Telegram to read your non-secret chats. Or they could just arrest the founder and make him give them the data + keys...

NayamAmarshe 2y ago

> They are stored in plaintext on telegram servers FYI, this is a totally misleading and false claim. Telegram uses the MTProto 2.0 Cloud algorithm for non-secret chats[1][2]. In fact, it uses a split-key encryption system and the servers are all stored in multiple jurisdictions. So even Telegram employees can't decrypt the chats, because you'd need to compromise all the servers at the same time. Telegram's algorithm has been independently audited multiple times. Compared to other apps like WhatsApp with claims of E2EE and no body of verification and validation.[3] [1]: https://core.telegram.org/mtproto#general-description https://core.telegram.org/mtproto#general-description [2]: https://core.telegram.org/mtproto/AJiEAwIYFoAsBGJBjZwYoQIwFMAm%2F2-0 https://core.telegram.org/mtproto/AJiEAwIYFoAsBGJBjZwYoQIwFM... [3]: https://arxiv.org/pdf/2012.03141 https://arxiv.org/pdf/2012.03141

jeroenhd 2y ago
> So even Telegram employees can't decrypt the chats I very much doubt that. If Durov wanted to, they could decrypt all of those messages. That fancy encryption system is worthless when someone can hijack the session of any of the users in a chosen group. This is a risk in many crypto messengers, but those usually come with optional key verification whereas Telegram doesn't have that outside of encrypted one-on-one chats.
- NayamAmarshe 2y ago
  Because of the nature of the encryption, it allows more convenience compared to WhatsApp and Signal. For example, on Telegram you can (and we do) have a million people in a group without exposing their phone numbers. This has proven itself to be extremely useful to protestors. Signal failed massively, you couldn't add too many people and you always had the risk of exposing the phone numbers. Along with that, you can use Telegram on as many devices as you want. The chats instantly appear after login. WhatsApp and Signal both are lacking here. So there are always tradeoffs when it comes to encryption and convenience. Telegram's focus has been on the convenience side and providing assurance using a clean record of protecting user-data from governments, which is why Telegram was created in the first place. Can the encryption be improved? Of course yes! I'd love to! but I think much of the criticism by the WhatsApp loving crowd is not only disingenuous, but also harmful.

matheusmoreira 2y ago

Yeah. I have no idea how Telegram got this reputation for privacy. I'd like to point out WhatsApp chats are also end-to-end encrypted, just like in Signal. People aren't wrong to distrust Meta but I'd like to point out that WhatsApp encryption often makes judges here seethe to the point they order nation wide blocks of WhatsApp out of spite. The fact everyone I know uses something this secure makes me very happy. It's not perfect but since network effects makes alternatives unusable I'll take what I can get.

negus 2y ago
See my comment above about the unencrypted backup. It's basically a UX tradeoff: You can not promote default E2E + no autobackups -- people in mass are not ready to lose their data when losing the device. Nor they are ready to store the key separately in a confidential manner. Nor they are ready to manually transfer the key among different devices. All this UX situation is defined by Moxie (the author of Signal and Whatsapp encryption) in his blog post about PGP/WoT concept meeting the reality https://moxie.org/2015/02/24/gpg-and-me.html https://moxie.org/2015/02/24/gpg-and-me.html So in fact as the average user you have either: 1) E2E + unenctypted autobackup (Whatsapp) or 2) no e2e by default and separate e2e secret chats (Telegram) that are available only on a specific device. In the first scenario all your chats inclusing the most sensitive are available by the law enforcement by issuing a warrant to your file storage provider. In the second scenario you potentially can spill some sensitive information in default non-encrypted chats. What is worse? I don't know. But I use both Telegram and Whatsapp with backups turned off. So I'm losing all the Whatsapp chat history when using a new device while losing only secret chats In Telegram (not a problem for me since I delete them often manually or set a self-destruct timer anyway)
- matheusmoreira 2y ago
  Backups are encrypted now. Looks like they improved it. I get it. I'm a privacy and free and open source software enthusiast. It's not perfect. It certainly is better than alternatives though. We know for a fact that it pisses off judges and authorities. That's a major sign that its working. You should be concerned when they stop complaining about it, it means they got in.

negus 2y ago

And non E2E chats by default is an intentional design desision. Pavel previously gave comments about these tradeoffs: In some sense it is better design than Whatsapp's e2e by default BUT 99%+ users have an automated backup to an un-e2encrypted storage such as Google Drive.

kkfx 2y ago

This Signal you trust? https://kitklarenberg.substack.com/p/signal-facing-collapse-after-cia https://kitklarenberg.substack.com/p/signal-facing-collapse-... Anyway, while it's possible to activate a Telegram account without a physical phone (using some temporary number services) or using an (relatively) anonymous SIM card 99% of users use it via Android or iOS and that's means there is no need to grab data from Telegram, USA gov. as well as Apple or Alphabet could simply milk them from their OSes, virtual keyboards and so on. It's really cloying how many do focus on the service instead of weighting the ecosystem...

stefan_ 2y ago
It's Kit Klarenberg of Grayzone. If he claims X, you should believe the opposite with much better than even odds. It could have been a hint to you when the news source of your choice attributes everything in the world to the CIA.
- flan1058 2y ago
  [dead]