8 ms·

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-secure-is-your-cloud-take-the-mud-puddle-test/ https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

lxgr 2y ago
Note that the mud puddle test was originally described on Matt's very blog: https://blog.cryptographyengineering.com/2012/04/05/icloud-who-holds-key/ https://blog.cryptographyengineering.com/2012/04/05/icloud-w... :)
- ASalazarMX 2y ago
  And it only works because a corporation likely would want to offer this to its users as a convenient feature. If they were actively trying to hide this, they can rig the test and keep access to themselves.
  - freehorse 2y ago
    It is true that passing the mud puddle test does not guarantee robust end-to-end encryption (there can still be backdoors reserved for company/law enforcement). But failing it definitely guarantees that there is no robust end-to-end encryption.
tigeroil 2y ago
Indeed and this is the other thing - even if Telegram don't themselves co-operate with law enforcement, it'd be fairly easy for law enforcement to request access to the phone number from the carrier, then use it to sign into the Telegram account in question and access all of the messages.
- nucleardog 2y ago
  You can set a password that’s required to authenticate a new device. Once that’s set, after the SMS code, then (assuming you don’t have access to an existing logged in device because then you are already in…), you can either reset the password via an email confirmation _or_ you can create a new account under that phone number (with no existing history, contacts, etc). If you set a password and no recovery email, there is no way for them to get access to your contacts or chat history barring getting them from Telegram themselves.
rvnx 2y ago
Also the same with Skype "encryption". The data is "encrypted", but you receive the private key from the server upon sign-on... So, just need to change that password temporarily.
baxtr 2y ago
Would love to see a side-by-side comparison of iMessage, Signal, WhatsApp and Telegram on this.
- tptacek 2y ago
  You already know how Signal is going to come out here, because this is something people complain incessantly about (the inconvenience of not getting transcripts when enrolling new devices).
  - Reisen 2y ago
    I agree with the principle here wholeheartedly. One addendum though is I think this isn't quite the same as the mud puddle test. The idea behind the mud puddle test is if you've forgotten everything, but then manage to recover your data, then the principle must be that someone other than you has to have had access. With Signal, they intentionally refuse to sync data as an extra security step even if you have the keys, the software just refuses to do the syncing step. I'm glad they do personally and I'm not contradicting your point, just adding some notes. Just thought it worth noting. Edit: Actually, yeah that proves your point.
    - joshjob42 2y ago
      This isn't fully accurate. You can backup your Signal messages on Android with an encrypted file and a key you control. So yes, just installing on a new device isn't going to give you history. I'd prefer they offer a universal structure for that backup file so we could easily switch between Android and iOS and have some way to backup your data at all on iOS (presently if anything goes wrong when setting up a new phone you lose your entire message history).
  - maqp 2y ago
    It's a bit unfortunate there isn't a mechanism to establish a key between your desktop and smart phone client that would allow message history to be synced over an E2EE connection. It's doable, but perhaps it's an intentional safety feature one can't export the messages too easily.
alerighi 2y ago
Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud. This of course has security implications, but also allows you to have a big number of chats without wasting your device memory like WhatsApp does, or having to delete old conversations, and allows you to access your chats from any device. By the way you can also set a password to log in from another device (two factor authentication, also on WhatsApp now you have this option). To me it's a good tradeoff, of course I wouldn't use Telegram for anything illegal or suspect.
- pandog 2y ago
  I think a high definition photo taken on a recent phone takes up an awful lot more device memory than a "big number of chats"
  - SonOfLilit 2y ago
    Yeah, but Whatsapp chats tend to be full of those... and videos.
    - akx 2y ago
      (On Android), if you don't care about the (old) WhatsApp media, just delete it from your phone. It's all just loose files in `/storage/android/data/com.whatsapp` (or thereabouts). The text content of the chats will remain available.
    - lukan 2y ago
      Whatsapp automatically resizes them (in standard settings) But it still gets big.
- hn_throwaway_99 2y ago
  But that's literally the entire point of this article. That is, in this day and age, when people talk about "secure messaging apps" they are usually implying end-to-end encryption, which Telegram most certainly is not for the vast majority of usages.
beefnugs 2y ago
Yeah, and the only way to get government to learn about why e2ee is important is to show them that if law enforcement can get it, then so can hackers/phishers. We need as many politicians dark secrets hacked and ousted as possible. It should be a whistblower protected right codified into law to perform such hacks
wkat4242 2y ago
> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.
- alephnerd 2y ago
  > Does Telegram let them see it: I don't think so. That seems to be the core issue style Durov being arrested The UAE requires decryption keys as part of their Telco regulations. If Telegram can operate in the UAE without VPN (and it can), then at the very least the UAE MoI has access. They (and their shadow firms like G42 and G42's shadow firms) were always a major buyer for offensive capabilities at GITEX. On that note, NEVER bring your personal phone to DEFCON/Blackhat or GITEX. Edit: cannot reply below so answering here Cybersecurity conferences. DEFCON/Blackhat happen during the same week, so you have a lot of script kiddies who lack common sense trying to pwn random workloads. They almost always get caught (and charged - happens every year), but it's a headache. GITEX is MENA and Asia's largest cybersecurity conference. You have intelligence agencies from most of the Middle East, Africa, Europe, and Asia attending, plus a lot of corporate espionage because of polticially connected MSSPs as well as massive defense tenders.
  - mubu 2y ago
    Sorry, but as someone who's completely out of the loop with these things. What's DEFCON/Blackhat or GITEX about and why shouldn't you bring your personal phone? I'm genuinely interested.
    - jijji 2y ago
      defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked
thisisabore 2y ago
That's it. The article could be just that. You log back in and all your messages are there without you having to provide a secret or allow access to some specific backup? Your data just lives on the server. The only thing preventing anyone from accessing it is the goodwill of the people running the server.
- wruza 2y ago
  Not true. Secret chats only live on a device where you started it. Regular people may not use them (their problem), but these are common for business-critical chats in my circles.
mjevans 2y ago
Offhand, this sounds like a terribly insecure workflow but... Client creates a Public Private key pair used for E2EE. Client uses the 'account password (raw)' as part of the creation of a symmetric encryption key, and uses that to encrypt and store the SECRET key on the service's cloud. NewClient signs in, downloads the encrypted SECRETKeyBlob and decodes using the reconstructed symmetric key based on the sign in password. Old messages can then be decoded. -- The part that's insecure. -- If the password ever changes the SAME SECRET then needs to be stored to the cloud again, encrypted by the new key. Some padding with random data might help with this but this still sounds like a huge security loophole. -- Worse Insecurity -- A customer's device could be shipped a compromised client which uploads the SECRET keys to requesting third parties upon sign-in. Those third parties could be large corporations or governments. I do not see how anyone expects to use a mobile device for any serious security domain. At best average consumers can have a reasonable hope that it's safe from crooks who care about the average citizen.
- kevincox 2y ago
  > When you regain consciousness you'll be perfectly fine, but won't for the life of you be able to recall your device passwords or keys You can't use your password as input to the mud puddle test.
  - mjevans 2y ago
    How would an end user even know they're running that test for a closed box system? The idea is what's possible in the real world.
vasco 2y ago
Why not the "founder locked up" test? If the founder claims secure encryption, yet they are not in jail, that means there's no secure encryption because they negotiated their freedom in exchange for secret backdoors.
- rafram 2y ago
  That isn’t applicable here. Telegram isn’t encrypted and yet they refused to comply with subpoenas. Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. Maybe in the future, creators of encrypted messaging apps will get locked up. I certainly hope not. But this case doesn’t indicate anything one way or another.
  - mandmandam 2y ago
    > Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. I dunno man, kinda seems like you ought to either have a right to privacy or not. Surely there's other ways to make a case, without extraordinarily abusable legal strong-arming. Why should a wealthy person be able to legally afford encrypted communication on a secure device, when 90+% of people can't because they're poor and tech illiterate? Does our historically unequal society need more information and rights asymmetry between rich and poor? Between privileged and marginalized?
    - rafram 2y ago
      Downloading Signal is just as easy as downloading Telegram.
      - mandmandam 2y ago
        As I said, tech illiterate - or as likely, legally illiterate. It's unreasonable to expect most people to intuit the distinction you describe. However, you don't see wealthy people communicating on insecure devices, because they have people to take care of that stuff.
scotty79 2y ago
If you apply this test to things like LastPass or Bitwarden they fail too. And yet the don't keep my unencrypted passwords on their servers.
- bryanlarsen 2y ago
  If you lose your Bitwarden master password you've lost your data. It passes the mud puddle test.
  - scotty79 2y ago
    ah, you are right ... I missed the password recovery flow part which is a key thing here
foresto 2y ago
Unless you can prove (e.g. using your old device or a recovered signing key) that the new device is yours. In that case, if the service supports it, the new device could automatically ask your contacts to re-send the old messages using the new device's public key.
pokot0 2y ago
Unfortunately if the answer is no, it does not mean law enforcement can’t
robmccoll 2y ago
How to do that on initial account creation: - locally create a recovery key and use it to wrap any other essential keys - Split that or wrap that with two or more keys. - N - 1 goes to the cloud to be used as MFA tokens on recovery. - For the other, derive keys from normalized responses to recovery questions, use Shamir's secret sharing to pick a number of required correct responses and encrypt the Nth key. You can recover an account without knowing your original password or having your original device.
- bryanlarsen 2y ago
  IOW, you've made the recovery questions into alternate passwords, passwords that law enforcement is likely able to find or brute force.
nox101 2y ago
I'm probably dumb, but why would that be proof? I upload encrypted backups to a cloud service provider (AWS, Google Cloud). I go to another computer, download them, use a key/password to decrypt them. Sure, I get it, you're typing in something that decrypts the data into their app. That's true of all apps including WhatsApp, etc... The only way this could really be secure is if you used a different app to the encryption that you wrote/audited such that the messaging app never has access to your password/private key. Otherwise, at some point, you're trusting their app to do what they claim.
- palotasb 2y ago
  > > using the password recovery flow > use a key/password The previous poster intentionally mentioned password recovery flow. If you can gain access without your password, than law enforcement can too. If you could only gain access with your password, you could consider your data safe.
  - kevincox 2y ago
    > If you could only gain access with your password, you could consider your data safe. You can't assume the negation. If you can get access without your password then you have proven that law enforcement or the hosting company can to. If you can't get access then you haven't proven anything. They may be securely storing your data end-to-end encrypted. Or they may just have a very strict account recovery process but the data is still on their servers in the clear.
refurb 2y ago
I know this is getting off-topic, but all the discussion about encryption missing an important weakness in any crypto algorithm - the human factor. I found it interesting that countries like Singapore haven’t introduced requirements for backdoors. They are notorious for passing laws for whatever they want as the current government has a super majority and court that tends to side with the government. Add on top Telegram is used widely in illegal drug transactions in Singapore. What’s the reason? They just attack the human factor. They just get invites to Telegram groups, or they bust someone and force them to handover access to their Telegram account. Set up surveillance for the delivery and boom crypto drug ring is taken down. They’ve done it again and again. One could imagine this same technique could be used for any Telegram group or conversation.
oloila 2y ago
Telegram has secure calls and secure e2e private chats. All other chats are cloud-backupped. So if you have an intent of using private communication - the answer is "no", if you don't care - the answer is "yes"
niutech 2y ago
Telegram has an answer to this: https://telegram.org/faq#q-do-you-process-data-requests https://telegram.org/faq#q-do-you-process-data-requests - only Secret Chats are e2e encrypted. As an alternative, Signal or Jami conversations are always e2e encrypted.

lxgr 2y ago

Note that the mud puddle test was originally described on Matt's very blog: https://blog.cryptographyengineering.com/2012/04/05/icloud-who-holds-key/ https://blog.cryptographyengineering.com/2012/04/05/icloud-w... :)

ASalazarMX 2y ago
And it only works because a corporation likely would want to offer this to its users as a convenient feature. If they were actively trying to hide this, they can rig the test and keep access to themselves.
- freehorse 2y ago
  It is true that passing the mud puddle test does not guarantee robust end-to-end encryption (there can still be backdoors reserved for company/law enforcement). But failing it definitely guarantees that there is no robust end-to-end encryption.

tigeroil 2y ago

Indeed and this is the other thing - even if Telegram don't themselves co-operate with law enforcement, it'd be fairly easy for law enforcement to request access to the phone number from the carrier, then use it to sign into the Telegram account in question and access all of the messages.

nucleardog 2y ago
You can set a password that’s required to authenticate a new device. Once that’s set, after the SMS code, then (assuming you don’t have access to an existing logged in device because then you are already in…), you can either reset the password via an email confirmation _or_ you can create a new account under that phone number (with no existing history, contacts, etc). If you set a password and no recovery email, there is no way for them to get access to your contacts or chat history barring getting them from Telegram themselves.

rvnx 2y ago

Also the same with Skype "encryption". The data is "encrypted", but you receive the private key from the server upon sign-on... So, just need to change that password temporarily.

baxtr 2y ago

Would love to see a side-by-side comparison of iMessage, Signal, WhatsApp and Telegram on this.

tptacek 2y ago
You already know how Signal is going to come out here, because this is something people complain incessantly about (the inconvenience of not getting transcripts when enrolling new devices).
- Reisen 2y ago
  I agree with the principle here wholeheartedly. One addendum though is I think this isn't quite the same as the mud puddle test. The idea behind the mud puddle test is if you've forgotten everything, but then manage to recover your data, then the principle must be that someone other than you has to have had access. With Signal, they intentionally refuse to sync data as an extra security step even if you have the keys, the software just refuses to do the syncing step. I'm glad they do personally and I'm not contradicting your point, just adding some notes. Just thought it worth noting. Edit: Actually, yeah that proves your point.
  - joshjob42 2y ago
    This isn't fully accurate. You can backup your Signal messages on Android with an encrypted file and a key you control. So yes, just installing on a new device isn't going to give you history. I'd prefer they offer a universal structure for that backup file so we could easily switch between Android and iOS and have some way to backup your data at all on iOS (presently if anything goes wrong when setting up a new phone you lose your entire message history).
- maqp 2y ago
  It's a bit unfortunate there isn't a mechanism to establish a key between your desktop and smart phone client that would allow message history to be synced over an E2EE connection. It's doable, but perhaps it's an intentional safety feature one can't export the messages too easily.

alerighi 2y ago

Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud. This of course has security implications, but also allows you to have a big number of chats without wasting your device memory like WhatsApp does, or having to delete old conversations, and allows you to access your chats from any device. By the way you can also set a password to log in from another device (two factor authentication, also on WhatsApp now you have this option). To me it's a good tradeoff, of course I wouldn't use Telegram for anything illegal or suspect.

pandog 2y ago
I think a high definition photo taken on a recent phone takes up an awful lot more device memory than a "big number of chats"
- SonOfLilit 2y ago
  Yeah, but Whatsapp chats tend to be full of those... and videos.
  - akx 2y ago
    (On Android), if you don't care about the (old) WhatsApp media, just delete it from your phone. It's all just loose files in `/storage/android/data/com.whatsapp` (or thereabouts). The text content of the chats will remain available.
  - lukan 2y ago
    Whatsapp automatically resizes them (in standard settings) But it still gets big.
hn_throwaway_99 2y ago
But that's literally the entire point of this article. That is, in this day and age, when people talk about "secure messaging apps" they are usually implying end-to-end encryption, which Telegram most certainly is not for the vast majority of usages.

beefnugs 2y ago

Yeah, and the only way to get government to learn about why e2ee is important is to show them that if law enforcement can get it, then so can hackers/phishers. We need as many politicians dark secrets hacked and ousted as possible. It should be a whistblower protected right codified into law to perform such hacks

wkat4242 2y ago

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

alephnerd 2y ago
> Does Telegram let them see it: I don't think so. That seems to be the core issue style Durov being arrested The UAE requires decryption keys as part of their Telco regulations. If Telegram can operate in the UAE without VPN (and it can), then at the very least the UAE MoI has access. They (and their shadow firms like G42 and G42's shadow firms) were always a major buyer for offensive capabilities at GITEX. On that note, NEVER bring your personal phone to DEFCON/Blackhat or GITEX. Edit: cannot reply below so answering here Cybersecurity conferences. DEFCON/Blackhat happen during the same week, so you have a lot of script kiddies who lack common sense trying to pwn random workloads. They almost always get caught (and charged - happens every year), but it's a headache. GITEX is MENA and Asia's largest cybersecurity conference. You have intelligence agencies from most of the Middle East, Africa, Europe, and Asia attending, plus a lot of corporate espionage because of polticially connected MSSPs as well as massive defense tenders.
- mubu 2y ago
  Sorry, but as someone who's completely out of the loop with these things. What's DEFCON/Blackhat or GITEX about and why shouldn't you bring your personal phone? I'm genuinely interested.
  - jijji 2y ago
    defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked

thisisabore 2y ago

That's it. The article could be just that. You log back in and all your messages are there without you having to provide a secret or allow access to some specific backup? Your data just lives on the server. The only thing preventing anyone from accessing it is the goodwill of the people running the server.

wruza 2y ago
Not true. Secret chats only live on a device where you started it. Regular people may not use them (their problem), but these are common for business-critical chats in my circles.

mjevans 2y ago

Offhand, this sounds like a terribly insecure workflow but... Client creates a Public Private key pair used for E2EE. Client uses the 'account password (raw)' as part of the creation of a symmetric encryption key, and uses that to encrypt and store the SECRET key on the service's cloud. NewClient signs in, downloads the encrypted SECRETKeyBlob and decodes using the reconstructed symmetric key based on the sign in password. Old messages can then be decoded. -- The part that's insecure. -- If the password ever changes the SAME SECRET then needs to be stored to the cloud again, encrypted by the new key. Some padding with random data might help with this but this still sounds like a huge security loophole. -- Worse Insecurity -- A customer's device could be shipped a compromised client which uploads the SECRET keys to requesting third parties upon sign-in. Those third parties could be large corporations or governments. I do not see how anyone expects to use a mobile device for any serious security domain. At best average consumers can have a reasonable hope that it's safe from crooks who care about the average citizen.

kevincox 2y ago
> When you regain consciousness you'll be perfectly fine, but won't for the life of you be able to recall your device passwords or keys You can't use your password as input to the mud puddle test.
- mjevans 2y ago
  How would an end user even know they're running that test for a closed box system? The idea is what's possible in the real world.

vasco 2y ago

Why not the "founder locked up" test? If the founder claims secure encryption, yet they are not in jail, that means there's no secure encryption because they negotiated their freedom in exchange for secret backdoors.

rafram 2y ago
That isn’t applicable here. Telegram isn’t encrypted and yet they refused to comply with subpoenas. Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. Maybe in the future, creators of encrypted messaging apps will get locked up. I certainly hope not. But this case doesn’t indicate anything one way or another.
- mandmandam 2y ago
  > Companies whose customer data is encrypted can truthfully say that they have no way to access it for law enforcement. Telegram can’t. I dunno man, kinda seems like you ought to either have a right to privacy or not. Surely there's other ways to make a case, without extraordinarily abusable legal strong-arming. Why should a wealthy person be able to legally afford encrypted communication on a secure device, when 90+% of people can't because they're poor and tech illiterate? Does our historically unequal society need more information and rights asymmetry between rich and poor? Between privileged and marginalized?
  - rafram 2y ago
    Downloading Signal is just as easy as downloading Telegram.
    - mandmandam 2y ago
      As I said, tech illiterate - or as likely, legally illiterate. It's unreasonable to expect most people to intuit the distinction you describe. However, you don't see wealthy people communicating on insecure devices, because they have people to take care of that stuff.

scotty79 2y ago

If you apply this test to things like LastPass or Bitwarden they fail too. And yet the don't keep my unencrypted passwords on their servers.

bryanlarsen 2y ago
If you lose your Bitwarden master password you've lost your data. It passes the mud puddle test.
- scotty79 2y ago
  ah, you are right ... I missed the password recovery flow part which is a key thing here

foresto 2y ago

Unless you can prove (e.g. using your old device or a recovered signing key) that the new device is yours. In that case, if the service supports it, the new device could automatically ask your contacts to re-send the old messages using the new device's public key.

pokot0 2y ago

Unfortunately if the answer is no, it does not mean law enforcement can’t

robmccoll 2y ago

How to do that on initial account creation: - locally create a recovery key and use it to wrap any other essential keys - Split that or wrap that with two or more keys. - N - 1 goes to the cloud to be used as MFA tokens on recovery. - For the other, derive keys from normalized responses to recovery questions, use Shamir's secret sharing to pick a number of required correct responses and encrypt the Nth key. You can recover an account without knowing your original password or having your original device.

bryanlarsen 2y ago
IOW, you've made the recovery questions into alternate passwords, passwords that law enforcement is likely able to find or brute force.

nox101 2y ago

I'm probably dumb, but why would that be proof? I upload encrypted backups to a cloud service provider (AWS, Google Cloud). I go to another computer, download them, use a key/password to decrypt them. Sure, I get it, you're typing in something that decrypts the data into their app. That's true of all apps including WhatsApp, etc... The only way this could really be secure is if you used a different app to the encryption that you wrote/audited such that the messaging app never has access to your password/private key. Otherwise, at some point, you're trusting their app to do what they claim.

palotasb 2y ago
> > using the password recovery flow > use a key/password The previous poster intentionally mentioned password recovery flow. If you can gain access without your password, than law enforcement can too. If you could only gain access with your password, you could consider your data safe.
- kevincox 2y ago
  > If you could only gain access with your password, you could consider your data safe. You can't assume the negation. If you can get access without your password then you have proven that law enforcement or the hosting company can to. If you can't get access then you haven't proven anything. They may be securely storing your data end-to-end encrypted. Or they may just have a very strict account recovery process but the data is still on their servers in the clear.

refurb 2y ago

I know this is getting off-topic, but all the discussion about encryption missing an important weakness in any crypto algorithm - the human factor. I found it interesting that countries like Singapore haven’t introduced requirements for backdoors. They are notorious for passing laws for whatever they want as the current government has a super majority and court that tends to side with the government. Add on top Telegram is used widely in illegal drug transactions in Singapore. What’s the reason? They just attack the human factor. They just get invites to Telegram groups, or they bust someone and force them to handover access to their Telegram account. Set up surveillance for the delivery and boom crypto drug ring is taken down. They’ve done it again and again. One could imagine this same technique could be used for any Telegram group or conversation.

oloila 2y ago

Telegram has secure calls and secure e2e private chats. All other chats are cloud-backupped. So if you have an intent of using private communication - the answer is "no", if you don't care - the answer is "yes"

niutech 2y ago

Telegram has an answer to this: https://telegram.org/faq#q-do-you-process-data-requests https://telegram.org/faq#q-do-you-process-data-requests - only Secret Chats are e2e encrypted. As an alternative, Signal or Jami conversations are always e2e encrypted.