7 ms·

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

alephnerd 2y ago
> Does Telegram let them see it: I don't think so. That seems to be the core issue style Durov being arrested The UAE requires decryption keys as part of their Telco regulations. If Telegram can operate in the UAE without VPN (and it can), then at the very least the UAE MoI has access. They (and their shadow firms like G42 and G42's shadow firms) were always a major buyer for offensive capabilities at GITEX. On that note, NEVER bring your personal phone to DEFCON/Blackhat or GITEX. Edit: cannot reply below so answering here Cybersecurity conferences. DEFCON/Blackhat happen during the same week, so you have a lot of script kiddies who lack common sense trying to pwn random workloads. They almost always get caught (and charged - happens every year), but it's a headache. GITEX is MENA and Asia's largest cybersecurity conference. You have intelligence agencies from most of the Middle East, Africa, Europe, and Asia attending, plus a lot of corporate espionage because of polticially connected MSSPs as well as massive defense tenders.
- mubu 2y ago
  Sorry, but as someone who's completely out of the loop with these things. What's DEFCON/Blackhat or GITEX about and why shouldn't you bring your personal phone? I'm genuinely interested.
  - jijji 2y ago
    defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked
    - Account_Removed 2y ago
      [dead]
      - 2snakes 2y ago
        For the lulz
        rustcleaner 2y ago
        Best reason of any!
      - reissbaker 2y ago
        Because the attendees are high-value targets who often have elevated permissions inside the firms or governments they work in, and that's worth even more.
      - alephnerd 2y ago
        On a separate note, Zerodium is dead now. They're in the middle of an active fire sale, but the Zero Day market's bottom fell out now that countries are increasingly moving exploit development in-house or to vendors that can do both zero day acquisition AND exploit deployment (which Zerodium cannot do as an American company). Also, u/reissbaker's answer is correct.
      - ParetoOptimal 2y ago
        Skiddies are renowned for their rational thoughts and actions.
sroerick 2y ago
Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE
- h4x0rr 2y ago
  I don't think the plaintext is required to be part of the API call
- wkat4242 2y ago
  The app can decrypt the notification before it's displayed.
- qwertox 2y ago
  Why? I think Google suggests that you send the payload encrypted through the notification. Google then only knows which app to send the message to, they don't know from whom the message originates (only "a Telegram server") nor what the content is. Also, you could just send a notification instructing the app to fetch a new message from your server. From the docs: Encryption for data messages The Android Transport Layer (see FCM architecture) uses point-to-point encryption. Depending on your needs, you may decide to add end-to-end encryption to data messages. FCM does not provide an end-to-end solution. However, there are external solutions available such as Capillary or DTLS. https://firebase.google.com/docs/cloud-messaging/concept-options https://firebase.google.com/docs/cloud-messaging/concept-opt...
  - sroerick 2y ago
    Assuming an adversarial relationship, what sort of metadata could Google capture simply knowing which app was sending the notifications and who was receiving them?
    - throwuxiytayq 2y ago
      Aren’t notifications enqueued on the server side, implying sender info is inscrutable? I’m curious what mechanism you’d propose to gather any valuable metadata given a sufficient volume of encrypted notifications.
empath75 2y ago
Will they let _US_ law enforcement see it? No. Will they let Russian? Of course.
- steelbrain 2y ago
  Source?
  - khafra 2y ago
    "Telegram is working with Russian intelligence" is a theory that's been floated in quite a few places, included Wired: https://www.wired.com/story/the-kremlin-has-entered-the-chat/ https://www.wired.com/story/the-kremlin-has-entered-the-chat...
  - victorbjorklund 2y ago
    recent support. kremlin yesterday arranged big protests in moscow demanding his release. kremlin yesterday arrested the nephew of the french ambassador claim he was dealing drugs (claiming he carried a package of heroin marked with the label "for distribution in russia" as if all drug dealers put their intentions in writing) clearly to try to trade him
    - rafram 2y ago
      > kremlin yesterday arrested the nephew of the french ambassador claim he was dealing drugs Source?
    - piskov 2y ago
      Jesus, it was the Onion-like parody website (Panorama)
highcountess 2y ago
All the encryption stuff is just a red herring to a larger degree. It’s not the technical access to the information that is the issue, it is that people can share and exchange information that the various regimes do not want shared that is the primary issue. They want censorship, i.e., control of thought and speech, arresting the information flow. They know what is being said and that’s what they want to arrest, that information can be sent and received. And by “they” I mean more than just the French. That was just coincidental and pragmatic. The French state does not operate that quickly on its own, to get an arrest warrant five minutes after he landed and execute on it immediately. That has other fingerprints all over it in my view.
kaba0 2y ago
AFAIK this current case has absolutely nothing to do with any form of chat features, it’s about telegram’s public channels that more or less work like reddit/twitter/any other news channels, except it refuses to censor content.
schmichael 2y ago
> Does Telegram let them see it: I don't think so. This is exceptionally naive. Even if he was arrested for not sharing with the French, what about for other countries? Was he arrested for not ever sharing or not sharing enough? Even if he, personally, has never shared, that doesn’t say anything about his employees who have the same access to these systems. Your data is not private with Telegram. You are trusting Telegram. It is a trust-based app, not a cryptographically secure app. If you trust telegram, that’s your choice, but just because a person says the right words in interviews doesn’t mean your data is safe.
- po 2y ago
  Following the St. Petersburg attack, the Federal Security Service (FSB), in an event that may ring somewhat familiar to many in the United States and Europe, asked Telegram for encryption keys to decode the dead attacker’s messages. Telegram said it couldn’t give the keys over because it didn’t have them. In response, Russia’s internet and media regulator said the company wasn’t complying with legal requirements. The court-ordered ban on accessing Telegram from within Russia followed shortly thereafter. Telegram did, though, enact a privacy policy in August 2018 where it could hand over terror suspects’ user information (though not encryption keys to their messages) if given a court order. ... ... Pavel Durov, Telegram’s founder, called on Russian authorities on June 4 to lift the ban. He cited ongoing Telegram efforts to significantly improve the removal of extremist propaganda from the platform in ways that don’t violate privacy, such as setting a precedent of handing encryption keys to the FSB. https://www.atlanticcouncil.org/blogs/new-atlanticist/whats-behind-russias-decision-to-ditch-its-ban-on-telegram/ https://www.atlanticcouncil.org/blogs/new-atlanticist/whats-...
  - Canada 2y ago
    This doesn't make any sense. Either the author of the article is confused, lying, or is drawing conclusions from source material that is untrue. In the US case, there was a phone where data was encrypted at rest. Though Apple was capable of creating and signing a firmware update that would have made it easier for the FBI to brute force the password, Apple refused to do so. In the Russian case, the FSB must have already had access to the suspect's phone because if it did not then Telegram would not be in any position to help at all. So, the FSB must have already had access. And therefore, by having access to the phone they also had complete access to the suspect's chats in plaintext, regardless of whether or not the suspect used Telegram's private chat. There would have been no keys to ask Telegram for copies of. Alternatively, the FSB might have had access to some other user's chats with the suspect, and wanted Telegram to turn over the suspect's full data. Telegram is 100% able to do that if they want to. As the specific part of the article you have quoted is definitely bullshit, I suspect the rest of it is bullshit too and that despite what Roskomnadzor states in public, the real fight with Durov was over censorship.
seanhunter 2y ago
Do you have some info about Durov being arrested for not letting law enforcement see encrypted messages? The public info says he was arrested for "...lack of moderation, ...[and] failing to take steps to curb criminal uses of Telegram." I don't see anywhere saying he's been arrested for anything to do with encryption or cooperating with investigations. eg https://www.bbc.co.uk/news/articles/ckg2kz9kn93o https://www.bbc.co.uk/news/articles/ckg2kz9kn93o but pretty much all the sources I have read say the same
medo-bear 2y ago
> They probably should implement E2EE for everything Certainly not because then Telegram would lose alot of its functionality that makes it great. One thing that I really enjoy about Telegram is that I can have it open and synched across many independent devices. Telegram also has e2e as an option on some clients which cant be synched
- tcfhgj 2y ago
  You can sync messages across many independent devices despite e2ee. Matrix has been doing that for years
  - elcomet 2y ago
    Even whatsapp does it now
    - medo-bear 2y ago
      Does it? Last time I used WhatsApp I could not use it on my desktop without scanning a QR code each time and keeping the phone nearby.
      - elcomet 2y ago
        You need to scan the QR code only the first time using the desktop app.
        medo-bear 2y ago
        Can you use the desktop app without the phone present? For example, if the phone is turned off.
        tcfhgj 2y ago
        I have heard you can, for about 2 weeks. Then the phone must be at least become active.
victorbjorklund 2y ago
they probably share it with russian authorities. Just look now. russia is allowing protests in favour of him (they only allow protest they support) and they arrested a french citizen on fake drug charges right after
ikt 2y ago
> They probably should implement E2EE for everything He explained in his blog why he doesn't like E2EE: https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Why Isn’t Telegram End-to-End Encrypted by Default? Pavel Durov August 15, 2017
- johnisgood 2y ago
  I do not think it is a remarkable feat to be more secure than WhatsApp.
maximinus_thrax 2y ago
> Does Telegram let them see it: I don't think so. I do think so: https://archive.is/M5zw4 https://archive.is/M5zw4 Also, 'exile' https://istories.media/en/news/2024/08/27/pavel-durov-has-visited-russia-more-than-50-times-since-his-exile-in-2014/ https://istories.media/en/news/2024/08/27/pavel-durov-has-vi...
immibis 2y ago
Either Telegram will let them see it, or Telegram's CEO will go to jail. Telegram's CEO doesn't want to go to jail, so Telegram will let them see it.

alephnerd 2y ago

> Does Telegram let them see it: I don't think so. That seems to be the core issue style Durov being arrested The UAE requires decryption keys as part of their Telco regulations. If Telegram can operate in the UAE without VPN (and it can), then at the very least the UAE MoI has access. They (and their shadow firms like G42 and G42's shadow firms) were always a major buyer for offensive capabilities at GITEX. On that note, NEVER bring your personal phone to DEFCON/Blackhat or GITEX. Edit: cannot reply below so answering here Cybersecurity conferences. DEFCON/Blackhat happen during the same week, so you have a lot of script kiddies who lack common sense trying to pwn random workloads. They almost always get caught (and charged - happens every year), but it's a headache. GITEX is MENA and Asia's largest cybersecurity conference. You have intelligence agencies from most of the Middle East, Africa, Europe, and Asia attending, plus a lot of corporate espionage because of polticially connected MSSPs as well as massive defense tenders.

mubu 2y ago
Sorry, but as someone who's completely out of the loop with these things. What's DEFCON/Blackhat or GITEX about and why shouldn't you bring your personal phone? I'm genuinely interested.
- jijji 2y ago
  defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked
  - Account_Removed 2y ago
    [dead]
    - 2snakes 2y ago
      For the lulz
      - rustcleaner 2y ago
        Best reason of any!
    - reissbaker 2y ago
      Because the attendees are high-value targets who often have elevated permissions inside the firms or governments they work in, and that's worth even more.
    - alephnerd 2y ago
      On a separate note, Zerodium is dead now. They're in the middle of an active fire sale, but the Zero Day market's bottom fell out now that countries are increasingly moving exploit development in-house or to vendors that can do both zero day acquisition AND exploit deployment (which Zerodium cannot do as an American company). Also, u/reissbaker's answer is correct.
    - ParetoOptimal 2y ago
      Skiddies are renowned for their rational thoughts and actions.

sroerick 2y ago

Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE

h4x0rr 2y ago
I don't think the plaintext is required to be part of the API call
wkat4242 2y ago
The app can decrypt the notification before it's displayed.
qwertox 2y ago
Why? I think Google suggests that you send the payload encrypted through the notification. Google then only knows which app to send the message to, they don't know from whom the message originates (only "a Telegram server") nor what the content is. Also, you could just send a notification instructing the app to fetch a new message from your server. From the docs: Encryption for data messages The Android Transport Layer (see FCM architecture) uses point-to-point encryption. Depending on your needs, you may decide to add end-to-end encryption to data messages. FCM does not provide an end-to-end solution. However, there are external solutions available such as Capillary or DTLS. https://firebase.google.com/docs/cloud-messaging/concept-options https://firebase.google.com/docs/cloud-messaging/concept-opt...
- sroerick 2y ago
  Assuming an adversarial relationship, what sort of metadata could Google capture simply knowing which app was sending the notifications and who was receiving them?
  - throwuxiytayq 2y ago
    Aren’t notifications enqueued on the server side, implying sender info is inscrutable? I’m curious what mechanism you’d propose to gather any valuable metadata given a sufficient volume of encrypted notifications.

empath75 2y ago

Will they let _US_ law enforcement see it? No. Will they let Russian? Of course.

steelbrain 2y ago
Source?
- khafra 2y ago
  "Telegram is working with Russian intelligence" is a theory that's been floated in quite a few places, included Wired: https://www.wired.com/story/the-kremlin-has-entered-the-chat/ https://www.wired.com/story/the-kremlin-has-entered-the-chat...
- victorbjorklund 2y ago
  recent support. kremlin yesterday arranged big protests in moscow demanding his release. kremlin yesterday arrested the nephew of the french ambassador claim he was dealing drugs (claiming he carried a package of heroin marked with the label "for distribution in russia" as if all drug dealers put their intentions in writing) clearly to try to trade him
  - rafram 2y ago
    > kremlin yesterday arrested the nephew of the french ambassador claim he was dealing drugs Source?
  - piskov 2y ago
    Jesus, it was the Onion-like parody website (Panorama)

highcountess 2y ago

All the encryption stuff is just a red herring to a larger degree. It’s not the technical access to the information that is the issue, it is that people can share and exchange information that the various regimes do not want shared that is the primary issue. They want censorship, i.e., control of thought and speech, arresting the information flow. They know what is being said and that’s what they want to arrest, that information can be sent and received. And by “they” I mean more than just the French. That was just coincidental and pragmatic. The French state does not operate that quickly on its own, to get an arrest warrant five minutes after he landed and execute on it immediately. That has other fingerprints all over it in my view.

kaba0 2y ago

AFAIK this current case has absolutely nothing to do with any form of chat features, it’s about telegram’s public channels that more or less work like reddit/twitter/any other news channels, except it refuses to censor content.

schmichael 2y ago

> Does Telegram let them see it: I don't think so. This is exceptionally naive. Even if he was arrested for not sharing with the French, what about for other countries? Was he arrested for not ever sharing or not sharing enough? Even if he, personally, has never shared, that doesn’t say anything about his employees who have the same access to these systems. Your data is not private with Telegram. You are trusting Telegram. It is a trust-based app, not a cryptographically secure app. If you trust telegram, that’s your choice, but just because a person says the right words in interviews doesn’t mean your data is safe.

po 2y ago
Following the St. Petersburg attack, the Federal Security Service (FSB), in an event that may ring somewhat familiar to many in the United States and Europe, asked Telegram for encryption keys to decode the dead attacker’s messages. Telegram said it couldn’t give the keys over because it didn’t have them. In response, Russia’s internet and media regulator said the company wasn’t complying with legal requirements. The court-ordered ban on accessing Telegram from within Russia followed shortly thereafter. Telegram did, though, enact a privacy policy in August 2018 where it could hand over terror suspects’ user information (though not encryption keys to their messages) if given a court order. ... ... Pavel Durov, Telegram’s founder, called on Russian authorities on June 4 to lift the ban. He cited ongoing Telegram efforts to significantly improve the removal of extremist propaganda from the platform in ways that don’t violate privacy, such as setting a precedent of handing encryption keys to the FSB. https://www.atlanticcouncil.org/blogs/new-atlanticist/whats-behind-russias-decision-to-ditch-its-ban-on-telegram/ https://www.atlanticcouncil.org/blogs/new-atlanticist/whats-...
- Canada 2y ago
  This doesn't make any sense. Either the author of the article is confused, lying, or is drawing conclusions from source material that is untrue. In the US case, there was a phone where data was encrypted at rest. Though Apple was capable of creating and signing a firmware update that would have made it easier for the FBI to brute force the password, Apple refused to do so. In the Russian case, the FSB must have already had access to the suspect's phone because if it did not then Telegram would not be in any position to help at all. So, the FSB must have already had access. And therefore, by having access to the phone they also had complete access to the suspect's chats in plaintext, regardless of whether or not the suspect used Telegram's private chat. There would have been no keys to ask Telegram for copies of. Alternatively, the FSB might have had access to some other user's chats with the suspect, and wanted Telegram to turn over the suspect's full data. Telegram is 100% able to do that if they want to. As the specific part of the article you have quoted is definitely bullshit, I suspect the rest of it is bullshit too and that despite what Roskomnadzor states in public, the real fight with Durov was over censorship.

seanhunter 2y ago

Do you have some info about Durov being arrested for not letting law enforcement see encrypted messages? The public info says he was arrested for "...lack of moderation, ...[and] failing to take steps to curb criminal uses of Telegram." I don't see anywhere saying he's been arrested for anything to do with encryption or cooperating with investigations. eg https://www.bbc.co.uk/news/articles/ckg2kz9kn93o https://www.bbc.co.uk/news/articles/ckg2kz9kn93o but pretty much all the sources I have read say the same

medo-bear 2y ago

> They probably should implement E2EE for everything Certainly not because then Telegram would lose alot of its functionality that makes it great. One thing that I really enjoy about Telegram is that I can have it open and synched across many independent devices. Telegram also has e2e as an option on some clients which cant be synched

tcfhgj 2y ago
You can sync messages across many independent devices despite e2ee. Matrix has been doing that for years
- elcomet 2y ago
  Even whatsapp does it now
  - medo-bear 2y ago
    Does it? Last time I used WhatsApp I could not use it on my desktop without scanning a QR code each time and keeping the phone nearby.
    - elcomet 2y ago
      You need to scan the QR code only the first time using the desktop app.
      - medo-bear 2y ago
        Can you use the desktop app without the phone present? For example, if the phone is turned off.
        tcfhgj 2y ago
        I have heard you can, for about 2 weeks. Then the phone must be at least become active.

victorbjorklund 2y ago

they probably share it with russian authorities. Just look now. russia is allowing protests in favour of him (they only allow protest they support) and they arrested a french citizen on fake drug charges right after

ikt 2y ago

> They probably should implement E2EE for everything He explained in his blog why he doesn't like E2EE: https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Why Isn’t Telegram End-to-End Encrypted by Default? Pavel Durov August 15, 2017

johnisgood 2y ago
I do not think it is a remarkable feat to be more secure than WhatsApp.

maximinus_thrax 2y ago

> Does Telegram let them see it: I don't think so. I do think so: https://archive.is/M5zw4 https://archive.is/M5zw4 Also, 'exile' https://istories.media/en/news/2024/08/27/pavel-durov-has-visited-russia-more-than-50-times-since-his-exile-in-2014/ https://istories.media/en/news/2024/08/27/pavel-durov-has-vi...

immibis 2y ago

Either Telegram will let them see it, or Telegram's CEO will go to jail. Telegram's CEO doesn't want to go to jail, so Telegram will let them see it.