7 ms·
Subverting Telegram's end-to-end encryption (2023)
- ethin 1y agoIs this really something new? If memory serves, Telegram has had it's own crypto since the beginning, and I don't remember anything about it ever being audited by... Well, anybody? Granted, I don't know how MTProto actually works all that well, but IMO Telegram should've just used Noise or something. Would've saved them a lot of trouble. Although that doesn't really resolve the underlying problem that people think Telegram is secure when it's not (i.e., you have to explicitly enable E2EE and it's off by default), at least last time I checked. I haven't used telegram in years so my knowledge might be out of date though.
- jansper39 1y ago> Granted, I don't know how MTProto actually works all that well I suppose it's what the actual goals of the app are, potentially it works out very well for someone.
- dijit 1y agoIt was audited, found to have some serious flaws[0], then those were rectified. Most people dislike Telegram because: A) It takes away from Signals market share B) They don't enable E2EE by default C) They're owned by Pavel Durov, the Russian Zuckerberg. I am aware that it's an unpopular opinion, but the FUD spread against Telegram and the hagiographies of Signal make me think something weird is going on. Telegram has third party clients, so you can just roll your own client that runs another encryption on top if you want, like Pidgin used to do with OTR. [0]: https://mtpsym.github.io https://mtpsym.github.io
- hiimkeks 1y agoD) They don't enable E2EE for groups at all E) (I believe) don't enable E2EE with more than one device
- dijit 1y agoD) True aside from group calls afaik E) Neither does Whatsapp/Signal; they rely on a backdoor interface to your phone to send messages.
- tptacek 1y agoSignal very definitely does multiparty end-to-end secure messaging.
- dijit 1y agoWeird, every time I mention Signal on HN tptacek responds. But I'm having trouble discerning what you mean. Either you're saying group chats are encrypted E2EE - which, I never claimed. Or, you're mentioning that you can have multiple phones/devices on the same account, which doesn't work the last time I checked.
- mahemm 1y agoYou replied to a claim that Telegram doesn't do E2EE for groups saying 'Neither does Whatsapp/Signal'. That's wrong as `tptacek noted. If you meant something else, that wasn't clear.
- dijit 1y ago> E) (I believe) don't enable E2EE with more than one device my response was: > E) Neither does Signal/Whatsapp. The thread of the "E" topic is relevant here, i'm not claiming that Signal/Whatsapp support (or do not support) encryption for group chats. Sorry that it wasn't clear, I thought referring to them directly by letter would make it easier to differentiate.
- rockskon 1y agoIt does work. How do you think Signal desktop works?
- tptacek 1y agoI like how you sandwiched "the encryption story is bad" between two irrelevant social claims.
- s17n 1y agoPeople in the US prefer Signal over Telegram because Signal was created by people who took security seriously, and Telegram wasn't. People outside the US prefer telegram because they assume that Signal is probably compromised, or at least highly vulnerable to compromise, by US intelligence - they trust Pavel Durov's history of expropriation and arrest more than they trust some nerds who claim that our product is secure.
- BoredPositron 1y agoI mean Durov is going down the deep end in the last few weeks. Messaging all Telegram user with an Emergency feature with a doomer manifest. https://t.me/durov/452 https://t.me/durov/452
- asacrowflies 1y agoSeems pretty cognizant of the modd of entire HN front page past few weeks honestly
- BoredPositron 1y agoI don't care I didn't subscribe to anything from him. I'd rather take a Coldplay album than political opinions.
- ur-whale 1y ago> with a doomer manifest Can you point at anything in his message that's not factually correct?
- simion314 1y ago>Can you point at anything in his message that's not factually correct? He also got involved in Romanian and Moldovan elections, by sending a message to target users in the day of the elections( when doing campaign is illegal) with claims he presented no evidence for, basically the bastard works for Ruzzia, he might be forced to but the facts do not lie.
- skeledrew 1y agoIt's not about the content IMO; it's about the principle. Should not be sending content to users, unless they opted into said content being sent to them.
- a57721 1y agoOne factual thing that looks off is "the UK is imprisoning thousands for their tweets". I'm not in the UK and not following closely the situation there, but "thousands", really? Genuine doubt, would love to see some evidence. Otherwise, the "doomer manifest" is OK, but the comically inflated ego of Durov is annoying, him thinking that such banal and commonplace sentiments are worth pushing as an alert message to all users, wrapping everything into announcing his birthday (that he doesn't want to celebrate, oh no).
- weberer 1y agoD) They moved to the enshittification phase and started displaying ads
- celsoazevedo 1y agoAs someone that uses Telegram almost every day, the sad true is that most messages are not private. Most people simply don't use "secure chats". Not only it's not the default, but encrypted chats also don't work across devices. So it shouldn't be a surprise that Signal users speak against Telegram. It's simply not private for most people. It's like recommending using Facebook Messenger (pre-E2EE)... privacy minded people won't do that. Signal itself is criticised by other more privacy minded users because it requires a phone number. Signal doesn't have the best call quality (voice/video) especially on slow connections, sending media can be a pain in the rear, their desktop client is way too simple, they move slowly, etc. Telegram beats them in almost everything, but not privacy... Between having to trust Durov forever with our texts and system that uses e2ee by default and may or may not (no proof) have some flaw, I think most people that want privacy will use the option that uses e2ee for everything.
- hiimkeks 1y agoWell, the article is from 2023, but what you remember is most likely MTProto version 1, which was even more ridiculously broken, iirc
- ProofHouse 1y agotelegram is NOT safe. Far from it.
- tptacek 1y agoReminder that Telegram has "end to end" encryption only for direct messages; the rest is client-server, which they seem to believe is just as good as end-to-end.
- ynoxinul 1y ago*for direct messages in secret chats, which you have to enable explicitly and which reduces user expericence in comparison to normal chats.
- fsflover 1y ago*only on non-GNU/Linux systems.
- dijit 1y agoYou've said this a lot in this thread, but my client on Arch seems to have secret chats. https://i.imgur.com/Pft8r3B.png https://i.imgur.com/Pft8r3B.png
- fsflover 1y agoYou screenshot doesn't show how you achieved this or that you're even using Linux. There is no option to start a secret chat for me on a right click. Where did you download your client? This ticket suggests that there's no such option: https://github.com/telegramdesktop/tdesktop/issues/871 https://github.com/telegramdesktop/tdesktop/issues/871 See also: https://github.com/telegramdesktop/tdesktop/issues/6491 https://github.com/telegramdesktop/tdesktop/issues/6491
- dijit 1y agoThose are the same link and they’re 10 years old. I am using telegram-desktop from aur, I clicked the three dots (…) at the top next to the magnifying glass, then info (i) to get to the profile, then there is a “more” (…) button where there was a “Secret” option.
- GranPC 1y ago(2023)
- gruez 1y agoFor people who only read the headline, it's not as bad as the title might suggest. This attack requires backdooring the client, by which point it's already effectively game over in most threat models. The main advantage of this attack is that a compromised client can be sending "encrypted" messages that can actually be trivially decrypted by authorities, but that isn't immediately obvious to someone inspecting network traffic. Needless to say, this is a pretty pointless attack because nobody is manually inspecting every piece of data that their telegram is sending, and the client probably makes so many requests that it's trivial to smuggle data through some other side channel.
- tptacek 1y agoThe threat model of the attack is targets relying on binary/source transparency of open source clients to protect against (state-sponsored) client backdoors; in that sense, it most closely resembles the Juniper/NetScreen Dual-EC attack, which functioned basically the same way: a backdoor that was essentially not auditable, as the underlying vulnerability was realized cryptographically. I'm just clarifying. I agree the practical implications of the attack are not really meaningful to a general audience.
- supermatou 1y agoExcellent article about Telegram's encryption from Matt Green (cryptographer, for those who haven't heard of him): https://blog.cryptographyengineering.com/2024/08/25/telegram-is-not-really-an-encrypted-messaging-app/ https://blog.cryptographyengineering.com/2024/08/25/telegram...
- defraudbah 1y agoand another one from king of encryption in golang The Most Backdoor-Looking Bug I’ve Ever Seen https://words.filippo.io/telegram-ecdh/ https://words.filippo.io/telegram-ecdh/
- upofadown 1y agoNote that this is about MTProto 1 and not the MTProto 2 under consideration here.
- defraudbah 1y agonote that it has a note related to MTProto 2
- emptysongglass 1y agoYeah this one isn't relevant at all to the current protocol version.
- r721 1y agoHN discussion (2024): https://news.ycombinator.com/item?id=41350530 https://news.ycombinator.com/item?id=41350530
- dang 1y agoThanks! Macroexpanded: Is Telegram really an encrypted messaging app? - https://news.ycombinator.com/item?id=41350530 https://news.ycombinator.com/item?id=41350530 - Aug 2024 (583 comments)
- 1y ago
- taminka 1y agocan anyone explain why telegram doesn't use an audited e2e implementation? is it really because they wanted more convenient and faster cross-device sync? have they been threatened and/or backdoored by the fsb? they basically stole vk from him, but left him alone w/ telegram? it's suspicious, but at the same time, iirc, nobody's been able to find a vulnerability in their encryption protocol :shrug
- tptacek 1y agoPeople have found vulnerabilities in MTProto.
- sedatk 1y agoIIRC, they had even started out with basic mistakes like MAC-then-encrypt.
- dijit 1y agoThe first version of MTProto was found to have weaknesses. The reason they rolled their own was because it came out before the Double-Ratchet/Axolotl protocol and OtR (which double-ratchet is essentially based on) was extremely inconvenient to use properly and had its own weaknesses.
- taminka 1y ago> The reason they rolled their own was because it came out before the Double-Ratchet/Axolotl protocol and OtR (which double-ratchet is essentially based on) was extremely inconvenient to use properly and had its own weaknesses. this actually makes a lot of sense lowkey, thanks :)
- chupasaurus 1y ago1,2) NIH syndrome 3) We don't know 4) Expropriation isn't "basically stolen", Telegram was a tiny side project at the time
- deleted 1y ago[deleted]
- defraudbah 1y agoin short, you don't need access to the device, only to the same network if you are on the same network and manage either intercept key to bruteforce it or guess encryption key with emoji it's possible to decrypt the whole chat. It works because telegram random generator uses time and some device information which is predictable the study managed to decrypt 500 messages out of 500 on emulator devices. Brutewforcing takes like a few $100 worth of computing power Honestly, durovs are exceptional people and enterpreneurs, however their encryption and what they say isn't always what it presented as
- upofadown 1y agoIn a very real sense you do need access to the device to install the backdoored client. There is no actual cryptographic weakness presented here...
- defraudbah 1y agowent through it again, you are right, network access alone isn't enough. It's more about installing a third party app (like telegram desktop or modified version from the store if intervened by the government or any other 3d party) but the protocol itself does not look reliable, since encoding 85% of messages is quite easy once you change your message padding a bit according to the paper unlike what's used in signal
- upofadown 1y agoI am sure that there are a zillion ways to leak information in Signal if you can hack the client. This sort of thing is normally assumed in threat models.
- deleted 1y ago[deleted]
- cimi_ 1y agoLex Friedman recently did an interview with Durov: https://lexfridman.com/pavel-durov/ https://lexfridman.com/pavel-durov/ I listened to bits of it and I was disappointed by the lack of push back from Lex who was supper excited because he got to hang out with Durov for a couple of weeks in Dubai - the tl;dr I got from what I heard is that Telegram is amazing and Durov is a visionary freedom fighter. Lex's recent history I'm not surprised though. Here's the transcript of the section about encryption: https://lexfridman.com/pavel-durov-transcript#chapter15_encryption https://lexfridman.com/pavel-durov-transcript#chapter15_encr... I'll let you judge for yourself. I'll comment on another section though because I'm somewhat knowledgeable having followed the subject closely in the media and by knowing the country: https://lexfridman.com/pavel-durov-transcript#chapter7_romanian_elections https://lexfridman.com/pavel-durov-transcript#chapter7_roman... He claims: 'So, by the time the head of intelligence services met me to ask about Romania to help them silencing conservative voices in Romania, I was already wary of what can be going on next.' I call bullshit on this. The 'conservative voices' are muppets doing Russia's bidding who broke all sorts of election laws. There was nothing serious happening on Telegram in Romania that would warrant any foreign intervention, it just doesn't make sense.
- pidgeon_lover 1y agoSignal is not an alternative to Telegram. It is an alternative to other mobile-phone-only instant messaging platforms like Whatsapp or Briar. All of these lack desktop clients, while claiming security and maintaining exclusivity to the backdoored platforms of Android and iOS. Telegram has functional standalone desktop clients.
- gh02t 1y ago> Telegram has functional standalone desktop clients. So does Signal? You need a phone number to initially register an account on either service last I checked. The Signal desktop app used to be awful, but now it's fine. I use both and have for many years; it used to be the case that Telegram had a much nicer user experience, but nowadays I feel like it's near parity between the two.