16 ms·

From their FAQ: >Q: How secure is Telegram? >Very secure. We are based on a new protocol, MTProto, built by our own specialists from scratch, with security in

• fwr 13y ago
  Gee, who are these random nobodies? http://telegram.org/faq#q-who-are-the-people-behind-telegram http://telegram.org/faq#q-who-are-the-people-behind-telegram
  • dchest 13y ago
    These people are "random nobodies" in cryptographic protocol design.
  • skion 13y ago
    "As a result, Telegram is the fastest and most secure messaging system in the world." That's a very bold and yet to be proven statement. Probably any crypto expert would know better than to say that. This paragraph exactly pin points the problem with being a cryptographic nobody. PS. I do like their icon designer.
• yurylifshits 13y ago
  MTProto's author is Nikolai Durov: http://en.wikipedia.org/wiki/Nikolai_Durov http://en.wikipedia.org/wiki/Nikolai_Durov He is one of most legendary math/programming champions of all time.
  • sillysaurus2 13y ago
    He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refactoring change. http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-... And the only reason the critical bug was found is because it was open source. This, as far as I can see, isn't. So we have a perfect storm of problems here: An author who has rolled his own crypto, isn't a cryptographer, and whose product is closed source. Trust Telegram at your peril. It's worth noting that there's an app which already does what Telegram claims to do. It's called TextSecure, and it was written by Moxie Marlinspoke and several other big-name cryptographers: https://whispersystems.org/ https://whispersystems.org/ ... and it's open source: https://github.com/WhisperSystems/TextSecure/ https://github.com/WhisperSystems/TextSecure/ ... and they don't try to roll their own crypto: https://github.com/WhisperSystems/TextSecure/wiki/ProtocolV2 https://github.com/WhisperSystems/TextSecure/wiki/ProtocolV2 These aren't coincidences. It's basic necessity. EDIT: Telegram is open source, so I was wrong about that and it'd be unfair of me not to mention it. But the other observations still apply. Until Telegram is verified to be secure, I don't think it's a good idea to trust it, especially when secure alternatives like TextSecure exist.
    • kitd 13y ago
      You are correct to be wary. However, the MTProto java impl is here: https://github.com/ex3ndr/telegram-mt https://github.com/ex3ndr/telegram-mt
      • sillysaurus2 13y ago
        Interesting. Some observations: TextSecure has been a work in progress for two years: https://github.com/WhisperSystems/TextSecure/commits/master?page=12 https://github.com/WhisperSystems/TextSecure/commits/master?... Telegram seems to have been in progress for two months: https://github.com/ex3ndr/telegram-mt/commits/master?page=2 https://github.com/ex3ndr/telegram-mt/commits/master?page=2 Telegram also seems to be the work of a single author. While TextSecure was written mostly by Moxie, there were several other contributing members.
        • haarts 13y ago
          Textsecure != Telegram. Textsecure is a replacement for SMS/text messages and Telegram for Whatsapp type messages. Totally different things.
      • jzwinck 13y ago
        Great, let's take a quick look. TcpContext.java[1] says: MAX_PACKED_SIZE = 1024 * 1024 * 1024;//1 MB READ_DIE_TIMEOUT = 5 * 1000; // 15 sec So those are bugs, though I'm not sure if documentation or code. Most importantly to me, there are very few comments in the code, and the few there are are incorrect. One might infer that this code has been written either in haste, or by someone who believes that comments are not needed in this sort of systems code. There are also writeInt() and readInt() method which seems to be little-endian, which seems odd for a network program. No comments near them. Finally, there's a "Package" class which is just a byte array and a flag. And there's a method which writes it after a cute encoding for the length divided by 4. But there is no code which checks that the length is evenly divisible by 4. This may lead to incomplete Packages being written, with what effect I am not sure. In summary, I wouldn't trust this program, having reviewed one of its source files mostly at random. Oh, and despite its README saying that it is designed for mobile, it uses TCP Keep-Alive, which seems like a bad idea for mobile specifically (due to keeping the radio alive and draining the battery). Again, no comments explaining why. [1] https://github.com/ex3ndr/telegram-mt/blob/master/src/main/java/org/telegram/mtproto/transport/TcpContext.java https://github.com/ex3ndr/telegram-mt/blob/master/src/main/j...
  • jessedhillon 13y ago
    I don't care if it was written by Eric A. Young -- I think history has shown that crypto takes a long time and many iterations to get to a point where it's secure and trustworthy. No single person is going to come down from the mountaintop with a working, secure and correct protocol from scratch. That just doesn't seem to be how it works.
• davidw 13y ago
  Could you find a way to say that without sounding like the Simpsons' Comic Book Guy? Maybe like this: https://news.ycombinator.com/item?id=6913705 https://news.ycombinator.com/item?id=6913705 For further reference: https://news.ycombinator.com/item?id=1852560 https://news.ycombinator.com/item?id=1852560
• alco 13y ago
  >Q: How secure is Telegram? >Very secure. [...] It's just an advertisement like any other. I'm sure the people responsible for the content of the FAQ know their target audience, so they know the wording will work for those whose attention they care about. It is good that we, technical people, understand how completely worthless those words are. It begs for the "citation needed" label. The question for me is this: do ordinary people (non-programmers in this case) really believe in most of the things ads tell them?
• userulluipeste 13y ago
  "Oh good, a bunch of randoms have rolled their own crypto. I stopped reading at this point." An ad-hominem attack. This is Hacker News and their work is open, how about making a statement after researching the actual code instead?
  • micheljansen 13y ago
    In this case, even if you remove the ad-hominem attack (a bunch of randoms), a valid point remains: implementing crypto is already notoriously difficult, let alone designing cryptographic protocols.
    • TelegramApp 13y ago
      Still, there are sometimes valid reasons for not re-using existing solutions. In our case, we needed something that is both secure and competitive in comparison to mass market solutions in terms of speed, working on weak connections and usability. Disclaimer: I work for Telegram.
      • ge0rg 13y ago
        It is a really bad idea to compromise security for speed and connection stability. Processing power is a question of scaling the hardware, communication speed is hardly affected by a proper encryption scheme, neither is reliability of the application-layer protocol. Usability, however, is a different beast. You must compromise security to make a chat application appeal to "regular" users. Still, this is a trade-off that can be clearly communicated to the user and to developers, and does not require a custom crypto protocol. You can achieve the same effects with using existing and tested libraries. Edit: Disclaimer: I am the developer of the yaxim Android XMPP client and the operator of the public yax.im XMPP server (both available at http://yax.im http://yax.im).
        • e12e 13y ago
          Thank you for the plug for yaxim. I've been searching around for a "good enough" jabber client for android, and while yaxim isn't there yet (for me: no otr support, single server) it looks like it's headed in the right direction!
• mikkom 13y ago
  Also, they store everything to their cloud. Very secure indeed!
• gr3yh47 13y ago
  With all the revelations of built in weaknesses and such with existing encryption schemes... I don't know. I think we need a new one. That said, it should probably be developed by a panel of experts. I would love to see something by Bruce Steiner et al, where 'et al' is a group that he selects. As you pointed out a group without heavy crypto experience can't realistically roll their own and have it actually be secure.
  • tptacek 13y ago
    Which revelations would those be?
• bnr 13y ago
  They did not roll their own crypto, it's using AES with Diffie-Hellman key generation. [0] You can now argue whether that's still "from scratch". (Is building something on top of TCP "from scratch"?) [0] http://core.telegram.org/api/end-to-end http://core.telegram.org/api/end-to-end
  • tptacek 13y ago
    Designing new protocols and constructions using primitives like AES and DH is exactly what cryptographers are talking about when they refer to "rolling ones own crypto". Look at the description of their protocol, particularly the handshake, which negotiates number-theoretic parameters, and try to make a list of all the checks they'll need and the additional protocol that they'd need to specify just to make the handshake secure. Not only that, but the crypto in Telegram is idiosyncratic; for instance, this is the only system I've ever seen that used IGE mode.
• carsonreinke 13y ago
  No, see this: http://core.telegram.org/mtproto http://core.telegram.org/mtproto
• TelegramApp 13y ago
  We have not 'rolled our own crypto'. We still use RSA, AES and DH. I've changed the part in the FAQ that seems to be one of major sources of this controversy, so that it no longer reads "built from scratch". This was poorly applied marketing language — we do use time-tested security algorithms. Even though Telegram doesn't uses MTProto instead of HTTPS due to mobile speed and trust issues.
  • tptacek 13y ago
    RSA in what mode? AES in what mode? IGE? Why are you using an authenticated cipher mode from the 1970s that predates every modern AEAD construction? DH with what group? How do you authenticate the exchange? How does forward secrecy work? Saying "we didn't roll our own: we use RSA, AES, and DH" is extremely worrying; it suggests that you're not aware of where the complexity in a cryptosystem lives. Anybody on HN can write the trivial code to ask the JCE for an RSA or an AES. You have to do better.
• hnriot 13y ago
  I think you need a new random function, the one you're currently using seems to be lacking some very basic features.