4 ms·

Why not the 200K? Was it outside the parameters of the contest or something?

oakwhiz 13y ago
Their contest had very restrictive parameters if I recall correctly.
hdevalence 13y ago
Yes. The contest is not about actually exposing flaws in their cryptosystem, which is why the rules are rigged up in a way that would allow even a terribly insecure protocol (like Telegram's, or Moxie's counter-challenge protocol) to pass as "secure".
- h0cked 13y ago
  Telegram's contest itself is meaningless regarding the security of its protocol (as others explained in details). Finding bugs such as this deserves 200k more than anything else
  - ballard 13y ago
    Offering the contest was shady and stupid enough. Not paying just proves they're chiselers that never intended to pay in the first place. This wins the runner-up award for second most botched PR disaster ever. The consolation prize is a lump of coal.
    - deleted 13y ago
      [deleted]
    - phaus 13y ago
      The contest was stupid and shady, but they did explicitly state the rules. Its not really fair to accuse them of wrongdoing if they don't give this guy $200,000. If I were in charge of telegram, I'd pay the guy the whole amount, but that would just be out of the kindness of my heart. Morally, they aren't obligated to pay just because the rules of their contest are ridiculous.
    - danabramov 13y ago
      They're paying $100 000. https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858
      - ballard 13y ago
        It's too late to matter. But good for him that they're only half crooked.
xytop 13y ago
Yes, outside. Although the underground of this contest was to prove security and inability to read messages by 3rd parties contest was about decrypting Durov's chat. Chat is not decrypted and as many say - it's nearly impossible (http://thoughtcrime.org/blog/telegram-crypto-challenge/ http://thoughtcrime.org/blog/telegram-crypto-challenge/). But "bookmark" is found and it means that all the PR was shit. Telegram already removed 'xor nonce' from their documentation and added a new layer to their api but who knows where they will put a next bookmark. Probably it will be hidden in a deeper place. But trust is already lost. It appears that either their secure protocol was containing the bookmark specially or that protocol is getting written by non-specialists which cant guarantee any security.
- xytop 13y ago
  old copy of their doc which has 'xor nonce' inside: http://webcache.googleusercontent.com/search?q=cache:FAntx8lsBMQJ:https://core.telegram.org/api/end-to-end+&cd=1&hl=ru&ct=clnk&client=ubuntu http://webcache.googleusercontent.com/search?q=cache:FAntx8l...
MatthewWilkes 13y ago
Their contest was based on a sample packet capture only.

Their contest had very restrictive parameters if I recall correctly.

Yes. The contest is not about actually exposing flaws in their cryptosystem, which is why the rules are rigged up in a way that would allow even a terribly insecure protocol (like Telegram's, or Moxie's counter-challenge protocol) to pass as "secure".

h0cked 13y ago
Telegram's contest itself is meaningless regarding the security of its protocol (as others explained in details). Finding bugs such as this deserves 200k more than anything else
- ballard 13y ago
  Offering the contest was shady and stupid enough. Not paying just proves they're chiselers that never intended to pay in the first place. This wins the runner-up award for second most botched PR disaster ever. The consolation prize is a lump of coal.
  - deleted 13y ago
    [deleted]
  - phaus 13y ago
    The contest was stupid and shady, but they did explicitly state the rules. Its not really fair to accuse them of wrongdoing if they don't give this guy $200,000. If I were in charge of telegram, I'd pay the guy the whole amount, but that would just be out of the kindness of my heart. Morally, they aren't obligated to pay just because the rules of their contest are ridiculous.
  - danabramov 13y ago
    They're paying $100 000. https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858
    - ballard 13y ago
      It's too late to matter. But good for him that they're only half crooked.

xytop 13y ago

Yes, outside. Although the underground of this contest was to prove security and inability to read messages by 3rd parties contest was about decrypting Durov's chat. Chat is not decrypted and as many say - it's nearly impossible (http://thoughtcrime.org/blog/telegram-crypto-challenge/ http://thoughtcrime.org/blog/telegram-crypto-challenge/). But "bookmark" is found and it means that all the PR was shit. Telegram already removed 'xor nonce' from their documentation and added a new layer to their api but who knows where they will put a next bookmark. Probably it will be hidden in a deeper place. But trust is already lost. It appears that either their secure protocol was containing the bookmark specially or that protocol is getting written by non-specialists which cant guarantee any security.

xytop 13y ago
old copy of their doc which has 'xor nonce' inside: http://webcache.googleusercontent.com/search?q=cache:FAntx8lsBMQJ:https://core.telegram.org/api/end-to-end+&cd=1&hl=ru&ct=clnk&client=ubuntu http://webcache.googleusercontent.com/search?q=cache:FAntx8l...

MatthewWilkes 13y ago

Their contest was based on a sample packet capture only.