4 ms·

The problem is that if the authors had actually consulted crypto guys, none of this would have happened. Their lack of security shouldn't be excused.

by daeken 13y ago

GigabyteCoin 13y ago
The author of the hack himself declares at the very bottom of the article: "An expert in cryptography [I] am not, please correct [me] if I'm wrong." How embarassing for telegram if what he says is true. This excerpt was taken from the google translate version of the article.
jalada 13y ago
Yeah you're right, the 'crypto guys' would've probably just said "Don't even try it because you'll kill people and even we wouldn't want to try and do it". Crypto is hard to get right, that doesn't mean anyone shouldn't even bother trying.
- jbri 13y ago
  If you want to build new crypto, people would be absolutely happy for you to design and present a new cryptographic scheme - hopefully with some advantages over existing ones. People will analyze it, tell you where the weaknesses are, and if they're not critical flaws you can fix them and come out stronger - and if they are critical flaws, you know your scheme is broken before it's been used for anything important. Likewise, building a hot new secure messaging app with existing well-analyzed, battle-tested cryptographic schemes is generally going to be welcomed. If you try to do both at once, you're building your application on shaky, untested cryptographical foundations. Cryptographers would similarly probably warn you not to base your application on a new cipher someone else announced at a cryptography conference last week - give it a bit of time for others to analyze it and spot any flaws it might have before you entrust anything sensitive to it.
- Morgawr 13y ago
  You're welcome "try" crypto, like everybody else is. Just don't go market your product as "the most secure" encryption ever when you don't even bother to put it to the test beforehand and get it reviewed by actual experts. I could go and try to play around with real time systems for flying planes, it still wouldn't make sense for me to sell you the "safest" plane in the world without going through the proper steps to get such system certified beforehand.

The problem is that if the authors had actually consulted crypto guys, none of this would have happened. Their lack of security shouldn't be excused.

by daeken 13y ago

The problem is that if the authors had actually consulted crypto guys, none of this would have happened. Their lack of security shouldn't be excused.

GigabyteCoin 13y ago

The author of the hack himself declares at the very bottom of the article: "An expert in cryptography [I] am not, please correct [me] if I'm wrong." How embarassing for telegram if what he says is true. This excerpt was taken from the google translate version of the article.

jalada 13y ago

Yeah you're right, the 'crypto guys' would've probably just said "Don't even try it because you'll kill people and even we wouldn't want to try and do it". Crypto is hard to get right, that doesn't mean anyone shouldn't even bother trying.

jbri 13y ago
If you want to build new crypto, people would be absolutely happy for you to design and present a new cryptographic scheme - hopefully with some advantages over existing ones. People will analyze it, tell you where the weaknesses are, and if they're not critical flaws you can fix them and come out stronger - and if they are critical flaws, you know your scheme is broken before it's been used for anything important. Likewise, building a hot new secure messaging app with existing well-analyzed, battle-tested cryptographic schemes is generally going to be welcomed. If you try to do both at once, you're building your application on shaky, untested cryptographical foundations. Cryptographers would similarly probably warn you not to base your application on a new cipher someone else announced at a cryptography conference last week - give it a bit of time for others to analyze it and spot any flaws it might have before you entrust anything sensitive to it.
Morgawr 13y ago
You're welcome "try" crypto, like everybody else is. Just don't go market your product as "the most secure" encryption ever when you don't even bother to put it to the test beforehand and get it reviewed by actual experts. I could go and try to play around with real time systems for flying planes, it still wouldn't make sense for me to sell you the "safest" plane in the world without going through the proper steps to get such system certified beforehand.