3 ms·

You must not have followed Telegram much. From the beginning they've done nothing but pretend their protocol is absolutely secure ("military-grade encryption",

You must not have followed Telegram much. From the beginning they've done nothing but pretend their protocol is absolutely secure ("military-grade encryption", "world's most secure protocol", etc) and rejected any attempt from the crypto community to help them fix problems before they endanger people. So, let's put it this way: Was it ok of them to lie through their teeth to users? If so, then that's a sad state of marketing. If not, then what are you proposing here?

eps 13y ago
Hey, you forgot to plug TextSecure.
yatsyk 13y ago
I’m not security expert, but I believe that: - military-grade encryption – true - world's most secure protocol – I’d consider this statement as false, I don’t know what they mean by most secure and what protocols were considered. May be messengers available at app store, better to ask them Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition? Why do you think that they lie more then TextSecure advocates? Each of these messengers is safe to passive listening. But unsecure to similar degree if user downloads them from app store and runs on hardware and software that could be easily patched. Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app and that every other app should be thrown out.
- sillysaurus2 13y ago
  Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition? I've written about this pretty extensively: https://www.hnsearch.com/search#request/all&q=by%3Asillysaurus2+textsecure https://www.hnsearch.com/search#request/all&q=by%3Asillysaur... It's an interesting contrast in cultures that you phrase it like "Why do you think Telegram lies more than TextSecure advocates?" .... As far as I'm aware, TextSecure advocates haven't lied at all. TextSecure's interest is in security, whereas Telegram's interest seems to be in money and power. Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app I just don't know what to say to this. Telegram has been proven insecure, TextSecure hasn't. Telegram isn't designed by cryptographers, TextSecure is. There is absolutely every reason to assume Telegram is broken. Each of these messengers is safe to passive listening. This is mistaken because Telegram has been proven vulnerable to MITM attacks. Even after they patch this latest security problem, it would be very unwise to trust them.
  - DanBC 13y ago
    > Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app > I just don't know what to say to this. Telegram has been proven insecure, TextSecure hasn't. Telegram isn't designed by cryptographers, TextSecure is. There is absolutely every reason to assume Telegram is broken. Textsecure is designed by cryptographers, and hasn't been broken yet, but that doesn't mean that it is secure. People need to risk assess when they're using any software. > If you want to be secure from the NSA, use TextSecure [...]. It's really that simple. That claim is far too confidant! If you want to be secure from NSA you need to do many things - have a look at the specifications for buildings that handle secret documents for example, as well as just using a piece of well designed but relatively untested software. Most people do not have nearly enough operational discipline to withstand investigation by well funded government agencies. Merely using this software is not enough.
    - sillysaurus2 13y ago
      > If you want to be secure from the NSA, use TextSecure [...]. It's really that simple. That claim is far too confidant! If you want to be secure from NSA you need to do many things - have a look at the specifications for buildings that handle secret documents for example, as well as just using a piece of well designed but relatively untested software. That's why I removed it 15 seconds after I wrote it. But perhaps it could be downgraded to "if you want to live in a world where it's very difficult for governments to vacuum up all your data by default, then use TextSecure, because it's the first step towards that." Telegram offers no such protection since it's vulnerable to MITM attacks (even after they fix this one).
      - Twirrim 13y ago
        If you rely on a single secure (for certain values of the word 'secure') messaging system or protocol you're absolutely insane. You'd want to be splitting your communication across multiple communication sources, with none of them ever seeing enough data to compromise whatever it is you're worried about. Deep and computationally expensive is great; deep, computationally expensive and broad is better. If one form (e.g. Telegraph) falls they've not got the full message, and they've still got a lot more work to do to get the whole thing.

eps 13y ago

Hey, you forgot to plug TextSecure.

yatsyk 13y ago

I’m not security expert, but I believe that: - military-grade encryption – true - world's most secure protocol – I’d consider this statement as false, I don’t know what they mean by most secure and what protocols were considered. May be messengers available at app store, better to ask them Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition? Why do you think that they lie more then TextSecure advocates? Each of these messengers is safe to passive listening. But unsecure to similar degree if user downloads them from app store and runs on hardware and software that could be easily patched. Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app and that every other app should be thrown out.

sillysaurus2 13y ago
Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition? I've written about this pretty extensively: https://www.hnsearch.com/search#request/all&q=by%3Asillysaurus2+textsecure https://www.hnsearch.com/search#request/all&q=by%3Asillysaur... It's an interesting contrast in cultures that you phrase it like "Why do you think Telegram lies more than TextSecure advocates?" .... As far as I'm aware, TextSecure advocates haven't lied at all. TextSecure's interest is in security, whereas Telegram's interest seems to be in money and power. Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app I just don't know what to say to this. Telegram has been proven insecure, TextSecure hasn't. Telegram isn't designed by cryptographers, TextSecure is. There is absolutely every reason to assume Telegram is broken. Each of these messengers is safe to passive listening. This is mistaken because Telegram has been proven vulnerable to MITM attacks. Even after they patch this latest security problem, it would be very unwise to trust them.
- DanBC 13y ago
  > Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app > I just don't know what to say to this. Telegram has been proven insecure, TextSecure hasn't. Telegram isn't designed by cryptographers, TextSecure is. There is absolutely every reason to assume Telegram is broken. Textsecure is designed by cryptographers, and hasn't been broken yet, but that doesn't mean that it is secure. People need to risk assess when they're using any software. > If you want to be secure from the NSA, use TextSecure [...]. It's really that simple. That claim is far too confidant! If you want to be secure from NSA you need to do many things - have a look at the specifications for buildings that handle secret documents for example, as well as just using a piece of well designed but relatively untested software. Most people do not have nearly enough operational discipline to withstand investigation by well funded government agencies. Merely using this software is not enough.
  - sillysaurus2 13y ago
    > If you want to be secure from the NSA, use TextSecure [...]. It's really that simple. That claim is far too confidant! If you want to be secure from NSA you need to do many things - have a look at the specifications for buildings that handle secret documents for example, as well as just using a piece of well designed but relatively untested software. That's why I removed it 15 seconds after I wrote it. But perhaps it could be downgraded to "if you want to live in a world where it's very difficult for governments to vacuum up all your data by default, then use TextSecure, because it's the first step towards that." Telegram offers no such protection since it's vulnerable to MITM attacks (even after they fix this one).
    - Twirrim 13y ago
      If you rely on a single secure (for certain values of the word 'secure') messaging system or protocol you're absolutely insane. You'd want to be splitting your communication across multiple communication sources, with none of them ever seeing enough data to compromise whatever it is you're worried about. Deep and computationally expensive is great; deep, computationally expensive and broad is better. If one form (e.g. Telegraph) falls they've not got the full message, and they've still got a lot more work to do to get the whole thing.