5 ms·

http://www.bq.com/gb/game-ubuntu http://www.bq.com/gb/game-ubuntu "Telegram is the most secure way to..." or http://www.bq.com/flexy_templates/game/assets/en/s

http://www.bq.com/gb/game-ubuntu http://www.bq.com/gb/game-ubuntu "Telegram is the most secure way to..." or http://www.bq.com/flexy_templates/game/assets/en/screen-3.png http://www.bq.com/flexy_templates/game/assets/en/screen-3.pn... If you market your phone towards nerds, don't bullshit us with crypto marketing.

0xFFC 12y ago
Would you mind to explain what you are talking about ? I thought telegram are more secure than whats app and etc . I would gladly hear what do you think about these app in general.
- davexunit 12y ago
  Telegram is a proprietary network service, which means that there is no reason to believe that it is secure.
  - talideon 12y ago
    The protocol is published, and the client is open source, but the protocol has a whole bunch of design issues, and that's the real problem with Telegram.
    - davexunit 12y ago
      But the server isn't free software, so it's untrustable, even if the protocol didn't have known design issues.
      - 0xFFC 12y ago
        @davexunit I am really impressed with your seriousness about being Free Software , I liked it.
      - talideon 12y ago
        If the protocol was properly designed, the proprietary nature of the server wouldn't be an issue as we could write a server implementing the protocol too. For instance, I don't have to worry about all of tarsnap being open source, because I know from the way the client is implemented that the server can't do a damned thing to sniff my data. However, due to how much of an awful botch job the protocol is, even if the server was FLOSS, it would still be untrustable.
- talideon 12y ago
  WhatsApp's security improved an awful lot back in November when it got end-to-end encryption. MTProto has... issues. It uses IGE (infinite garble extension, a variation on the accumulated block chaining - ABC - mode of operation) as its mode of operation, which isn't exactly widely used or battle proven and is considered broken. Something like GCM wouldn've been a saner choice. Another issue is that it uses SHA1 for message authentication. Now, the issue isn't so much that they're using SHA1, but that they aren't using a MAC for message authentication. It has other issues, but I have to rush off.

0xFFC 12y ago

Would you mind to explain what you are talking about ? I thought telegram are more secure than whats app and etc . I would gladly hear what do you think about these app in general.

davexunit 12y ago
Telegram is a proprietary network service, which means that there is no reason to believe that it is secure.
- talideon 12y ago
  The protocol is published, and the client is open source, but the protocol has a whole bunch of design issues, and that's the real problem with Telegram.
  - davexunit 12y ago
    But the server isn't free software, so it's untrustable, even if the protocol didn't have known design issues.
    - 0xFFC 12y ago
      @davexunit I am really impressed with your seriousness about being Free Software , I liked it.
    - talideon 12y ago
      If the protocol was properly designed, the proprietary nature of the server wouldn't be an issue as we could write a server implementing the protocol too. For instance, I don't have to worry about all of tarsnap being open source, because I know from the way the client is implemented that the server can't do a damned thing to sniff my data. However, due to how much of an awful botch job the protocol is, even if the server was FLOSS, it would still be untrustable.
talideon 12y ago
WhatsApp's security improved an awful lot back in November when it got end-to-end encryption. MTProto has... issues. It uses IGE (infinite garble extension, a variation on the accumulated block chaining - ABC - mode of operation) as its mode of operation, which isn't exactly widely used or battle proven and is considered broken. Something like GCM wouldn've been a saner choice. Another issue is that it uses SHA1 for message authentication. Now, the issue isn't so much that they're using SHA1, but that they aren't using a MAC for message authentication. It has other issues, but I have to rush off.