6 ms·

What's wrong with Telegram?

by cynic_ 11y ago

lloeki 11y ago
Back in the day, one of the main arguments were that they're "rolling their own crypto", although I don't know how it stands today[0]. [0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-custom-protocol https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
deleted 11y ago
[deleted]
- deleted 11y ago
  [deleted]
darklajid 11y ago
Arguments as far as I'm aware (please correct me where I'm wrong): - Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven - End to end encryption isn't the default
- SideburnsOfDoom 11y ago
  I'm looking at this: https://core.telegram.org/techfaq#q-why-are-you-mostly-relying-on-classical-crypto-algorithms https://core.telegram.org/techfaq#q-why-are-you-mostly-relyi... While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems. So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
  - Nursie 11y ago
    So to me a 'cryptosystem' is the way the elements are combined. Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem. Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either. Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
    - SideburnsOfDoom 11y ago
      You're right; that was poor wording. At the link they talk the "crypto algorithms" not cryptosystems that they combine.
- Aoyagi 11y ago
  That's wrong in comparison to Viber/WhatsApp/Skype or just in general?
Nursie 11y ago
>> What's wrong with Telegram? "Hey look! We invented this novel cryptosystem and, despite it being unproven and not having it validated by anyone, we reckon it's the most secure thing ever!"
- e12e 11y ago
  Added to that: why don't the just build on XMPP? Why lock users to their servers?

What's wrong with Telegram?

by cynic_ 11y ago

What's wrong with Telegram?

Back in the day, one of the main arguments were that they're "rolling their own crypto", although I don't know how it stands today[0]. [0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-custom-protocol https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...

deleted 11y ago

[deleted]

deleted 11y ago
[deleted]

darklajid 11y ago

Arguments as far as I'm aware (please correct me where I'm wrong): - Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven - End to end encryption isn't the default

SideburnsOfDoom 11y ago
I'm looking at this: https://core.telegram.org/techfaq#q-why-are-you-mostly-relying-on-classical-crypto-algorithms https://core.telegram.org/techfaq#q-why-are-you-mostly-relyi... While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems. So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
- Nursie 11y ago
  So to me a 'cryptosystem' is the way the elements are combined. Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem. Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either. Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
  - SideburnsOfDoom 11y ago
    You're right; that was poor wording. At the link they talk the "crypto algorithms" not cryptosystems that they combine.
Aoyagi 11y ago
That's wrong in comparison to Viber/WhatsApp/Skype or just in general?

Nursie 11y ago

>> What's wrong with Telegram? "Hey look! We invented this novel cryptosystem and, despite it being unproven and not having it validated by anyone, we reckon it's the most secure thing ever!"

e12e 11y ago
Added to that: why don't the just build on XMPP? Why lock users to their servers?