TelegramApp

5 ms·

1.
by TelegramApp 11y ago
Yes, it DOES stop showing you as online. If you are not sharing your last seeen/online status with somebody, he will NOT see you online, regardless of the app they are using. There is one exception to this: people will see you online f
2.
by TelegramApp 13y ago
One of the Telegram apps for Android did use Google Maps in http-mode. The issue was fixed within an hour, and the update is on its way to Play Market, containing several other security-related improvements. At this moment we are working to
3.
by TelegramApp 13y ago
> 1. The biggest problem is that the SHA1 digest of a message is not an authenticator of that message, because an attacker can generate the same digest given only the contents of the message. Please note that a message to be encrypted wo
4.
by TelegramApp 13y ago
The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (s
5.
by TelegramApp 13y ago
Kindly take at look at this technical FAQ that we've assebmled based on the conversations on Hacker News and elsewhere: http://core.telegram.org/techfaq
6.
by TelegramApp 13y ago
No. What we mean is, as I've just noted in the reply to tptacek, that so far no attack was named that could harm the setup as described in our docs. And since this setup also delivers the performance that we require in terms of speed,
7.
by TelegramApp 13y ago
Thanks for noticing, we fixed that yesterday.
8.
by TelegramApp 13y ago
> The consensus seems to be that you're doing.. Now, again, could I somehow direct your attention away from speculations and to what we are ACTUALLY doing (as, again, documented here [0], and now here as well [1]). 1. We are not d
9.
by TelegramApp 13y ago
In order to clarify a few points in our setup, we've added this scheme to the protocol description page [0],[1]. We are indeed using well-known older algorithms, created in the days when bandwidth and processing power were both a much
10.
by TelegramApp 13y ago
2. A passing look at the docs would reveal that we do not use IGE that way, and instead use SHA1 for integrity check (see 'message key' here: https://core.telegram.org/mtproto/description ). The problems you m
11.
by TelegramApp 13y ago
We use SHA1 (see 'message key' here: https://core.telegram.org/mtproto/description ). IGE is used instead of CBC.
12.
by TelegramApp 13y ago
This version of the client is using manual padding with random bytes. This isn't too bad, considering the SHA1 presence. (See #4 here: https://core.telegram.org/mtproto/auth_key ) The server now supports OAEP, alth
13.
by TelegramApp 13y ago
In terms of DoS possibilities, one doesn't need to replay old messages, they could just as easily send new ones or random garbage. We could employ additional filtering techniques, but that increases processing time. And since modern ha
14.
by TelegramApp 13y ago
Two questions for you: 1. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know. 2. And what problem
15.
by TelegramApp 13y ago
MTProto still uses RSA, AES + DH. So I would disagree that what we have here means 'compromising security for speed and stability'. It is rather optimizing for speed and stability, while staying secure.
16.
by TelegramApp 13y ago
We have not 'rolled our own crypto'. We still use RSA, AES and DH. I've changed the part in the FAQ that seems to be one of major sources of this controversy, so that it no longer reads "built from scratch". This wa
17.
by TelegramApp 13y ago
That is correct, Telegram does upload names and numbers — naturally, after receiving permission to do so. (see also: http://telegram.org/privacy ) Apart from identifying Telegram users among the user's friends, this als
18.
by TelegramApp 13y ago
Still, there are sometimes valid reasons for not re-using existing solutions. In our case, we needed something that is both secure and competitive in comparison to mass market solutions in terms of speed, working on weak connections and usa
19.
by TelegramApp 13y ago
Private keys for secret chats are only stored on the two participating devices. As for server code — open sourcing the server code wouldn't really do much to improve trust. You would still have to trust us that we are using THAT code,
20.
by TelegramApp 13y ago
Is anything wrong with it?
21.
by TelegramApp 13y ago
The main reason is speed. MTProto is designed to work fast on weak mobile connections. Another reason is security, with HTTPs you need to trust more parties.
22.
by TelegramApp 13y ago
The reason for designing something new was this: in order for really secure messaging to catch on among the masses today — it needs not only be secure. When you want to compete with the likes of WA, you also need be fast and reliable on wea