News for hackers. Stuff that matters.
Re:A Formal Security Analysis of the Signal Messaging Protocol by moyta on Tuesday November 08, 2016 @09:26AM (#12900435)
Eh, Telegram looks more insecure [1] AFAICT. Sure, Signal will not stand up to high threat models due to hardware failings (backdoored baseband RTOS, missing dual backup RTC batteries for secure boot) and software failings (insecure Android), about the only thing designed to be attacked like that is a terminal like a Pax S80 or a Verifone VX520 and they do a bunch of fun stuff with magnetic tamper sensors, conductive wires that tear on opening, heat sensors, etc.

Then again, that isn't the threat model Signal is designed for, and if you are looking to protect against that type of threat model you could totally design hardware to support it for not too much (see Blackphone) and throw Replicant on there (with some development of course). Then, if it were Signal vs Telegram, the latter would likely be your security weakness.

[1] - http://security.stackexchange.com/questions/130559/is-telegr...

Re:A Formal Security Analysis of the Signal Messaging Protocol by tptacek on Tuesday November 08, 2016 @10:24AM (#12900930)
Not only is Telegram far less secure --- even when its opt-in(!) end-to-end messaging is enabled --- than Signal, but Reuters has reported that Iran has exploited some of its faults to hijack accounts and track activists. Don't use Telegram.
[dead]
Re:A Formal Security Analysis of the Signal Messaging Protocol by tptacek on Tuesday November 08, 2016 @11:34AM (#12901599)
You should be embarrassed to be repeating these falsehoods on this thread.
Re:A Formal Security Analysis of the Signal Messaging Protocol by Dolores12 on Tuesday November 08, 2016 @12:30PM (#12902162)
your falsehood claims are no better, Joe. telegram puts their money where their claims are. and you cite reuters as reputable source. just wow.
Re:A Formal Security Analysis of the Signal Messaging Protocol by def_true_false on Tuesday November 08, 2016 @05:55PM (#12904683)
Yeah, using GCM to wake up the device is totally worse than sending 99% messages without end-to-end encryption.

What's wrong with Reuters? Would you prefer RT?

Re:A Formal Security Analysis of the Signal Messaging Protocol by Dolores12 on Tuesday November 08, 2016 @10:49AM (#12901154)
So Iran can claim 300k award for breaking telegram crypto, can it?
Re:A Formal Security Analysis of the Signal Messaging Protocol by MrMullen on Tuesday November 08, 2016 @12:45PM (#12902301)
That reward is bullshit. Their requirements are so strict that no one could defeat it. If they did that same challenge in Iran, Iran would win the challenge and the reward.
Re:A Formal Security Analysis of the Signal Messaging Protocol by Dolores12 on Tuesday November 08, 2016 @12:53PM (#12902380)
Re:A Formal Security Analysis of the Signal Messaging Protocol by MrMullen on Tuesday November 08, 2016 @03:14PM (#12903538)
Re:A Formal Security Analysis of the Signal Messaging Protocol by Dolores12 on Tuesday November 08, 2016 @11:45PM (#12906107)
How does it relate to 300k contest i am talking about?
Re:A Formal Security Analysis of the Signal Messaging Protocol by antocv on Tuesday November 08, 2016 @10:51AM (#12901164)
Signal is providing usage data to Google, it is not anonymous, the messages sent are available for Google to decrypt at wish.

Telegram is open to Russian version of NSA, and the company that made it.

For me and you both, it doesnt matter, unless you work for NSA.

Re:A Formal Security Analysis of the Signal Messaging Protocol by def_true_false on Tuesday November 08, 2016 @05:59PM (#12904708)
Re:A Formal Security Analysis of the Signal Messaging Protocol by antocv on Wednesday November 09, 2016 @03:27AM (#12907779)
I didnt mean the messages are available to decrypt, that messages would hit GCM or that encryption methods are flawed or anything like that.

More like, Google has root on your phone so it can steal your private keys any time.