News for hackers. Stuff that matters.
Re:TDLib – Build Your Own Telegram Client by lloeki on Thursday February 01, 2018 @06:02AM (#16280966)
While I am wary of "build-your-own-crypto", saying it has a poor security record is, to my knowledge so far, incorrect. I have yet to see satisfactory cryptanalysis that shows a weakness (theoretical or real) in the protocol. If anything, it seems to withstand scrutiny so far. Even the dedicated security.se.com question[0] seems like it wraps itself in tautologies.

Until then, throwing the "homegrown encryption" argument to argue for Telegram's weakness is hand-waving and a straw man.

Telegram's security is sufficient for the threat model I have to face against now and in the future.

[0]: https://security.stackexchange.com/questions/49782/is-telegr...

Re:TDLib – Build Your Own Telegram Client by bjoli on Thursday February 01, 2018 @11:14AM (#16282968)
Well, to me the whole thing is about a couple of things:

When Telegram first launched, people were reading their crypto whitepaper and going "Whoa, this is weird. You should probably not be doing it like this", and the reply was "Well, our 6 world champion coders (did you win a coding world championship?) think it is nice. Deal with it".

They then launched a bullshit crypto challenge (which would have been secure even using crypto primitives we _know_ are insecure). People told them that wasn't how it was done. They replied something cocky about world champion coders.

A couple of months later, someone found an gaping hole where the server could MITM every newly started secret chat (which their hack for forward secrecy a couple of years later would have made possible for every 100 messages).

I think their attitude towards encrypted messaging hasn't left puberty yet, and I recommend against it for everyone looking for a secure messenger. For anyone looking for a more convenient whatsapp without caring much for privacy by default, I don't mind recommending Telegram.

Regarding your future threat model: I certainly can't say whether having a copy of a significant chunk of my private communication on a server in Russia is a future threat to me. On the other hand, I don't use any social media, and have proper data retention policies on most of my online communications.

Re:TDLib – Build Your Own Telegram Client by ComodoHacker on Thursday February 01, 2018 @07:45PM (#16287373)
>having a copy of a significant chunk of my private communication on a server in Russia

To be fair, Telegram doesn't have servers in Russia.

Re:TDLib – Build Your Own Telegram Client by saurik on Thursday February 01, 2018 @07:04AM (#16281246)
FWIW, four years ago, the HN zeitgeist considered the cryptography blunders made by Telegram, when conbined with their hubris over how their protocol was clearly perfect, a death knell for the company from which they would never recover.

https://news.ycombinator.com/item?id=6948742

Re:TDLib – Build Your Own Telegram Client by morganvachon on Thursday February 01, 2018 @07:23AM (#16281339)
Indeed, I've been attacked and modded to oblivion on here for mentioning that I use Telegram, and the scope wasn't even security related, just an alternative to email for sending non-sensitive photos.

I've found Telegram to be more than good enough for day to day communications where I would previously have used email or SMS/MMS.

Re:TDLib – Build Your Own Telegram Client by andrepd on Thursday February 01, 2018 @07:37AM (#16281411)
So is Signal and at least that is secure.
Re:TDLib – Build Your Own Telegram Client by morganvachon on Thursday February 01, 2018 @07:45AM (#16281449)
And once again, if I need that kind of security I'll seek it out. Telegram is more secure than email and SMS, and more convenient for my use case.
Re:TDLib – Build Your Own Telegram Client by jamesb93 on Thursday February 01, 2018 @03:45PM (#16285688)
Signal is not feature rich and harder to get people to use. It also lacks the desktop/laptop integration.
Re:TDLib – Build Your Own Telegram Client by nkristoffersen on Friday February 02, 2018 @05:18AM (#16289586)
Signal has desktop apps now https://signal.org/download/
Re:TDLib – Build Your Own Telegram Client by cosarara97 on Friday February 02, 2018 @11:10AM (#16291628)
How do they compare to the telegram desktop client? Are they electron apps?
Re:TDLib – Build Your Own Telegram Client by mashedvikings on Thursday February 01, 2018 @06:04PM (#16286799)
Telegram is exactly as secure as email. SSL where third party email servers can see your traffic.
Re:TDLib – Build Your Own Telegram Client by codedokode on Thursday February 01, 2018 @04:13PM (#16285953)
Signal requires to provide a phone number (read: disclose your identity to US Government) to use it.
Re:TDLib – Build Your Own Telegram Client by andrepd on Friday February 02, 2018 @08:18AM (#16290286)
I'm not a US citizen. And there is such a thing as prepaid phones, at least where I'm living.
Re:TDLib – Build Your Own Telegram Client by jhasse on Thursday February 01, 2018 @10:45AM (#16282639)
Signal is missing too many convenient features though, e.g. editing messages.
Re:TDLib – Build Your Own Telegram Client by 24gttghh on Thursday February 01, 2018 @11:09AM (#16282916)
Why should one be able to edit a message after it is sent in a text-chat app?
Re:TDLib – Build Your Own Telegram Client by f2n on Thursday February 01, 2018 @11:32AM (#16283156)
Because one is human and one mistypes...

I'm normally on the Signal side of this argument, Telegram is trash and should not be used, but basic features like message editing are legitimate requests. I use Signal heavily and a number of times a day at least I or someone I'm chatting with corrects a previous poorly phrased or incorrectly typed messages. Because Signal has no mechanism for that, it usually involves retyping most of the message or the relevant word and adding an asterisk. I believe if Signal had built-in message editing support it would be used far more than I currently see corrections.

To be clear, I would expect Signal to allow me to see previous versions of a message and clearly indicate that it's been changed, but message editing is a valid feature that Signal should absolutely implement.

Re:TDLib – Build Your Own Telegram Client by 24gttghh on Thursday February 01, 2018 @02:13PM (#16284826)
I've been retyping the offending word and adding * since I started using chat programs 20 years ago, and in every program since...I would think allowing messages to be edited after the fact would allow more problems than solving simple grammar or spelling mistakes most people can think around anyways.
Re:TDLib – Build Your Own Telegram Client by f2n on Thursday February 01, 2018 @07:18PM (#16287218)
I'd imagine I would have thought the same thing before I actively used a messaging tool that supports message editing (I use Slack for work)

Further, the goal of Signal is not to work well for people who are accustomed to the various quirks of text-based communications that have existed since forever, but to provide a secure, modern communication client that normies don't find difficult to use. Message editing has become a standard feature of any usable modern messaging client.

Re:TDLib – Build Your Own Telegram Client by andrepd on Friday February 02, 2018 @08:19AM (#16290294)
I don't think I ever used a message service that allows you to edit messages.
Re:TDLib – Build Your Own Telegram Client by jhasse on Thursday February 01, 2018 @06:06PM (#16286819)
I thought so, too. But after using Telegram for 3 years as my main messenger: No, it really is very convenient.
Re:TDLib – Build Your Own Telegram Client by sangnoir on Thursday February 01, 2018 @11:50AM (#16283336)
Because people make (sometimes embarrassing) mistakes all the time. These circumstances can be saved if recipient hasn't read the message, and if they already have, can have a face-saving effect.
Re:TDLib – Build Your Own Telegram Client by 24gttghh on Thursday February 01, 2018 @02:17PM (#16284871)
Embrace the mistakes and have a laugh!
Re:TDLib – Build Your Own Telegram Client by JensRex on Thursday February 01, 2018 @02:22PM (#16284926)
And a desktop app that isn't Electron trash.
Re:TDLib – Build Your Own Telegram Client by mashedvikings on Thursday February 01, 2018 @06:02PM (#16286789)
"I have yet to see satisfactory cryptanalysis that shows a weakness (theoretical or real) in the protocol":

https://eprint.iacr.org/2015/1177.pdf