News for hackers. Stuff that matters.
Re:Reverse Engineering WhatsApp Web by lxglv on Monday April 09, 2018 @11:40AM (#16793950)
Out of curiosity: I’ve noticed a long-term sceptical attitude to telegram in HN audience and have seen multiple arguments against it. Something like that their crypto can’t be trusted, that it’s not time-proven. Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted? No intention to start any flame against Signal, only curiosity regarding telegram flaws. Personal point of view is also appreciated.
Re:Reverse Engineering WhatsApp Web by Analemma_ on Monday April 09, 2018 @01:53PM (#16795256)
> Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted?

People like tptacek have talked here at length about why Telegram is not trustworthy, you can see a history of his comments with a simple search: https://hn.algolia.com/?query=tptacek%20telegram&sort=byPopu.... Moxie Marlinspike has also pointed out a bunch of problems with Telegram, and even if you don't consider him a trustworthy source because he runs a competing service, the technical reasoning behind his opinions is sound.

If you want a personal POV, here are three reasons why Telegram is a bad idea:

1) The large number of unsound technical decisions. See Thomas and Moxie's many comments for details, or the "Security" section on its Wikipedia page.

2) Within days of launching, they had a critical security vulnerability: https://news.ycombinator.com/item?id=6948742. Frankly, this alone should have discredited them forever, especially considering how much boasting they were doing beforehand, but people are stupid.

3) They have a consistent pattern of responding to criticism not with technical defenses, but with ad hominem attacks and conspiracy theories ("You're paid by the US Government!")

Re:Reverse Engineering WhatsApp Web by gsich on Monday April 09, 2018 @08:13PM (#16798055)
Some years ago all you needed for Whatsapp was the phone number and MAC address to login and view all messages. Nobody gives a shit about this today. Should have discredited WA forever too.
Re:Reverse Engineering WhatsApp Web by soziawa on Monday April 09, 2018 @11:42AM (#16793972)
It's not even end to end encrypted by default. That's the main reason why you shouldn't use it.
Re:Reverse Engineering WhatsApp Web by StudentStuff on Monday April 09, 2018 @11:54AM (#16794082)
This right here, how can such a basic step to protect your users be skipped?
Re:Reverse Engineering WhatsApp Web by eitland on Monday April 09, 2018 @02:10PM (#16795420)
Same way as in email, banking etc?

Also I find it puzzling that so many people here keeps on recommending WhatsApp over Telegram after all the lies from WhatsApps owner.

Edit: While I have no way to verify this, AFAIK both Telegram and Gmail stores data and keys in ways that makes them hard to access by everyone except for the user.

Telegram in particular say they do this by storing data and keys in different datacenters in different jurisdictions.

Add to this that WhatsApp has had their fair share of issues as well before they started working with Moxie.

Re:Reverse Engineering WhatsApp Web by lozenge on Monday April 09, 2018 @01:50PM (#16795219)
They rolled their own crypto. Just Google "telegram security" and you'll find explanations of why that's a red flag.
Re:Reverse Engineering WhatsApp Web by pmlnr on Monday April 09, 2018 @04:04PM (#16796482)
Someone has to roll new crypto, otherwise we're stuck. That said, I know about the potential issues with Telegram's encryption.
Re:Reverse Engineering WhatsApp Web by alien1993 on Monday April 09, 2018 @04:31PM (#16796713)
You don't roll a new crypto and use it the day after, it must be tested for vulnerabilities, reviewed by expert cryptoanalysts.

It can take years, much like a car has to be crash tested, a new crypto algorithm must go through a certain process to be considered good enough.

Re:Reverse Engineering WhatsApp Web by eitland on Tuesday April 10, 2018 @09:58AM (#16801377)
AFAIK WhatsApps crypto isn't too old either but that doesn't seem to prevent HNs resident cryptospecialists from recommending it.

That said: I belive them when they say that WhatsApps crypto is stronger.

On the other hand I would expect them to leave a little note somewhere about WhatsApp being a data collection tool for Facebook that also still happens to works as an instant messaging platform.

Re:Reverse Engineering WhatsApp Web by gsich on Monday April 09, 2018 @08:08PM (#16798036)
Any flaws in Telegrams crypto that lead to decryption?
Re:Reverse Engineering WhatsApp Web by StavrosK on Monday April 09, 2018 @08:11PM (#16798046)
None discovered yet, just like my new design, this cardboard box on wheels I'd like to offer you as a replacement for your car.
Re:Reverse Engineering WhatsApp Web by gsich on Tuesday April 10, 2018 @03:07AM (#16799598)
Car comparisons aren't viable.
Re:Reverse Engineering WhatsApp Web by raarts on Monday April 09, 2018 @01:46PM (#16795190)
It's Russian. You know, like: hand over the encryption keys or you, or someone you love will disappear.
Re:Reverse Engineering WhatsApp Web by kirillseva on Monday April 09, 2018 @08:32PM (#16798136)
Telegram is actually fighting the Russian government over the encryption keys, saying that it is impossible to hand them over (I assume this is for e2e encrypted secret chats). The consequence of this action is that they'll likely get banned (i.e. removed from app store). How much of this is a farce remains to be seen, since the whole nation, from casual users to small businesses to government employees use the app daily.

As a Russian, I do appreciate the fear that the "russki" brand instills in your soul, but I think you are rightly being downvoted for jumping to conclusions simply based on nationality.

Re:Reverse Engineering WhatsApp Web by raarts on Tuesday April 10, 2018 @07:44AM (#16800597)
I too appreciate nationalist sentiment, but the parent clearly stated: 'personal opinions also appreciated'.

But to be clear: I have a lot of distrust against governments regarding mass surveillance. But I distrust some governments more than others. And Russia is relatively high on that list for me. I think a healthy dose of distrust would be fitting for Russians citizens too.