News for hackers. Stuff that matters.
Re:Poll: Switching from WhatsApp by ryanlol on Thursday January 07, 2021 @10:05AM (#25671841)
Let’s not forget that Telegram backdoored their encrypted chat implementation and got caught.
Re:Poll: Switching from WhatsApp by ffpip on Thursday January 07, 2021 @11:48AM (#25673410)
Link.
Re:Poll: Switching from WhatsApp by coolspot on Thursday January 07, 2021 @02:38PM (#25676141)
Best I can find with keywords “telegram” and “backdoor” is this article: https://socialbarrel.com/telegram-founder-makes-shocking-bac...

Which discusses how Telegram was banned in many countries for refusing cooperation while WhatsApp suspiciously was never banned, which could mean that WhatsApp gives governments everything they demand.

Re:Poll: Switching from WhatsApp by beagle3 on Thursday January 07, 2021 @04:10PM (#25677526)
I suspect the Google/Facebook deal for "free backup of WhatsApp chats on your Google account" is exactly that.

WhatsApp had perfectly usable encrypted backup - which took up space on your Google backup. And then, all of a sudden, it wasn't encrypted and didn't take up space. But you don't have access to it yourself - only Google does (and WhatsApp if it is recovering). This is a perfect way to provide all the data to various governments for 99.9% of users, without killing the E2E encryption.

Re:Poll: Switching from WhatsApp by coolspot on Thursday January 07, 2021 @04:19PM (#25677639)
Same situation with the iCloud backup on Apple iOS, AFAIK.

WhatsApp backup in iCloud is not encrypted.

Re:Poll: Switching from WhatsApp by beagle3 on Friday January 08, 2021 @04:03AM (#25682918)
Is it user accessible at least? The Android backup is not.
Re:Poll: Switching from WhatsApp by bjoli on Friday January 08, 2021 @02:28AM (#25682459)
They didn't backdoor it. It was back in 2013 when they were new. Everyone was going "whoa, your encryption is weird" and they were defending themselves by saying "we have 6 world champion programmers".

Anyways, something like 6 months after launch a Russian guy found that they were seeding their secret chat keys with entropy from the server, meaning the server could trivially MITM any secret chat. Pretty embarrassing.

Iirc it got quite little publicity since most of the discussion was in Russian, and the disclosure was in a forum post in an obscure forum.

Re:Poll: Switching from WhatsApp by ryanlol on Friday January 08, 2021 @03:16PM (#25689832)
If you look at their implementation the balance of probabilities definitely leans heavily towards “backdoor” rather than “not a backdoor”.

You aren’t going to find any cryptographers anywhere who’d be willing to repeat your “They didn’t backdoor it” lie.

If it looks like a backdoor, swims like a backdoor, quacks like a backdoor, then it probably is a backdoor.

Re:Poll: Switching from WhatsApp by ryanlol on Friday January 08, 2021 @03:18PM (#25689858)
https://m.habr.com/ru/post/206900/

FiloSottile described it as “The most backdoor-looking bug I’ve ever seen” https://twitter.com/filosottile/status/987376021589692416?s=...

Re:Poll: Switching from WhatsApp by ffpip on Saturday January 09, 2021 @01:25PM (#25702973)
That was the month telegram launched? It's been 7 years. It was a new app. The same bug is still being used against it?

Do you have any recent bugs? Or 'backdoors'? All their official apps are open source and reproducible. Must be easy to find bugs for security researchers. They even offer much larger bounties compared to other apps.

Anything? I want to believe people saying bad crypto, but it looks like there's no actual proof.

Here's something that says it is good, published more recently.

https://web.archive.org/web/20180727070936/https://www.susan...

https://kryptera.se/assets/uploads/2015/12/Telegram-cryptana...

Re:Poll: Switching from WhatsApp by ryanlol on Sunday January 10, 2021 @12:17PM (#25716845)
It’s really obvious this wasn’t a bug, but a backdoor. It proves that Telegram is an actively hostile adversary, the fact that their encryption scheme hasn’t been publicly broken since then doesn’t change that.

> Or 'backdoors'?

You might argue that their deliberate decision to not encrypt most chats is exactly that, more of a front door really.

Telegram is a bad actor.