News for hackers. Stuff that matters.
Re:Et Tu, Signal? by eximius on Wednesday April 07, 2021 @10:21AM (#26725359)
There are no known attacks against Telegram.

The problem is entirely that its cryptography was sketchy and just plain weird to begin with. It wasn't wrong, per se, but raised some eyebrows. And then some of the questionable choices were silently fixed removing the ability to MITM, etc, but with no real notice.

It's not FUD.

Re:Et Tu, Signal? by lxgr on Wednesday April 07, 2021 @01:32PM (#26728067)
> There are no known attacks against Telegram.

Because there isn't anything to meaningfully attack. Chats and chat backups are not encrypted by default.

Re:Et Tu, Signal? by jackbravo on Wednesday April 07, 2021 @11:40AM (#26726492)
and telegram does not used encrypted e2e messages by default. Only on the special secret messages that no ones uses.
Re:Et Tu, Signal? by sascha_sl on Wednesday April 07, 2021 @10:57AM (#26725867)
More than one red flag there, there was the claim of it being secure just because the spec was out there and nobody had broken it yet.
Re:Et Tu, Signal? by vetinari on Wednesday April 07, 2021 @10:43AM (#26725641)
Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD.

Shouldn't we have the same standard for all claims?

Re:Et Tu, Signal? by tablespoon on Wednesday April 07, 2021 @12:00PM (#26726817)
> Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD.

> Shouldn't we have the same standard for all claims?

Huh? Telegram's protocol has been criticized by cryptographers for making specific "odd" cryptographic choices (see See https://crypto.stackexchange.com/questions/31418/signal-vs-t...). It's not FUD to bring that up.

However, it is FUD to imply something concrete based for vague, indirect reasons.

Re:Et Tu, Signal? by xenocratus on Wednesday April 07, 2021 @11:54AM (#26726718)
So you're saying we should have the same standard while literally giving two different types of allegations that are thrown at Signal and Telegram respectively?

We either consider the funding of both and decide how the funding COULD ultimately impact the product, or we could look at the source code of the applications and the cryptographic theory supporting them and talk about that. If crypto experts aren't finding holes in Signal's protocols [1], I don't think random people on the internet yelling "bUt It WaS fUnDeD bY ..." will make it less secure.

[1] https://eprint.iacr.org/2016/1013