Cryptographers unearth vulnerabilities in Telegram's encryption protocol

Re:Cryptographers unearth vulnerabilities in Telegram's encr... by c7DJTLrn on Sunday July 18, 2021 @01:10PM (#27874583)

When you really think about it, almost nobody can be sure that their conversations are end-to-end encrypted. The only way you can be is to verify the fingerprint on both ends, provided you have exchanged fingerprints over a medium known to be secure or in person. Nobody does that.

[ Parent | on HN ]

Re:Cryptographers unearth vulnerabilities in Telegram's encr... by maqp on Sunday July 18, 2021 @03:36PM (#27875912)

You make this idiotic assumption that chat companies are MITM attacking users. Sure, the only way to be sure there is no MITM is to check the fingerprints. But that's aching to false dichotomy. You're not actually choosing between

1. 100% verified E2EE chat and

2. 100% MITM attacked insecure chat

When you don't check the fingerprints, when you are choosing between E2EE and client-server encryption, you're actually choosing between

1. Chat vendor having to commit felony with mandatory minimum sentences, to read your messages

2. You voluntarily sending EVERY SINGLE MESSAGE to the vendor without any expectation of privacy, and thus waving your legal right to privacy.

So no, opportunistic end-to-end encryption is definitely not equivalent to cloud encryption.

Sure, if your personal threat model is that there must be zero chance of some messages ending in wrong hands (maybe you're a lawyer sending private info to client, or naughty pics to your SO), then sure, you will want to perform the fingerprint check. But for majority of communication, it's enough that there is a significant threat of users verifying the fingerprints: Getting caught doing MITM against users is extremely damaging for the company, and again, will land you jail time with very high probability.

[ Parent | on HN ]

Re:Cryptographers unearth vulnerabilities in Telegram's encr... by strogonoff on Tuesday July 20, 2021 @04:50PM (#27899140)

I'm surprised this one even needs to be spelled out. If it turns out WhatsApp/FB have access to message contents, they will be liable. Telegram conveniently (for itself) makes that only the case if a setting is changed.

This wouldn’t matter if people gave up arguing Telegram is secure and agreed that it’s just more convenient, but this in fact is a security-related thread.

[ Parent | on HN ]

Re:Cryptographers unearth vulnerabilities in Telegram's encr... by strogonoff on Sunday July 18, 2021 @01:40PM (#27874799)

It’s verifiable, though.

[ Parent | on HN ]