[dead]
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by dijit on Sunday July 18, 2021 @07:13PM
(#27877564)
> I'd use native Signal desktop client written on Rust if there was an option. But there isn't, thus I'm using the Electron app.
I’m not going to say anything else other than that this is exactly what Signal wants. They are actively hostile towards efforts to make third-party clients.
You can argue that this is for security reasons, and maybe I’d buy that.
But I would also bring up the fact that they implicitly control both ends in a binary distributed or web(thus- backdoorable) fashion most of the time. I’m not saying they do that, but since they have control of the clients, the servers and the protocol it is not impossible.
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by maqp on Sunday July 18, 2021 @08:23PM
(#27877982)
Reproducible builds help here. Not all clients are supported yet I give you that, but perhaps you can see how far injecting backdoored clients on mass scale is from "user's sending plaintext copy to server every time". Both achieve the same thing, one will fill the headline of every news paper in the world if it happens once, the other happens right now, billions of times a day, and nobody cares. There's no perfect verification process, but there's a metric fuckton of low hanging fruits we need to address first.
It doesn't have anything to do with the competition being unable to provide a fast _native client_ that I can use. I dislike web based apps, and I refuse to use them whenever a native alternative is available.
> It's fast because it's insecure. Would they deploy end-to-end encryption for their groups, it would be as slow as the competition.
Doubtful - it would increase the amount of compute required on their side, sure, but if done properly it will have close to 0 impact on the end users in terms of latency.
> Mark Zuckerberg of Russia who will take zero responsibility if his servers are hacked.
As opposed to _x_ from country _y_ that WILL take responsibility if their servers are hacked? Please.
I will continue to talk about what I like about the user interface and what it does better than the competition because I want to.