Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by MikusR on Sunday July 18, 2021 @07:07PM
(#27877519)
Signal just spent a year being closed source.
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by decrypt on Monday July 19, 2021 @03:12PM
(#27886229)
This is an incorrect take. It's true that Signal's server code had not been updated for many months, but that doesn't have an effect on security as messages are end-to-end encrypted locally on the clients/apps. The client/app code had been consistently updated during this period.
Signal responded to the server code being outdated as well: https://github.com/signalapp/Signal-Android/issues/11101#iss...
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by einpoklum on Sunday July 18, 2021 @06:52PM
(#27877410)
But Signal won't allow federation and is hostile to independent client development.
Also, what about the server source code?
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by maqp on Sunday July 18, 2021 @07:10PM
(#27877538)
Signal choosing not to federate isn't in the scope of this thread. IMO not federating is a guarantee of client quality. The last time I had a look at Matrix E2EE implementations, only Riot was barely usable. There was a ton of clients that didn't support it, didn't intend to, didn't have the confidence to go about implementing etc.
>Also, what about the server source code?
https://github.com/signalapp/Signal-Server There you go, last commit two days ago.
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by tffgg on Monday July 19, 2021 @02:21AM
(#27879786)
It's not a quality guarantee for clients in practice since you can't control Client Side with open source
Regarding Riot, which is called Element by now, you may want to update your knowledge
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by maqp on Monday July 19, 2021 @10:45AM
(#27883213)
Yeah I'm familiar with Riot being called Element now, and you don't need to look further than this chat for me to state that.
"It's not a quality guarantee for clients in practice since you can't control Client Side with open source"
What? Open source native client with reproducible builds is literally the gold standard of individual control over software, it's even GPL licenced.
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by int_19h on Monday July 19, 2021 @01:23AM
(#27879538)
> IMO not federating is a guarantee of client quality.
That's not how it worked out for email long-term; why should IM be any different?
Re:Cryptographers unearth vulnerabilities in Telegram's encr...
by Siira on Monday July 19, 2021 @06:20PM
(#27887962)
I know Telegram’s default is to give all the data to the server. But being honest about this makes them able to provide significant UX benefits. Backdoored E2E gives a false sense of security, and, backdoored or not, E2E’s UX sucks. (Also note that the backdoor/malware could be on any level of the stack; From WhatsApp’s plaintext backups, to NSO’s zero days.)
You can check e.g. Signal is not backdoored by reading the source code. You can find it here https://github.com/signalapp/
You can vefify the client you downloaded from Play Store hasn't been tampered with. Instructions for that are here: https://github.com/signalapp/Signal-Android/tree/master/repr...
Your post is slightly ironic, considering Telegram doesn't give you any choice on using E2EE for groups or any chats for that matter, on majority of desktop clients. Know this: when you're not using end-to-end encryption, i.e. when you're using Telegram cloud chats, those chats are by definition as private as a backdoored E2EE chat would be. So one could argue they are front-doored by design.