News for hackers. Stuff that matters.

A comment on Telegram has launched a pretty intense campaign to malign Signal as insecure. Parent comment

Re:Telegram has launched a pretty intense campaign to malign... by danpalmer on Monday May 13, 2024 @08:07AM (#40342366)
It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily.

It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".

[ Parent | on HN ]
Re:Telegram has launched a pretty intense campaign to malign... by kaba0 on Monday May 13, 2024 @09:26AM (#40343102)
It’s insecure if done by your average full stack developer, that barely passed high school math. That’s why the usual mantra. It’s waaay different when done by math experts specialized in this topic, as is the case with telegram.
[ Parent | on HN ]
Re:Telegram has launched a pretty intense campaign to malign... by MatejKafka on Monday May 13, 2024 @07:39PM (#40349878)
Math experts are not necessarily good cryptographers, and authors of MTProto were not renowned cryptographers (unlike with Signal).

Most people in the cryptographic community agree that the Signal protocol is well-designed, is widely believed to be secure, and the authors react openly and swiftly to potential issues. Meanwhile, a lot of the MTProto crypto is just weird (that is, it does not follow standard practices of the field, without strong reasons to do so), and many cryptographers treat it with suspicion.

[ Parent | on HN ]