News for hackers. Stuff that matters.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by smt88 on Sunday August 25, 2024 @12:57PM (#41348925)
> He refuses to implement backdoors as well.

We have no way to know this, and (unlike Signal), Telegram doesn't give us best-effort assurances by doing things like open-sourcing its code.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by BeetleB on Sunday August 25, 2024 @01:11PM (#41349083)
> We have no way to know this

Well, other than his arrest ;-)

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by pakyr on Sunday August 25, 2024 @01:45PM (#41349419)
The arrest tells us that he said no to one country, it doesn't say much about all the others.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by smt88 on Sunday August 25, 2024 @02:53PM (#41350100)
Russian govt officials are protesting his arrest.

When an authoritarian govt is calling for the release of someone who runs a "private" messenger, it suggests they have a back door. Otherwise they tend to oppose all private messaging.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by kombine on Sunday August 25, 2024 @03:02PM (#41350197)
No, there is no logical link between the two events. Russian govt can protest that for propaganda reasons: to make a point that Western governments are restricting freedom of speech.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by sweeter on Sunday August 25, 2024 @03:20PM (#41350379)
They're hitting that Uno Reverse card. Tbf, the US does a LOT of the stuff that we openly criticize Russia and China for. Which, I would hope that people have enough insight to recognize that this is a bad thing across the board. The only people who get hurt and face consequences from this kind of a thing are the citizens.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by averageRoyalty on Sunday August 25, 2024 @05:40PM (#41351708)
This is a key perspective people fail to take into account. We've been conditioned by movies, books etc to think everyone fits into these black and white "good and bad" categories.

Most western countries do horrific things we do not find acceptable, but when we do find out we hand wave it away because they're the "good guys".

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by azinman2 on Sunday August 25, 2024 @05:55PM (#41351809)
Can always count on HN for whataboutism.

Good thing it’s legal to say so in the countries that dominate its user base.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Nuzzerino on Monday August 26, 2024 @06:12AM (#41355655)
They don't tend to care until large enough quantities of people start listening despite whatever filters (i.e. de-ranking social media posts) and countermeasures (i.e. cable news assets) are put in place before it gets to that point. Then they very likely have the ability to label it as misinformation and find a legal reason to prosecute under a number of broad categories: https://www.thefederalcriminalattorneys.com/false-informatio...

It came very close to this during Covid, and maybe once or twice since then.

You're free to say what you want, and everyone is free to ignore you if what you say doesn't jive with "common sense".

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by kennedywm on Sunday August 25, 2024 @04:37PM (#41351169)
No. What would be illogical is to assume that because Russia might be motivated to protest for the sake of propaganda, that it is not also, or instead, motivated by not wanting to lose access to a hypothetical backdoor.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by miohtama on Sunday August 25, 2024 @06:23PM (#41352020)
Durov was robbed from his previous startup at a gunpoint by Putin’s thugs, and then he had to escape, so it is unlikely Durov co-operates with Russia:

https://x.com/moo9000/status/1827651335476461813

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by JetSpiegel on Sunday August 25, 2024 @07:32PM (#41352491)
https://twitter.com/AmbRusFrance/status/1827628382617481284

Well the embassy is complaining about this arrest, so maybe that's just counter-intelligence.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by redthnb on Sunday August 25, 2024 @08:40PM (#41352843)
That's just the half of the story and Pavel isn't an innocent victim
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by petre on Monday August 26, 2024 @12:14AM (#41353962)
So what's the full story then?
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by dawnerd on Sunday August 25, 2024 @03:27PM (#41350456)
Russia was also using it for “secret” chats and are probably terrified what could be exposed.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Nux on Sunday August 25, 2024 @05:10PM (#41351464)
Or they want to make it seem as such..
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by squarefoot on Sunday August 25, 2024 @03:18PM (#41350364)
I don't completely buy the fact that he was arrested because he didn't cooperate with authorities. World Police forces have an history of infiltrating criminal groups and gaining their trust; planting backdoors isn't the only way they can investigate people. Also, this way they're yelling loud to these people "hurry! pick another platform!".

And then, he is also on Putin's wanted list; his arrest could one day turn him into a valuable bargaining chip.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by HumblyTossed on Sunday August 25, 2024 @02:06PM (#41349614)
What exactly do you think this tells you?
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by mihaaly on Sunday August 25, 2024 @05:58PM (#41351831)
I did not see in the list the 'did not allow us adding backdoor to their service' charge. Did I miss something?
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by miohtama on Sunday August 25, 2024 @06:21PM (#41352011)
This is one of the charges (according to French press): refusing to give French police unfettered access to Telegram user data and moderation.

It’s French national law, not EU (though the EU will copy for sure).

https://www.lawfaremedia.org/article/whats-going-frances-onl...

Also now they have added “because people watch football matches illegally on Telegram”. So they are going to throw everything at kitchen sink at Durov, probably also national security issues because anti-French political groups use Telegram in Africa.

https://x.com/ChrisO_wiki/status/1827767824858931319

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by mihaaly on Monday August 26, 2024 @06:42AM (#41355838)
It is still not backdoor, sorry, you are completely mistaken. They came - tried to come - in the front door openly (the expression of back door means completely different, just look it up and you will see) to catch criminals, doing well known and prominent criminal activity, but the Telegram decided to protect the criminals instead. You can try to smear in whatever imaginative reasons behind when the reason are in the front of your face, like it or not, it does not matter if you like it or not! Also how much people like the Telegram because 'it is soo user friendly and pretty', not in pair with serious crimes committed and aided there, completely not!

Also it is still the investigative phase but the suspicion is warranted completely.

I seriously do not understand low moral people shielding those helping criminals, do you really not knowing what are you doing, seriously, just because there is a - misleadingly presented - popular service there? Really? Very worrying the moral state of social media user masses.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by hcfman on Monday August 26, 2024 @07:53AM (#41356266)
Which is principle is meaningless
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Timber-6539 on Sunday August 25, 2024 @01:02PM (#41348978)
What? Literally all Telegram clients are open source.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by konart on Sunday August 25, 2024 @01:18PM (#41349168)
What about the server? Telegram is not strictly e2e.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Zambyte on Sunday August 25, 2024 @02:04PM (#41349594)
Huh, I was going to point out that the Signal server isn't Free Software either, since for a while it wasn't being published, but it seems they have gotten back into publishing it.

https://github.com/signalapp/Signal-Server

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by twelve40 on Sunday August 25, 2024 @02:20PM (#41349763)
while it's amazing for them to keep maintaining it, as the person mentioned down the thread, it's hard to know what they are actually running, right? and it's not a lot of work to patch this or clone/branch as necessary before deploying. Oh well, i already resigned that a part of my life will be run by someone else by now.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by jjav on Sunday August 25, 2024 @06:35PM (#41352118)
Publishing server code provides no assurance of anything (although it is still nice, for other reasons) since nobody can know if what they (for any "they") run in production is the same as the public source.

Open client code and documented protoccols are much more important. If you can compile your own client from open source code and it works fine, then you can know for sure what you're sending to the server.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Timber-6539 on Sunday August 25, 2024 @01:25PM (#41349231)
An "open source server"... are you trolling?
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by vilunov on Sunday August 25, 2024 @01:28PM (#41349265)
> Show me an example of an "open source server".

XMPP and Matrix services run open source software such as ejabberd

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Timber-6539 on Sunday August 25, 2024 @01:32PM (#41349304)
Running open source software != "Open source server"
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by foresto on Sunday August 25, 2024 @02:45PM (#41350028)
If you bothered to look, you would find that both of the examples given are open-source servers. You might then deduce that you misunderstood the comment to which you replied.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Timber-6539 on Sunday August 25, 2024 @04:04PM (#41350825)
You cannot audit the system/service logs for those servers, neither can you audit the hardware running those servers, nor the internet providers who can snoop the traffic et al... That's the argument behind "Open source server" in case it wasn't clear.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by xorcist on Monday August 26, 2024 @05:03AM (#41355262)
This might be where the misunderstanding is. This software is indeed server software that anyone can run, and the global network consists of servers run by many independent entities, in many cases with full control of the hardware. One of these entities can be you, and it is completely possible to run from home.

The integrity of your conversation with someone would then depend on both your endpoints, clients, and the respective server.

Just like email, but for chat. There is no single gatekeeper who is allowed to use the network.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by Timber-6539 on Monday August 26, 2024 @09:52PM (#41363942)
No misunderstanding at all. The argument is very clear.

> global network consists of servers run by many independent entities

This is not the case for all the popular chat apps including Signal which uses centralized servers which they run themselves. They clearly see little benefit from this distributed independent server model.

And even that doesn't mean the server is open source.

As I explained earlier if you cannot audit the physical server you are connected to, claiming it's open source is useless. FYI that's literally how the term open source was used in this context!

> The integrity of your conversation with someone would then depend on both your endpoints, clients, and the respective server.

Client to client verification simply works and eliminates the need to also "verify" the server which if compromised introduces an even higher risk of contamination in the trust model (too many co-dependent functions are delegated to the server), not to mention collusion in establishing integrity of yet another device that we need to trust.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by konart on Sunday August 25, 2024 @02:58PM (#41350149)
Not sure what part of my comment amused you so much.

An IM platform server can be open sourced. Just like any kind of software.

It's just a matter of publishing your code and, preferably making it possible to verify that the service your users are connecting to is build using the same published code.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by mr_mitm on Sunday August 25, 2024 @03:34PM (#41350527)
How could you possibly verify what code they are running server-side?

Typically, the way it goes is that you implement e2ee such that even a fully compromised server cannot read the clients messages, publish the client's source code, and build it yourself or use reproducible builds. That ladt part is where you can criticize Signal. Whether they publish the server code is mostly irrelevant unless you want to run a separate messenger infrastructure.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by 3np on Sunday August 25, 2024 @07:06PM (#41352322)
> unless you want to run a separate messenger infrastructure.

Or if you S2S federate with the upstream server. Which is a core differentiator of XMPP and Matrix. Signal server(s) notably supported proper federation during their initial growth-phase but famously closed it off ("The ecosystem is moving").

Similar story as Google [Chat/Talk/Hangouts], which did federate over XMPP before they closed that down years ago.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by 4ad on Sunday August 25, 2024 @01:02PM (#41348971)
Open source is irrelevant as the protocol is plain text.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by cbsmith on Sunday August 25, 2024 @01:05PM (#41349021)
Wait... you're saying if the protocol is binary, that's different somehow?

Either way, you're saying the MTProto is binary? How do you mean that?

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by cbsmith on Sunday August 25, 2024 @05:14PM (#41351491)
"...you're saying MTProto isn't binary?"
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by 4ad on Wednesday August 28, 2024 @03:38AM (#41376968)
https://en.wikipedia.org/wiki/Plaintext

Pretending you misunderstand what I meant is detestable.

Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by lmm on Sunday August 25, 2024 @07:08PM (#41352341)
Telegram publishes open-source clients that can run on open-source platforms. Signal does not offer any client that doesn't depend on proprietary code (either iOS or Google Play Services) and is aggressive about taking down third-party builds that remove that dependency. I'd say there's a lot more reason to assume Telegram is not wilfully backdoored than Signal (though I'd trust Wire or Matrix ahead of either of them).
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by outside415 on Sunday August 25, 2024 @07:14PM (#41352378)
Only his word to go off of.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by xorcist on Monday August 26, 2024 @04:45AM (#41355178)
We have no real way to check for backdoors in Signal either. Signal is not transparent about what code their servers are running, and you are not allowed to start your own server with a known version. They do not allow for independent distribution of reproducible builds on F-droid, or any other application store that does not identify you. They will take steps to lock out any independent implementations of the client from their servers. That the code for their client is released is good, but not good enough.
Re:Arrest of Pavel Durov, Telegram CEO, charges of terrorism... by isakkeyten on Tuesday August 27, 2024 @10:40AM (#41368055)
> (unlike Signal)

Well Tucker Carlson also said he used Signal and his messages were leaked by the government so yeah...