News for hackers. Stuff that matters.

A comment on The Arrest of Pavel Durov Is a Reminder That Telegram Is Not Encrypted. Parent comment

Re:The Arrest of Pavel Durov Is a Reminder That Telegram Is ... by honestjohn on Monday August 26, 2024 @02:53PM (#41360411)
No, your client asks Signal's server for the other end's public key. There's fundamentally no way for Signal's server to prove to your client that the pubkey you're encrypting for is indeed the one owned by the phone number you keyed in.
[ Parent | on HN ]
Re:The Arrest of Pavel Durov Is a Reminder That Telegram Is ... by stavros on Monday August 26, 2024 @03:40PM (#41360980)
To clarify, there's no way for any software to do that. You need to somehow validate the keys' ownership out of band.
[ Parent | on HN ]
Re:The Arrest of Pavel Durov Is a Reminder That Telegram Is ... by hughesjj on Monday August 26, 2024 @03:34PM (#41360920)
It offers a fingerprint you're supposed to validate over sneakernet but people are lazy
[ Parent | on HN ]
Re:The Arrest of Pavel Durov Is a Reminder That Telegram Is ... by rvnx on Monday August 26, 2024 @04:06PM (#41361334)
and Google Play offers the possibility to distribute an update only to specific e-mail addresses, so if there is a need to compromise users with a malicious update that shows another fingerprint it's really doable (or just copy the messages, like Skype was doing with TOM-Skype).
[ Parent | on HN ]