Russia lifts ban on Telegram
apnews.com
apnews.com
- Telegram does log chats server-side if you want them to (to be able to see your chat history across devices). You don't have to. Telegram supports end-to-end encryption ("secret chats") with no logging -- as far as I know there is no proof that these chats are untrustworthy.
- Telegram groups have never been sacred and they are deleted if they spread illegal information. This is not the same thing as leaking someone's personal chat history, which to my knowledge has still never been done.
I'd be glad to be proven wrong on any of these counts, I use both Telegram and Signal and trust the latter more for obvious reasons (it's completely open source) -- but the fact that Telegram is not perfect in every way does not make it insecure by default.
The argument I've heard is that Telegram uses their own encryption protocol. The rule of thumb in cryptography is "don't roll your own crypto".
The reason why that statement exists is because there are _countless_ examples of teams coming up with their own, new cryptographic mechanisms that either break (intentionally or not) or were written with a backdoor. People get incredibly clever when it comes to breaking encryption.
AFAIK the only way to be on the right side of this argument is to use a time-tested encryption protocol. However, there are even instances where some protocols have been live and in production for x years before discovering that a backdoor has been in the code since day one.
> The reason why that statement exists is because there are _countless_ examples of teams coming up with their own, new cryptographic mechanisms that either break...
But aren't there _countless_ examples of this in crypto made by cryptographers?
I'm not playing devil's advocate, I don't really have a stake here. :)
1. Actual cryptographers usually design with a set of constraints that make their crypto work: those might be about compute power, or memory bandwidth, or what have you, that make an algorithm difficult to brute force.
2. The algorithm will typically be peer-reviewed to try to weed out mistakes, either fundamental mathematical ones, or in the assumptions.
3. The implementation then needs to be high quality.
There are certainly no shortage of examples where systems which pass 1 & 2 are undermined by failures in 3. All algorithms are susceptible to the context around 1 changing (changes in compute power or whatever).
When you go it alone, you're assuming that you won't make any mistakes any of these. That seems a pretty tall order.
In machine learning, a model that works 90%, 95% of the time is pretty good.
A glitchy video game can still be fun as long as the glitches don't happen too often or cause a loss of too much progress.
Even a filesystem that doesn't lose most people's data, most of the time, will have a lot of adherents.
But if your cryptography implementation isn't completely perfect, it's frequently just 100% useless for its intended purpose.
But a bad crypto implementation will work. For all intents and purposes, it will appear completely fine. Users will get their messages. The bitstream will appear completely random. At least, until somebody with expertise in breaking crypto systems digs into it.
And that applies even if they're using AES but wrong mode of operation. That applies even if they're using best practices like AES-GCM but the CPU doesn't support AES-NI and a cache timing attack allows key exfiltration.
Like Swiftonsecurity wrote:
"Cryptography is nightmare magic math that cares what kind of pen you use. Should math care what kind of pen you use to implement it? No, but Fuck You, this is Cryptography."
The attacks are incredibly subtle for even the best systems, and Telegram is so far away from even adaquate it's difficult to emphasize it so I'll try with my best restraint:
TELEGRAM FUCKING LEAKS EVERY GROUP MESSAGE TO THE SERVER WHICH IS THE EXACT EQUIVALENT OF A FUCKING BACK DOOR.
I hope that didn't leave anything unambiguous.
This phrase is tiring to hear in this form, and your understanding seems to be incomplete here. Signal also rolled its own crypto, but you don’t see anyone saying it’s insecure for that reason. That phrase is used to tell non-cryptographers not to roll their own crypto because of the high chances of vulnerabilities being introduced. In the case of Telegram, the company defends its protocol saying that it’s been created by people with PhD in mathematics (which is related to and is foundational for, but different from, cryptography). Telegram’s encryption protocol (the second version) has not been broken by anyone till date.
It was created by Nikolai Durov who has a PhD in geometry. That's like a gynaecologist performing brain surgery. Specialization matters. Sure both took human anatomy 101 class in college, but somewhere along the way they went and spend their ENTIRE career doing different things. It's easier to get another decree in medical science sure, but in this case the gynaecologist did not, they just started cutting the brain with kitchen knife and just because their patients haven't died yet doesn't mean they have the credentials to abandon best practices.
Trying to assume good faith here that this is accidental and not trying to deliberately mislead but the way this is phrased strongly implies that server-side logging is off-by-default. It is not.
Nor are secret chats prompted or prominently advertised in the UI (it's the 2nd option when you go to create a new group, never seen when initiating new 1:1 conversations).
I would wager most Telegram users don't know about secret chats, or if they have heard of them they probably assume they're on by default.
It literally does though.
At the time I knew about the voice call remote exploit in whatsapp due to their outdated hardfork, and I knew about the XSS RCE bug in signal’s innerHTML mess... so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted on.
You can meanwhile look that information up on vault7 or snowden leaks, so it’s already publicly disclosed.
Anyways, if you feel safe using a stock Android ROM that isn’t AOSP and is still using legacy 3.x or 4.x kernels... your general assumption on what is secure is wrong.
Having said that, I don’t know whether palantir’s gotham has access to telegram’s servers. But given their workforce and sheer amount of RE they hire, the likeliness of telegram being a target is very high.
So with all that in mind I’d recommend telegram only with AOSP head and only with secret chats. You don’t stand a chance if you are using the public clearnet routing protocols either way.
And this is assuming that you don't use Windows and something like a hardened Kali or Arch-based distro that is updated regularly and uses both a secure transport layer for pacman and doesn't allow "some random guy's" gpg signatures, aka you'd have to manually check every source from AUR. If you use Windows 10, you can forget security. If you use Ubuntu or Debian, you can forget security. If you use Steam, you can forget security. If you play any networked games on any of your machines, you can forget security.
Joyful times where private organizations with nearly unlimited resources "hack the planet" and seemingly get away with it.
Personally I wouldn't trust chroot alone. There were some privilege escalation bugs available in the past from "forgot to sandbox the cwd" [1] to more sophisticated exploits via "nsswitch in docker" [2].
But, of course, given the amount of bugs I'd say that chroot is as secure as it can get. But always take everything with a grain of salt, chroot developers also make mistakes, like everyone.
The problem with chroot is not chroot itself, but all the libraries linked in the binaries. And if I know any statement to be true, it's that game developers on Steam don't give a damn about correctly linking anything. I mean, they even don't get 64bit right. And we have 64bit architecture mainstream since 2005 or so...
Why do you say so?
Critical security fixing time is years, not days. Also in practice, a lot of people use PPAs to get work done, and this is a critical component in an audited system.
I’m just gonna leave these here:
[1] https://security-tracker.debian.org/
[2] https://security.archlinux.org/
...then everyone can compare upstream/downstream fixing times for themselves.
Remember: “not yet assigned” is equivalent to “not fixed”.
This is a very strange assumption, you mean that the "Pentagons guideline for secure military conversations" is actually not a guideline for secure conversations, but exploitable conversations?
Why would the Pentagon tell their own people to use exploitable communications? There's no way of knowing if you are the only one with the capability.
In my eyes this information (which I haven't verified and don't have time to dig into) would rather indicate that the Pentagon believes Threema, WhatsApp and Signal to be secure while they are doubtful about Telegram -- maybe because they know something we don't, or simply because it's harder to audit.
I'm not anyhow claiming that Telegram is secure. But given the problems that legal courts have when the FBI and other three letter agencies want to get access to Telegram data (and the fact that the company moved their HQ around Europe every time a state wanted access) seems to me much more trustworthy than say, any Facebook software.
And I would also argue that given the fact that Gotham has full administrative access for anything Facebook sends and that the end-to-end encryption cannot be verified as both clients never actually connect directly would speak also contra WhatsApp when it comes to their security claims. (install a Firewall on Android and you'll see the whatsapp gateways/proxies).
To be honest, I doubt that the Pentagon would trust any software without having seen its source code or at least having full access to the data that's transferred. And I think that's a fair assumption.
The underlying issue is that the field of security has is actually that it's not a field of trust - but rather a field of mistrust. Currently I'm mistrusting the Pentagon more than some random dudes I've never seen; which might be the actual point of the discussion: Can we trust the Pentagon given their fuckups in the past?
To be fair, all three of those are the defaults on any distro I've ever used. You have to say explicitly "no, I do not want to inspect this PKGBUILD file" in pretty much every AUR helper (and it's worth noting AUR helpers aren't even the supported way of building AUR packages).
- Telegram requires a phone number and in my country for example it is tied to you (yes, you need to sign a contract for even a prepaid SIM card).
- Telegram does NOT support E2E encryption for group chats on any platform.
- Telegram does not use E2E encryption for ANYTHING by default.
No. Telegram forces you to log all Windows / Linux desktop client chats and all group chats to their server. You don't have a choice with those. Also all chats in general are logged by server by default.
For Signal, the server being able to eavesdrop on 100% of group messages would be complete failure, a backdoor that would cause everyone to abandon Signal. For Telegram it's the primary design principle. So Telegram is in fact bacdoored by design.
>Telegram groups have never been sacred
Yeah it says that right there on the front page. This "obviously" propaganda actually hurts people, and not just in the way I die a little inside from reading it
> This is not the same thing as leaking someone's personal chat history
This is no standard of anything. "Oh it's fine that Telegram and anyone who hacks their server spies on you, it's only problem if they intentionally leak your chat history". Screw this kind of thinking.
>which to my knowledge has still never been done.
I've never seen such moving of goal posts in my life.
>I'd be glad to be proven wrong on any of these counts,
You can't just define the context to your liking and then prance about when nobody can win the argument of your rigged rules.
>but the fact that Telegram is not perfect in every way does not make it insecure by default.
This is called nirvana fallacy. Signal isn't perfect either. But it's at least E2EE by default which is the norm these days.
Your comment is not thoughtful at all, it's indistinguishable from shill arguments. I hope you feel ashamed.
--
For profesional cryptographers and security experts, it's enough the first protocol wan't IND-CCA secure. That alone tells the professionals the app is no good to any extent. Telegram loses at that point and it'll never advance to some next round. There will never be a community based code review or stamp of approval, that ship has sailed. The developers have lost face permanently.
The evidence of this is no professional cryptographer has recommended Telegram at any point. Instead, world-renowned experts like Schneier and Matt Green have adviced against using Telegram. There's nothing Telegram developers or the community can ever say that undoes expert opinion.
Every agency in the government has an official account. The president’s spokesman uses it to communicate with members of the media. Most recently it was successfully used to disseminate guidance on COVID-19.
Or propaganda, given the (credible) accusations against Russia on misinformation campaigns.
edit: I'm referring to the fact that Telegram is the most popular service for German conspiracy myth spreaders (e.g. former stars Attila Hildmann and Xavier Naidoo), especially in regard to the COVID19 crisis. Unfortunately I'm unaware of decent English articles, but here's a good German starter: https://www.br.de/nachrichten/netzwelt/messengerdienst-teleg...
https://en.wikipedia.org/wiki/Saint_George_and_the_Dragon
https://commons.wikimedia.org/wiki/File:S.George_(Novgorod,_...
I don't care much for the conspiracy nuts, but their ability to communicate with each other would surely have been terminated had they used WhatsApp.
It's fine to use WhatsApp to praise Obama, Merkel or anything else that is widely accepted in your society etc, but it's a terrible choice if you're on the shit list of the government.
If it were that easy to influence Whatsapp, India would not have a real problem with Whatsapp-mobilized lynching mobs.
Correct. It then goes on to - by default at least - upload everyones messages unencrypted to Google Cloud.
> the key difference to Telegram is it requires a phone number to use which instantly reveals your real identity to any snoop, snitch or government mole.
I usually defend Telegram but here I think you are wrong. Telegram also requires a phone number to sign up.
https://arxiv.org/pdf/2002.04609.pdf
https://github.com/Loki-project
Seems to somehow be associated with the working group for Loki cryptocurrency, but not using blockchain to store messages or message contents, per FAQ.
https://docs.loki.network/LokiServices/Messenger/Session/
LokiNet reminds me of a self-funding P2P decentralized anonymous analog with massively more functionality to Google Jigsaw[1] project called Outline[2], which runs shadowsocks[3] on Digital Ocean droplets or your own Linux infra.
[1] Jigsaw, formerly Google Ideas: https://jigsaw.google.com
[2] Outline: https://getoutline.org
[3] Shadowsocks: https://shadowsocks.org
Some excerpts:
> TL;DR edition: an onion router with a tun interface for transporting ip packets anonymously between you and the internet and internally inside itself to other users.
> "What if I2P was made in the current year (2018)? What would be different?"
> In short we want to permit both anonymous exit and entry network level traffic between LLARP [aka LokiNet] enabled networks and the internet.
> In short, I want to take the "best parts" from Tor and I2P and make a new protocol suite.
Both Telegram and WhatsApp required a phone number last I checked, but you can install Telegram on a Desktop using a dumb phone for activation, you don't need to run the app.
> If it were that easy to influence Whatsapp, India would not have a real problem with Whatsapp-mobilized lynching mobs.
India has no jurisdiction over WhatsApp. They can ask Facebook nicely, but that's about it.
To stop communication you don't need to read WhatsApp-chats. You just disable the accounts that you want silenced. And you can't do that if you don't have control over the service (hence Western extremists use of Telegram).
If you're Russian and you want to talk about how free yourself of Putin, use WhatsApp or Signal, that is: an American provider. If you're American (or living in an American province) and you want to talk about how to free yourself of Washington, you use Telegram (or a Chinese messenger). Even if none of them can ever read your chats, they can a) use the meta data and b) disable your ability to communicate.
This also applies if you're a common criminal: US cops will have a much easier time getting meta data on your communication from WhatsApp than from Telegram. It's generally a good idea to know your threat model. Unless you're a Russian Oligarch or Ex-FSB, the FSB is not your problem. But your local domestic intelligence service may be, if you ever step out of line.
I don't think the average citizen has to worry about the FSB finding their kinks and blackmailing them. You don't kidnap poor people's children for ransom, you don't blackmail people who have no special powers.
Yeah, WA isn't anonymous. The problem is with Telegram storing all your private messages on their cloud, by hacking the server, just knowing your username the state level attacker learns everything about you, metadata, and content, and because there's no forward secrecy, it will date back basically forever unless you're constantly deleting logs, and even then you can only hope Telegram also erases their backup tapes.
>If you're American (or living in an American province) and you want to talk about how to free yourself of Washington, you use Telegram
That's just stupid, why would you want less secure architecture to criticize Americans? NSA can trivially hack Telegram servers to see your criticism if they want. You want E2EE for your dissident group no matter what, thus Signal will always remain a better choice.
By default, WhatsApp uploads all your messages to Google Cloud in clear.
That's actually not always true. Racism is widely accepted in many areas of American society, but, online platforms are beginning to make more of an effort to restrict outright hate (Twitter, for example).
LOL also I would like to point out the current President of the United States is the archetypal Obama-hater, so ... I dont know if it makes sense to talk about the government coming down on people who don't praise Obama. I would imagine President Trump also talks a lot of trash about Merkel, so, again, the current chief executive of this one particular government very publicy espouses the beliefs you claim that same government would crack down on.
I mean, there's also Fox news. Not praising Obama or Merkel. Very much active.
My point is, even if your point may be true, the examples you chose, when compared against some real-world data-points, undermine your own position.
Telegram has headquarters in the UK, a Five Eyes country. It's not unreasonable to assume that its unencrypted comms are monitored by Western gov agencies.
The non-E2EE comms are a joke and a liability of insane proportions.
That doesn't mean it can't be trivially hacked by a Western government. When you're using service that isn't using E2EE, you're just making two statements:
1. I don't trust Western companies 2. I haven't the foggiest wrt computer security or cryptography
Says a Westerner whose entire ration of "news" also consists of propaganda.
Even russian government officials have official Telegram channels. All the "news" sources quote Telegram channels all the time. All pro-gov celebrities and stuff.
It was not a ban, but a farce that made the regime look like incapable fools. Not that they are not, but they don't want to emphasize that so much. Not that they don't, but at least not make it that obvious. Not that it isn't, but...
Of course. So now that it's not banned, its no longer a tech defined as against the system.
But It doesn't matter really. They don't need to have anything to send you away in Russia.
At the same time government officials kept using it, including those in charge of blocking it.
It was an "old man yells at cloud" travesty from the beginning.
The truth is, Russia employs hackers of their own that hack Telegram's servers without trace and read messages of anyone they find interesting.
The real reason to use telegram is that it's miles away the best messenging program out there. It's as user friendly as whatsapp while having completely seamless desktop/mobile integration (something whatsapp and signal have failed to do), it only requires a phone number for the initial signup, and generally speaking it has all sorts of cool features and less bullshit than alternatives.
Then there are the little things - you can create multiple accounts and switch seamlessly, you can delete whatever message from whomever for everyone without leaving a trace (if it bothers you just switch to secret chats), all links are listed in each convo, you have pretty much unlimited and unrestricted cloud storage, etc.
Then you have all the gravy like cool tools for groupchat admin, channels, and bots of course. You can order a taxi or search up a book on scihub (bypassing countrywide blocking) with telegram. You can even do bizarre stuff like discover people around you or verify your identity on a service with telegram.
Yeah my texts are probably being read by the FSB. So what? Better that than the NSA, frankly. If I really want secrecy I'll use Tor or Signal.
The one thing that keeps me from using Telegram as my primary messenger is the low maximum line-width that makes it feel like you're on mobile even if you're using the desktop client. But UX, especially speed, is just amazing.
On macOS I use the semi-official Swift/Cocoa client instead of the main Qt-based one.
Other messaging apps wouldn't be so bad if alternative clients were a possibility, because inevitably someone would build better clients. Messaging app platforms should have open APIs and welcome third party client devs, not chase them away.
Only if you have multiple phones. One account per number.
> Yeah my texts are probably being read by the FSB. So what? Better that than the NSA, frankly.
I can't tell if this is a joke. If it's not, it's fairly insulting to everyone who believes in a world with privacy and freedom.
I personally think the NSA has a jurisdiction to do more to American citizens in the USA. I would be extra careful about the NSA if I was H1B.
Let's say you say something less than pleasant about China, or you like Winnie the Pooh.
China has already demonstrated the will and influence necessary to extend pressure on other companies, governments, and etc to deal with such things.... and you have far less recourse (if any) to deal with (or know about) it than most anything.
I post this a lot but it's true:
“Injustice anywhere is a threat to justice everywhere. We are caught in an inescapable network of mutuality, tied in a single garment of destiny. Whatever affects one directly, affects all indirectly.”
― Martin Luther King Jr.
But let's also be clear that much like your data being held by a corporation, leaks, etc all happen... if Russia has it, so may someone closer to you.
But I think it is also unhelpful / inaccurate for every non free nation that comes up we get these sort of "What about this place!?!?" false equivalency arguments.
Leave a little nerve agent on your doorknobs.
Also the FSB would probably report on you to the US govt anyway, if you were actually up to something big enough that the NSA would have taken interest.
Go to, https://transparency.twitter.com/en/information-operations.h...
Download,
Internet Research Agency (October 2018) - 3613 accounts
Tweet information (1.2GB)
Search,
mytwitterusername
And there it is, Russia's efforts at influencing my account or using it's messaging to influence others. Targeted attempts to get users to click rigged links. Psy-op mind fucking.
Do I really want to give this type of government more data to fuck with me or people in my orbit? Just because "better than NSA," whatever that means?
No I'll pass on that give me privacy from all the alphabet boys please.
Being funneled to the FSB doesn't prevent them from being read by the NSA, it's just one more opportunity for the NSA to intercept them.
Care to explain?
He probably lives in the USA where the FSB is less likely to oppress him than US government agencies are.
Every time these discussions come up people sound like they think they're El Chapo or Ai Weiwei in which case yes don't use telegram. If you're an average citizen these agencies couldn't care less what youtube videos you share
FSB would try to read that information to try to damage the countries, to spy, to steal databases, to hurt people and so on.
If FSB could read private messages of US citizens it would be 1000 times worse than Google or Facebook reading them even accounting for leaks and misuse in G and FB.
G and FB is thousands engineers who love unicorns and rainbows and are extremely offended when the see a person wearing MAGA hat. FSB is men who regularly drink vodka, who are trained kill, who are not allowed to leave Russia, who are constantly told that Russia is surrounded by enemies.
Don’t compare G and FB to FSB.
(I doubt FSB can read Telegram.)
And have a pet bear that plays balalayka.
On the other hand, it's the NSA's job to read all the FSB's data. So by using the non-US-based program, you make it easier for the US government to spy on you.
Do you use email despite it's lack of end-to-end encryption? I would bet that 99% of these privacy people still use email.
Last time I looked, Gmail or equivalent products didn't allow you to easily end-to-end encrypt your messages without any additional effort.
All of that to say, I guarantee the majority of Telegram users aren't utilizing E2E-encryption so the Gmail comparison is valid in that light.
Though my counterpoint would be that privacy advocates likely know how to use PGP and use it to securely communicate with fellow privacy advocates via email.
The question is, what is email being used for? Communicating with people who we don't have private interaction with? Having academic discussion on mailing lists? That stuff doesn't really require confidentiality.
The company does not have servers in Russia, the software wasn't developed in Russia, etc.
The only reason one could make the connection is that it was developed by a Russian. A Russian that gave up a lot specifically not to cooperate with the Russian government.
But it was developed in Russia. Durov was lying to the world that developers were abroad out of reach of russian authorities, when in practice they were in Saint Petersburg just a floor below VK.com developers (a previous company by Durov, now controlled by russian government via proxy pocket oligarchs)
They failed to do this only because they have a real end-to-end encryption for all chats, unlike Telegram.
Telegram doesn't have E2E encryption for groups or Windows/Linux desktop clients, even if you try to toggle something. So your argument is false.
That, and it's not Facebook-owned, a company which has a very detailed track record of lying and abusing private information.
Telegram as a Messenger/WhatsApp replacement for the general public is solid gold, even if state security agencies were able to peek in it.
It all depends on your threat model for a given information exchange you're going to have and who you consider to be your adversary.
Yet the VERY FIRST feature presented in Telegram's front page is privacy: "Telegram messages are heavily encrypted and can self-destruct."
Heavily encrypted is a complete lie, but people who want privacy don't know that, they will download Telegram thinking it's secure. You're wrong and you're doing harm by spreading claims like that.
>or his advocates) pops up and tells us it's trash and we should all use signal instead.
Yeah, everyone should fight the propaganda machine shilling a really, really dangerous product.
Every time someone recommends Telegram it's due to features, the marketing strategy is clearly "if we can get them hooked on features, they will forget about the fact every feature is designed to spy on them".
>The real reason to use telegram is that it's miles away the best messenging program out there.
Ooh you're one of them. See here's the thing: the features that aren't really private, aren't really features. Telegram is a collection of trojan horses: seemingly useful things that actually hurt you by spying on you. When you measure Telegram's E2EE features against that of Signal's you'll immediately see who has more features. Telegram doesn't even have group messages.
>It's as user friendly as whatsapp while having completely seamless desktop/mobile integration
It doesn't. There is absolutely no desktop mobile integration for anything that's E2EE. For Signal, everything is.
>Then you have all the gravy like cool tools for groupchat admin, channels, and bots of course
No there are no private group chats with any kind of management in Telegram.
>Yeah my texts are probably being read by the FSB. So what?
To me it sounds like you're a privileged person who doesn't have to care about these things. You're not doing anything that will ever rock the boat, so you're pretty much immune. The only real question is, what is your legacy?
Also why did you come here to tell us about your privilege and to list Telegram's dangerous features? Because you're a good Samaritan?
The issue was that to block Telegram they had banned a few IP blocks, around 10 million ips[1]. These blocks were used in both Digital Ocean and AWS. So if your website or service used any of these blocks, it wouldn't be available in russia.
TG LLC got 1.7 bil USD with two rounds of investment. US based investors are returned 72% of original fund. Those 28% are 500 mil USD.
It's rumored that TG CEO got 300 mil selling his share of VK, so in the end he returned all personal investment on TG development. Who's behind all those funds, private investors etc. How many of those are under US sanctions really?
And now, upon failing to submit the reasonable paperwork even thought they had quite expensive and experienced lawyers, Pavel suddenly calls for unban in Russia. Like a week later a legislation appears and almost immediately after that the deal is done.
Reconciliation happened unbelievably quick. Or his words have so much power now?
Just think Crypto AG serving the purposes of BND and CIA when you talk about Telegram.
Sounds pretty complicated when a simpler answer would also exist.
For starters, the citizenship that was acquired for $ 250k something is from Saint Kitts and Nevis, known for it's abuse of human rights. To me it's a classical double standard behavior.
He's vocal on not being able to conduct business in Russia as he pleases and it's a clear violation in his purview. Never heard him being involved with fighting inequity of the new home country.
Second of all, Saudi Arabia, the unofficial Telegram HQ, is tax exempt for hi-tech, but don't quote me on it.
Blame the UK and EU who allow visa-free travel with SKN but not with Russia and don’t sanction it.
It is a country with a population of 50 000 people. The only reason it is not extremely poor is because its business model is giving citizenship to businessmen to avoid taxes and allow them to travel freely.
Fighting an obviously lost fight against SKN and jeopardizing your whole life sounds even more stupid than fighting windmills.
>>Fighting an obviously lost right against SKN and jeopardizing your whole life sounds even more stupid than fighting windmills.
He could've applied for maltese or cypriot passport.
[0] https://en.m.wikipedia.org/wiki/Crime_in_Saint_Kitts_and_Nev...
He was never properly persecuted. He never had a close call with McPolonium when eating out. He's not considered an actual threat.
I'm in a camp who thinks that this 'ban' was just a PR stunt coordinated with Roscomdanzor, which was known to be futile from the start and instantly raised the credibility of Telegram and cemented the myth how 'protected' it is.
[1] https://medium.com/@anton.rozenberg/friendship-betrayal-clai...
1) European Court of Human Rights will publish a set of decisions about Russia blocking access to different websites. [0] All those decisions are expected to be in favour of plaintiffs.
2) Court would soon communicate first case about blocking of Telegram by collateral party.
3) Communication of primary case by Telegram LLC [1] is a matter of weeks, it was delayed due to company restructurizing.
Russia gonna face direct lifting order from ECHR and that would be a Zugzwang: position, from which any move is losing.
Besides, blocking of Telegram for at leas last year and a half was inefficient, if not nonexistent. It is a common subject of satire towards state actors responsible for blocking.
So, I take it as a face-saving move, according to Hanlon's razor.
[0] https://hudoc.echr.coe.int/app/conversion/pdf?library=ECHR&i...
[1] https://agora.legal/fs/a_delo2doc/97_file_Report_2018.pdf
The jurisdiction of the court extends to nearly all European states, with the exception of Belarus, the Vatican City, and the predominantly Central Asian Kazakhstan.
But,
In 2015, Russia adopted a law allowing it to overrule judgements from the ECtHR, codifying an earlier Russian Constitutional Court decision which ruled that Russia could refuse to recognize an ECtHR decision if it conflicted with the Russian Constitution.
Compare,
Other countries have also moved to restrict the binding nature of the ECtHR judgments, subject to the countries' own constitutional principles. In 2004, the Federal Constitutional Court of Germany ruled that judgments handed down by the ECtHR are not always binding on German courts.
(All https://en.wikipedia.org/wiki/European_Court_of_Human_Rights
And the vote on the new Constitution amendments is scheduled to proceed in a few days.
Sadly I feel like that is a very real possibility for any software / hardware produced in any significantly non free country.
It can happen in other countries, but the likelihood of you hearing about it seems much much higher.
It's a sad situation as I don't like the idea of being suspicious by default of other developers / products simply because their country of origin, but I have trouble avoiding the obvious fact that even a well meaning developer / company based in those countries would / could easily be pressured into introducing some sort of access (doesn't matter how) and it's simply unlikely we'd know.
I wonder if the money Crypto AG made will have been worth any future reputation cost for Zug's economy.
https://www.luzernerzeitung.ch/wirtschaft/bund-stoppt-nachfo... "... verkaufte die Crypto AG im Auftrag des US-Geheimdienstes CIA und des deutschen Bundesnachrichtendienstes Jahrzehnte lang manipulierte Chiffriergeräte an diverse Staaten."
I don't believe any country means all countries are equivalent as far as the risks go.
The amount of news / data about it will of course be higher in more free nations.
Why? Bureaucracy, Intelligence Services and state-level paranoia transcends political ideologies and systems.
> The amount of news / data about it will of course be higher in more free nations.
On the other hand, we'd hear a lot more about anything from Moscow in our media, so I doubt there's a lot to be talked about as of now. It's only one big leak away, of course, but so far, I don't see a lot of support for your theory.
If China comes to you and tells you to hand over the keys, you don't go to court or the news media ... in the west you can actually refuse and we see that happen and play out in the courts and etc.
Not in less free countries.
It seems like you're holding all nations to be equal if there isn't perfection. I think that's a poor way to measure anything involving people.
The Snowden of China doesn't get his day in court, maybe never talked if his family back home was at risk.
Russia literally had court proceedings about Telegram, which this post is about. Is Russia not a "less free country"? Or are those not "real court cases" while "ours" are totally real (but you can't talk about them and must play charades, and the opposing side has super powers written into the law)? If you need help carrying those goal posts, let me know.
> The Snowden of China doesn't get his day in court, maybe never talked if his family back home was at risk.
Neither does the Snowden of the US of A, you know, that one guy... right, Snowden, who has to hide in Russia of all places to not get shipped off to Gitmo. And even if he took that route, I'm sure the apologists would say "well, this is one of those small imperfections but he's fortunate that he's not in Russia".
His choice to not do so is understandable, but it's an option.
I'm a little lost on what you're saying at this point. I can't imagine you or I want to get into the judicial differences between the US and Russia.
In that context, in a post-Snowden world, it's kinda grating to still have people talk about all the evil things that supposedly happen in "non free countries", while mostly being completely unaware about what their own, supposedly "free", countries are doing, often on a global scale because they are supposedly way more likely to "hear" about it, while still not being able to change anything about it.
[0] https://en.wikipedia.org/wiki/Lawful_interception
[1] https://en.wikipedia.org/wiki/Third-party_doctrine
[2] https://opendatacity.github.io/stasi-vs-nsa/english.html
It's fairly obvious that more free countries allow for a greater chance in changes of law than non free countries.
The Snowden of China would not get his day in court....
Because the Snowden of the US did?
I don't think the Snowden of China gets such an option.
If they caught him, he would not have been able to properly defend himself because US law would prohibit him from making his case [2].
Heck, if they would have caught him before his Hong Kong meeting, they could simply have "vanished" him and nobody would have been any the wiser, as Greenwald, Poitras, and MacAskill would have had a very difficult time proving the legitimacy of the leaked documents.
So no, neither the Snowden of the US, nor of China gets any of these options, that's why this whole false dichotomy of "free countries vs nonfree countries" is just another facette of the constantly going on propaganda war.
The best chance whistleblowers like that have is trying to escape the sphere of influence of whoever they blew the whistle on. For Chinese, Russian, Iranian, and others that's large parts of the world they will be welcomed in, for US whistleblowers it's pretty much only a handful of countries out of whom only a very few are actually able to keep them save/not straight up hand them over.
[0] https://en.wikipedia.org/wiki/Evo_Morales_grounding_incident
[1] https://www.theguardian.com/us-news/2016/feb/05/edward-snowd...
[2] https://whistleblower.org/in-the-news/wsj-op-ed-why-edward-s...
There's a whole world of talk of Snowden and others supposedly going to be vanished and it for whatever reason the fact that it hasn't happened seems entirely lost on folks who talk about it.
> "free countries vs nonfree countries" is just another facette of the constantly going on propaganda war.
I don't know what you're trying to say about that. I think there are real differences between freedoms allowed in different nations and they have real impacts.
If I were him, I, uh, would not try my hand in a court of law.
https://www.theguardian.com/media/2020/jun/01/julian-assange...
Not sure he'd get the same type of trail in China, Russia, or if it would go that far.
The mob has sent hitment to people whose offences were way lesser than that.
Their ways are unyielding, and uncompromising. Putin has a record killing people who grieved him more than a decade ago, keeping trying for years on end. People he killed some times survived 2-3, even 4, assassination attempts over years, just to be eventually killed by yet another one.
Knowing that, it's hard to explain how Telegram kept maintaining an office in Russia.
Telegram has an office in Russia? Do you have sources? I cannot find one to confirm, and as far as I know that's not the case.
It is a good example of "he said she said". But Igor Ashmanov considers Rosenberg a good source on Durov brothers and lets say information above is correct.
That means that Durov is used a part of the real estate he had access to to help development of Telegram. It does not mean that Durov is (not) affiliated with Russian government it just means that for Durov it is useful to use Russian real estate he knows and adores and to use Russian talent.
It looks like Telegram servers are somewhere in Europe, BTW.
I think you are talking about Clinton Foundation, aren't you? A joke, of course.
Can you help me to access statistics from which you inferred "double digit portion"?
Not that I am pro-Russian-government, I am not. I just sense here something that is not completely right with my view of the world and I want to get better in that regard.
https://en.wikipedia.org/wiki/List_of_journalists_killed_in_...
https://www.rferl.org/a/nemtsov-murder-russia-political-kill...
Going by exemplar logic in your answer to gdy above, you are either paid by, say, Navalny or you are a troll. Okay then.
Is it Nemtsov "an audacious opposition" in your opinion? As much as I don't like the Putin rule, Nemtsov popularity was really minor to influence anything. If anything it was the "non-systematic opposition" who won most from his death.
There's absolutely no point in making any physical moves against Durov even if he was openly anti-Putin and supported opposition in any way. It's never done like that. He's already forced out of the country and is not considered a direct threat. He or his remaining actives may be considered a future asset, on the other hand.
This implies he does not support opposition in any way. This is not true. He does support opposition rallies—when they are held to support his cause, true, but such is political climate in Russia that publically supporting those who vocally oppose the state policy is a domain for very few and quite brave.
When Libertarian Party of Russia was organizing a rally in 2017 to protest Telegram ban, Durov contacted the Party himself. (I'm a member of LP RU.)
I don't count on Telegram security but Durov's public image and actions are certainly noticeable and appreciated by opposition.
It implied just that I don't know for sure and it does not change a lot. Even Khodorkovsky is not considered a threat worthy of eliminating - he much better serves the cause being a propaganda target. Durov has even more to offer to Russian gov't (digital technology is the new arms race) so he has even lesser chance of bodily harm.
Russia's leadership is not monolithic, and it's decisions are not rational. Some critics are killed even though they do not pose a significant threat. Some are able to continue their fight. Some have allies on the inside; some are said to actually be controlled by the government.
If anything, history of such politics teaches me that it's chaos all the way down and almost no one has the full picture, neither knows what he's doing.
There are very much parts of the Russian political elite that will use violent and coercive means outside their official mandate to silence individuals. Roskomnadzor isn't really one of those, and is mostly limited to spewing more things onto blocklists to the chagrin of ISPs and people who actually understand the internet.
More likely Telegram is unblocked because someone higher-up finally got around to telling Roskomnadzor to fuck off and stop being a nuisance here, since its order never succeeded in actually blocking Telegram and mostly served to disrupt access to cloud service providers (breaking other, non-Telegram applications) as RKN ineffectually tried to issue block orders for entire AWS and GCP network ranges. Other parts of the government clearly didn't care much about the order (they continued to use Telegram for official business after the block), and it seems like it was either RKN attempting to flex its muscles to impress higher-ups or an unsuccessful attempt to put pressure on Telegram that the government has finally given up on.
All that while having open-source and much safer alternatives. I don't see a problem here.
However, the effort of setting this up could be better spent on making (or contributing to) a messaging app that's open-source and secure by design, where you don't need such setups to detect backdoors because they are near-impossible to introduce (open-source code and lack of a central server).
One justification for sharing keys could be that security services want to use data recorded by SORM (and nowadays we also have the goddamn Yarovaya law) as an evidence and to do that you have decrypt it. Luckily for us modern security frameworks are built around ephemeral keys and forward secrecy.
How? As far as I understand by having the client download encrypted messages from one Telegram server and keys from another and then place those servers in different datacenters in different jurisdictions.
FTR: of course I am aware that unlike E2E-encrypted messaging in this case you have to trust the vendor. If you do is up to you. I trust them more than WhatsApp (who are E2E-encrypted but backup to NSA^HGoogle and try to extract all kinds of metadata) and less than Signal (even though Signal has had at least one horribly security glitch).
One more thing: Telegram are also pretty open on the fact that they take down public terrorist content.
People, who used Telegram did not stop using it since the very first day of official ban.
They never needed those keys however, they've always had the capability to hack the server.
1. Hack the server
2. Read every dissident groups' messages.
3. No step 3.
These unsubstantiated claims (like Telegram to send data to Russian gov) won’t help anybody.
Basically, 95% of the blacklist.
Take note on how it feels to read this line when it's about a country that isn't yours. When the United States pushes the same argument, the rest of the world's privacy is at risk.
This is why European governments increasingly try to keep their data on European soil, and to trust businesses bound to EU laws.
I'm not for any of conspiracy stories, but we need to be clear about this ban story.
This is a random article (in a Russian) about RKN threatening to block App Store in Russia if they refuse to remove Telegram from the App Store.
https://www.the-village.ru/village/city/news-city/313713-rkn...
I'm not the one for conspiracy theories though. Most likely they never intended to actually block it simply because they are using it themselfs and that's just it.
Obviously, they are not mad enough to break everyone's phones just to block Telegram.
> I'm not the one for conspiracy theories though.
Yeah, that was my thought. You did not provide any evidence to the claim that RKN only pretended they want to block Telegram, while there's a lot of evidence they actually wanted to block: they blocked millions of IP addresses and they threatened Apple to block App Store.
> simply because they are using it themselfs
If they really wanted to use it themselves, they would not block AWS and DO.
Technically speaking there was no law prohibiting telegram for citizens or government officials. “Optionality of compliance” does not apply here because no user of telegram broke the law.
- Open up! Police! Your neighbours called.
- Nu, so go next door. We didn't call for police, we called for ...
Might be a timezone? The most eastern part of Russia (cities such as Pevek, Anadyr) observes UTC+12.
https://en.wikipedia.org/wiki/Russian_Internet_Restriction_B...
Every website and TV show in Russia must show age rating.
The authorities failed to shut Telegram down while making active use of it themselves. So now they are giving up because there’s not much point in continuing the efforts.
And if you're afraid of people talking about stuff without you knowing, the last thing you want it large parts of the population (or at least those parts you're interested in) using more encryption. Basically: you can't stop it, trying to stop it has negative side-effects, so stop trying.
This is insane and like pretty bigoted - not a good look for HN.
Here's the guy that leads the company: https://en.wikipedia.org/wiki/Pavel_Durov
>In 2011, he was involved in a standoff with police in St. Petersburg when the government demanded the removal of opposition politicians' pages after the 2011 election to the Duma.
He's living abroad because he's either not allowed or does not feel safe entering Russia. VK was taken from him pretty much over his principals not to do what HN just assume telegram does. Telegram was developed outside of Russia to avoid being beholden to them.
The fact that Russia was actively blocking telegram should be proof enough. The reason they stopped is because when they did, they would accidentally blocked other services and it was kind of a disaster. They simply don't have the expertise to run their blocking campaign. It looked bad so they stopped.
Russians are more than one-dimensional Putin-driven fake news generating bad guys.
Russian people are not one-dimensional. Russian government is.
No, you're just projecting. This mindset of untrustworthy until proven otherwise is universally applied to all chat apps, from any country, it happens under pretty much every discussion of Facebook's Whatsapp and Messenger and it happens in discussions about WeiBo (and similar).
He has since entered Russia. Also, Durov's warrant was dropped just two months after he went exile. Stop inventing things.
>VK was taken from him pretty much over his principals not to do what HN just assume telegram does.
HN isn't concerned over what he does, it's what capabilities he leaves himself and anyone who hacks his systems. If Durov really cared about his principles, he'd have deployed app-wide E2EE from the get go. He had the money to hire the people to do that.
>Telegram was developed outside of Russia to avoid being beholden to them.
Didn't stop it from being developed by non experts, almost equally bad considering there's now the equivalent in the backdoor that allows the server to read everyone's group messages.
>The fact that Russia was actively blocking telegram should be proof enough
If that's proof of Telegram's security, then the fact the ban was lifted means Telegram is now 100% compromised. So yeah, you have to make a choice here.
>The reason they stopped is because when they did, they would accidentally blocked other services
This is the actual reason they continued, and Telegram's security is not proven by the ban. They've had the capability to hack the server since day one. And if you disagree, you're either ill informed, or fooling yourself. If it's the former, start here https://en.wikipedia.org/wiki/Fancy_Bear
>Russians are more than one-dimensional Putin-driven fake news generating bad guys.
It's very probable Durov isn't actively trying to uphold the oligarchy from abroad by continuing his military training in propaganda and position in the Russian society by retreating to an oppressive country like UAE under the disguise of exile just when chat platforms start to overtake social media sites. I think that's very improbable.
But he's a useful fool for creating something that's trivial to hack, and that allows all intelligence establishments around the world to access Telegram's communication. We should've learned from Cambridge Analytica that ubiquitous E2EE by default is the only way to prevent future disasters. It's not like Durov can magically protect Telegram from all the state driven hacking organization and their insane budgets with no profit responsibility.
Yes we got it you don't like telegram. Use whatever and move on. There is no need to constantly come up with the same BS. Cloud chats are in the cloud (which you probably hate too ryt?) and no, they are not e2e encrypted. Calling it a server side logging is just straight out FUD. Also pretty sure 99+% of all telegram user never use the secret chat feature because telegram is mostly so useful because of all the rest. And people use it for all the rest (large community groups/channels/bots/games). I'm sure more than 99% of my telegram messages go to groups that are public or semi public (like you would find the link on another platform if you are part of the community there). Its absolutely unwanted to have any kind of nonsense encryption for such groups. Yet all the feature telegram can provide because it does not have nonsense encryption, like fast server side search or link to messages visible on the web, are the reason I and other use it. Just like y'all use hacker news and don't mind that your comments are "server side logged".
tl;dr A tool isn't broken or insecure because it does not what you want it to do. It's just the wrong tool for you.
Context:
In Russia we have a limit of 2 terms for presidents. Putin and his mafia don't like it, so he decided to be nullified and get additional privilegies (e.g. after he decides to resign, he will be able to dismiss a president).
Putin has even already signed the changes because he knows we are too scared of jail to protest IRL: even if you are protesting alone, police will likely beat & fine you (even if you are a girl or just holding a BLANK board) for an unauthorized demonstration. In one video the election chief almost laughed while saying everything is already decided and legitimate and they just want our opinion.
But for additional legitimization Putin set the voting. Probably he doesn't want the situation as in Venezuela. And he wants to increase his ego (his ego is very high, just compare inauguration of him and Obama/Trump).
He paid many famous people for short videos where they support some part of the changes, typical example: "I will vote yes because I like animals!" although we already have laws for animals.
And none of those videos mention that Putin would be the president forever. Only half people are even aware of this change (and many are forced by employers to make a photo that they voted yes). Oh, and our constitution doesn't work at all anyway. Gov-t people laugh at you when you mention anything from it. And there were news several years ago that a journalist got a suspended sentence (условный срок) of 4 years for extremism because he quoted the constitution.
P.S. >97% of Russian IT people seem to hate Putin according to the comments I read everyday. And Durov should hate him much more because Putin's mafia stole VK (that's our Facebook with nice UI/UX and awesome search) from his control.
> Now the government got access to everything that goes through telegram?
> About Telegram Messenger
> June 18, 2020
> We positively assess the readiness expressed by the founder of Telegram to counter terrorism and extremism.
> By agreement with the Prosecutor General’s Office of the Russian Federation, Roskomnadzor removes requirements to restrict access to the Telegram messenger.
> We are ready to cooperate with all Internet companies operating in the country to quickly suppress the spread of terrorist and extremist information, child pornography, and the promotion of suicide and drugs.
> Currently, jointly with leading Russian and foreign Internet companies, on average weekly materials are removed:
> - propagandizing suicidal behavior 2,500;
> - extremist and terrorist nature 1,300;
> - propagandizing drug use, about places of their purchase 800;
> - with pornographic images of minors - 300.