Hacker News Reader

Comment by krick | Hacker News Reader

Given how bashing on MTProto is a favourite cryptographers' activity from the day-0, I'm actually kinda encouraged by the fact that's all they found. It's especially nice, that htey could fix all of them without breaking back-compatibility, which isn't really a given for crypto protocols. Would appreciate more technical and less dumbed down responses from the Telegram team, though. I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean.

(Also, it's funny, but being accustomed to SMS and such I always somehow assumed Telegram messages can be reordered by chance too, if I send them fast. I never really thought about it, obviously, but simply didn't expect it to be otherwise.)

View on HN

That's my takeaway here as well - no serious issues found, and Telegram actively worked with them to fix their minor theoretical issues, and did all of the fixes before the paper was published and without breaking any clients.

For the grains of sand thing, here's a technical explanation of that: https://core.telegram.org/techfaq/UoL-ETH-4a-proof#4-attacki...

This document seems like a better response to the theoretical problems the researchers found.

    that's all they found

Besides the trivial MITM in MTProto 1.0?

Telegram protocol defeated. Authors are going to modify crypto-algorithm: https://news.ycombinator.com/item?id=6948742

Telegram messages do sometimes randomly go out of order, especially under bad network conditions.

If they are sent out of order.

If a previous message is in a retry state, the second message could go through without issue.

>I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean.'

They have been doing this since the beginning. Their strategy of downplaying every attack against their protocol serves to mask the fact their team has absolutely no qualifications to implement cryptography. Like the original article stated, Telegram did not even file for CVEs, simply because they look bad. CVEs have been filed for much smaller things than these.

Their security game isn't on the side of secure-by-design, but grass-roots-damage-control to justify protocol designed by the owner's brother (who is a geometrician, not a cryptographer) and insecure-by-default. The nepotism and Russian pride should never go before the users' security. But they've never cared about it.

Slightly related, you should see /r/telegram on Reddit, that outright censors articles that criticizes the app or discuss its vulnerabilities. From the looks of it, Telegram is more a cult these days than a collective of users. Its users are willing to spend hours arguing over semantics, and Telegram shamelessly makes use of them having no life, by recruiting them to something known as Telegram Support Force https://tsf.telegram.org/

Russia has been mentioned 7 times in this discussion now, every time by you. I don't have any stake in this fight; I don't use or recommend any of these applications. But you do seem to have a bone to pick.

In Russia it's "legal" to hack other countries or their citizens, so it's not weird take.

The weird part is being the only guy bringing it up half a dozen times in one conversation.

It's also "legal" to do so in other countries.

I think it's better to focus on Telegram's open specification and implementation instead of bashing it because the developers happen to be born somewhere you don't like.

With Russia? No it's just useful to remember Durov's background, and since he's Russian, there aren't many countries he'd be secretly collaborating with.

When the vendor is intentionally collecting and defending the collection of such vast amounts of data, you have to ask, who might benefit if Telegram was a front.

I'm not specifically against Russia or US, I'm just someone who'd prefer people to have the right to their privacy. Mass surveillance isn't healthy for society, and Telegram is enabling it with their silo of user data.

So ultimately, it doesn't matter if Durov is directly playing for any big party, the problem is there's not enough tech in place to prove he isn't and when that's the case, Telegram servers and the user data that sits there, is a free for all. A server in UK is not legally, (or technically) protected from the NSA, CCA, Fancy Bear, Unit 8200, Iranian Cyber Army etc.

The only bone to pick here is any vendor who'd claim to be fighting for privacy when their privacy-by-design architecture is indistinguishable from honey pots and surveillance capitalistic companies.

>A server in UK is not legally, (or technically) protected <snip> a free for all

So exactly like servers from Facebook, Signal, Google, German police, etc. anywhere on earth. Just ask NSA (or Snowden). This is the whole China debate over again: Who would you rather that have access to all your old data the day something you did years ago suddenly become a danger to you because some fascist person became a dictator? China, who likely cannot touch you if you are outside Mainland China or the US, who will happily kidnap you from almost any place on earth if they dislike you enough (often with local help)? I'd rather put my eggs in a Chinese (or Russian) basket than a US/UK one if I had to pick only between those options.

What are you talking about :D This isn't about who's basket you'd dump your eggs into. The point is, Telegram isn't deploying end-to-end encryption, therefore there is a basket in the first place. Had they used E2EE, it wouldn't matter where the server is located, because the server never ever built a massive trove of messages, regardless of where the server is physically located.

I'm equally against everyone reading my private messages. I don't want to have to choose a country who has my messages, I choose my computer, and the computer of my peer, where ever they are.

Durov's background is that he left Russia for political reasons, which include, among other things, several confrontations with the government over stuff like handing users' data for prosecution.

If they have "absolutely no qualifications to implement cryptography" then they are doing an insanely amazing job since such few vulnerabilities were found. All that other crap of russia, censorship, reddit threads, russia, cult, russia, is beside the point here. It makes no difference on the quality of the cryptography. If they suck at cryptography then post code that show why at least (and a fix).

>then they are doing an insanely amazing job since such few vulnerabilities were found.

If they are doing amazing job, then

1. Why isn't desktop chats end-to-end encrypted?

2. Why aren't group chats end-to-end encrypted?

3. Why isn't any chat end-to-end encrypted by default?

If they're so good, why does SO MANY vendors like Signal, Element, Wire, WhatsApp, Session, Threema, Briar, Cwtch manage to pull ubiquitous end-to-end encryption off?

They have the money, why can't they pay a cryptographer to design protocol with best practices, and modern primitives?

>cult, russia, is beside the point here. It

They're not beside the point. When the E2EE is practically non-existent, the project becomes practically indistinguishable from honeypots like the recent Anom, you have to ask whose honey pot operation would it be. As for the cult aspect, if you're not part of the cult fanbase, surely you can stop defending a random company, and take a rational stance and condemn Telegram for not deploying ubiquitous E2EE? It's not like them doing so would hurt you in any way? Surely they in their infinite wisdom can implement it?

Also, I don't need to fix their crappy protocol to be able to criticize it. I don't need to show you the line of code for you to agree there is no E2EE for group chats etc. As for my job, I managed to implement ubiquitous end-to-end encryption for my project, TFC, even for groups, on an extremely constrained split TCB HW architecture. If a CS major can pull it off in such circumstances, why the f can't a multi-millionare with award winning mathematicians?

My guess for 1 and 3: because they haven't figuered out a way to sync this to all devices.

For 2, maybe scaling issues? Some groups tend to be like public IRC channels.

Telegram already has two different group categories: Normal, an super groups. Telegram bumps 200 member groups to super groups. Signal's group E2EE scales up to 1000 members (hard limit). It's both doable, and scalable far beyond group sizes that have reasonable expectation of privacy.

I.e. they could drop end-to-end encryption after the group grows too large, e.g. after 200, 500 or 1000 members.

Public IRC-channel groups don't need E2EE. The overwhelming majority of groups are small, and would benefit tremendously from E2EE.

As for syncing messages between devices, it's doable, as shown by Signal, Wire etc.

Of course it's doable, but citing Signal for it ... you don't get old messages, only new ones. Might be a security "feature" but then again, let me export/import the history manually.

You are missing the point though. If I as a random person create a client with E2EE then if it is a good client otherwise or E2EE by default doesn't matter in the question "Are they doing a good job at cryptography". It would be like saying "That expensive and very beautiful plate sucks because the cake you put on-top of it is disgusting". Irrelevant to the discussion at hand.

>surely you can stop defending a random company, and take a rational stance and condemn Telegram for not deploying ubiquitous E2EE

Yes I can and I do by comparing Telegram to likewise badly made clients (like iMessage) but this is still beside the point that you seem to avoid: If they made a piece of software and have no professional knowledge of the area it was made for (cryptography/E2EE) then they are extremely good at what they are doing no matter if you like the default settings or not.

I don't use Telegram but this comment thread is nothing but a tirade against something because it is Russian. If you wanted to discuss the actual work then there's no reason at all to mention Russia. You criticize them and say a CS major can pull it off too and then try to argue their home country and default options are a proof of how vulnerable their software is. It is not proof. Code quality, default settings and where you live is not the same thing. Your comment is reading as "TL;DR Made in Russia, hence bad".

I was wrong about the CVE numbers not being there at all, the original article did state Telegram didn't prioritize them but here we go https://nvd.nist.gov/vuln/detail/CVE-2021-36769

Reply on news.ycombinator.com