this post was submitted on 25 Aug 2024
130 points (95.8% liked)

Privacy

31800 readers
366 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
130
Is Telegram really an encrypted messaging app? (blog.cryptographyengineering.com)
submitted 2 months ago by [email protected] to c/[email protected]
51 comments fedilink hide all child comments
 

Blog post by crypto professor Matthew Green, discussing what Telegram does (I wasn't familiar with it) and criticizing its cryptography. He says Telegram by default is not end-to-end encrypted. It does have an end-to-end "secret chat" feature, but it's a nuisance to activate and only works for two-person chats (not groups) where both people are online when the chat starts.

It still isn't clear to me why Telegram's founder was arrested. Green expresses some concern over that but doesn't give any details that weren't in the headlines.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 72 points 2 months ago (5 children)

I mean really, we don't need an entire article to explain how encryption works on Telegram.

  1. Chats by default aren't fully e2e. Your key must be kept on the server(s) to enable instant sync with other devices

  2. There is a full e2e chat, you can enable this at any time. But, it doesn't do groups, it's only between 2 parties, and it doesn't sync across devices.

  3. Telegram's encryption isn't open source, so no one can verify it's soundness or risks.

None of this is new info, it's been talked about for 2 years now.

[–] [email protected] 23 points 2 months ago

2 years? Try ten!

[–] [email protected] 13 points 2 months ago (1 children)

We really don't need more than #3 for a reason to stay far away from Telegram. Security through obscurity is not security, and neither is rolling your own crypto.

[–] [email protected] 3 points 2 months ago

Just note that the comment was inaccurate, in that their weird encryption is indeed open source at least.

[–] [email protected] 11 points 2 months ago (1 children)

Telegram’s encryption isn’t open source, so no one can verify it’s soundness or risks.

This is not true, it is available in the open-source Telegram clients.

What you probably mean is that it is using an unusual and not well studied encryption algorithm. This means you need to be a real cryptography expert to spot flaws in it.

Telegram justifies this with a bit of FUD about well known encryption algorithm being NSA sponsored etc, but when cryptography experts did look at Telegram's homegrown algorithm they were less than impressed.

[–] [email protected] -2 points 2 months ago (1 children)

As I recall, Telegram put up bounties for people actually demonstrating exploits in its encryption. Have any of these cryptography experts actually shown exploits?

[–] pupbiru 1 points 2 months ago* (last edited 2 months ago) (1 children)

telegram put up bounties relating to specific properties of their encryption, yes but there’s more to private messaging than just encryption… for example afaik it’s trivial to do things like replay attacks

their encryption may not be flawed, but they failed to design an algorithm that protects against the wide array of modern attacks, as they are mathematicians; not security experts. they understood the maths, but not the wider scope of implementation

a good example of these is linked down thread about MLS

Security properties of MLS include message confidentiality, message integrity and authentication, membership authentication, asynchronicity, forward secrecy, post-compromise security, and scalability.

the telegram bounties afaik only cover 1 security property

[–] [email protected] -2 points 2 months ago (1 children)

But can you provide an example of an actual flaw being demonstrated by anybody with or without a bounty?

[–] pupbiru 1 points 2 months ago* (last edited 2 months ago) (1 children)

i neither have the time nor inclination to research to that degree - i’m merely saying that the bounties prove very little, and change nothing about how people should treat non-standard protocols and algorithms. in fact, the lack of substance is proof that they don’t fully understand the scope of what’s required in the field of security

[–] [email protected] 0 points 2 months ago

And I'm saying that despite people constantly throwing shade on the protocol, nobody has actually showed any flaws in it over many years. The whole dogma that non-standard protocols and algorithms should be shunned out of principle is just that. Meanwhile, plenty of exploits have been found in standard protocols. Not only that there are known cases where US security agencies introduced exploits into popular protocols. https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-million-for-a-back-door-into-rsa-encryption-according-to

[–] [email protected] 7 points 2 months ago

Sure, I just have never used telegram or paid attention to it until that guy got arrested. So the quick overview by a cryptographer was helpful.

[–] [email protected] 1 points 2 months ago (5 children)

Are there any programs that can do e2e in a group chat? My limited knowledge of e2e and encryption makes me think that'd be extremely difficult and even clunkier

[–] [email protected] 22 points 2 months ago (13 children)

Signal

load more comments (13 replies)
[–] [email protected] 4 points 2 months ago

Element (really any Matrix client that supports e2ee) but rooms with hundreds I'd people and having encryption enabled is going to to have lots of messages with key exchange errors.

[–] [email protected] 2 points 2 months ago (1 children)

Group chat is a tricky problem and the modern crypto group (moderncrypto.org) talked about it at great length a few years back. I don't know whether any software exists that incorporates all those ideas, but that's mostly because I haven't really been looking for it.

[–] [email protected] 2 points 2 months ago (1 children)

There is the MLS standard now that was explicitly developed with e2ee group chat applications in mind. From what I have read so far, this new standard seems well regarded by cryptography experts.

[–] [email protected] 1 points 2 months ago

Thanks, I'll ask my crypto homies about it. I remember they were trying to handle some subtle problems.

MLS info: https://en.m.wikipedia.org/wiki/Messaging_Layer_Security

[–] [email protected] 1 points 2 months ago

PGP/GPG encryption. It works with any IM, social network, anything (at least if the platform/program/app/medium allows for sufficiently lengthy messages so to carry the encrypted payload). There are some IMs that bring PGP/GPG natively, as well as extensions for existing IMs that also adds PGP/GPG feature, but PGP/GPG doesn't need to be native to the app to convey encrypted messages, it's a base64 text. It's really an E2EE.

[–] [email protected] 0 points 2 months ago (1 children)

Messages app by Apple. Not extremely difficult, but has its trade offs, and easier when all devices share a CA.

[–] [email protected] 2 points 2 months ago (1 children)

CA?

[–] [email protected] 1 points 2 months ago (1 children)

Certificate Authority

[–] [email protected] 1 points 2 months ago (1 children)

Doesn't the concept of using a CA (which are generally also central authorities) go against the idea of E2EE that only required to (or more) endpoints or am I missing something? Signal group messages (and the protocol/concept behind it) work without a CA. I think I'm missing something, can you connect the dots for me?

[–] [email protected] 2 points 2 months ago

The CA is purely a way to provide validation that the endpoints being connected are who they say they are; the actual signing certificates are still private. Apple uses a central directory; Signal depends on certificates linked to one way hashes of phone numbers.

[–] [email protected] 8 points 2 months ago (1 children)

https://en.wikipedia.org/wiki/Betteridge's_law_of_headlines

[–] [email protected] 10 points 2 months ago (1 children)

Is Betteridge's law always correct?

[–] [email protected] 6 points 2 months ago (1 children)

same subject 3 hours ago ☞ https://lemmy.dbzer0.com/post/26612132

[–] [email protected] 2 points 2 months ago

Hmm, so this is kind of a dup thread. I wonder if there is a way to lock and forward it, or at least mark it as a cross post. Thanks.

[–] [email protected] 5 points 2 months ago

Only under very specific circumstances.

[–] [email protected] 5 points 2 months ago

No.

[–] [email protected] 5 points 2 months ago

This is pretty good, a discussion of possible motivation of the founder's arrest, and comparison with an earlier scuffle involving the RIM Blackberry.

https://www.oblomovka.com/wp/2024/08/25/pavel-durov-and-the-blackberry-ratchet/

[–] [email protected] 4 points 2 months ago (1 children)

They can shut off that server whenever they want and then it won't matter how encrypted your unsent message is.

Telegram is service as a software substitute.

[–] [email protected] -1 points 2 months ago* (last edited 2 months ago)

Not quite

SaaSub is when you have a server do your computing for you. This is just delivering messages. You technically could make a Telegram server if you were motivated enough. The server is just a relay for the most part.

That doesn't make it good by any stretch.

[–] [email protected] 4 points 2 months ago (1 children)

There is a reason the Russian government allow the use of it and even let their military use it - and it is not due to security! They have a backdoor into the chats and UAE it actively for listening in on things and spreading propaganda and disinformation.

[–] [email protected] 1 points 2 months ago (1 children)

Then why do the Ukrainians also use it?

[–] [email protected] 2 points 2 months ago

Nør for military communication. Just for public info

[–] [email protected] 4 points 2 months ago (1 children)

No

Although Telegram is probably better than Instagram, WhatsApp or whatever other spyware.

[–] [email protected] 5 points 2 months ago

Functionality-wise it definitely is, but secure wise no. There's probably same kind of tracking for profit going on in the background like with WhatsApp and signal. SimpleX is a better alternative privacy and security wise, but it's still in heavy development

load more comments
view more: next ›