133
Is Telegram really an encrypted messaging app?
(blog.cryptographyengineering.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 25 Aug 2024
133 points (96.5% liked)
Privacy
31609 readers
85 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
This is not true, it is available in the open-source Telegram clients.
What you probably mean is that it is using an unusual and not well studied encryption algorithm. This means you need to be a real cryptography expert to spot flaws in it.
Telegram justifies this with a bit of FUD about well known encryption algorithm being NSA sponsored etc, but when cryptography experts did look at Telegram's homegrown algorithm they were less than impressed.
As I recall, Telegram put up bounties for people actually demonstrating exploits in its encryption. Have any of these cryptography experts actually shown exploits?
telegram put up bounties relating to specific properties of their encryption, yes but there’s more to private messaging than just encryption… for example afaik it’s trivial to do things like replay attacks
their encryption may not be flawed, but they failed to design an algorithm that protects against the wide array of modern attacks, as they are mathematicians; not security experts. they understood the maths, but not the wider scope of implementation
a good example of these is linked down thread about MLS
the telegram bounties afaik only cover 1 security property
But can you provide an example of an actual flaw being demonstrated by anybody with or without a bounty?
i neither have the time nor inclination to research to that degree - i’m merely saying that the bounties prove very little, and change nothing about how people should treat non-standard protocols and algorithms. in fact, the lack of substance is proof that they don’t fully understand the scope of what’s required in the field of security
And I'm saying that despite people constantly throwing shade on the protocol, nobody has actually showed any flaws in it over many years. The whole dogma that non-standard protocols and algorithms should be shunned out of principle is just that. Meanwhile, plenty of exploits have been found in standard protocols. Not only that there are known cases where US security agencies introduced exploits into popular protocols. https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-million-for-a-back-door-into-rsa-encryption-according-to