Telegram probably isn't as secure as ISIS thinks | Hacker News Reader

Telegram probably isn't as secure as ISIS thinks

motherboard.vice.com

83 pointstptacek64 comments

If you wondering why cryptographers haven't claimed the $300,000 prize offered by Telegram, this is a good start:

http://thoughtcrime.org/blog/telegram-crypto-challenge/

I don't think you should use Telegram.

What should I use for casual, daily chatting with friends that runs on Android, iOS, Linux, Windows, Windows Phone, web, and allows group messaging and message history search?

I keep seeing these dire warnings whenever Telegram is mentioned, and I don't understand the hate. Is it some super secure platform? Probably not, but people needing a provably NSA-resistant chat client is such a tiny percentage of the people interested in regular chatting. None of the warnings I see have the nuance of "don't use it if you think it'll keep you safe from the government, but otherwise it's a pretty nice service to use" nor do they list the chat services that they feel are more secure.

Compared to the alternatives of Skype, WhatsApp, SMS, Hangouts, iMessage, etc it's a good chat service, with a relatively lightweight native client on multiple platforms, actual working sync, and good recovery when used on poor Internet connection.

People don't like Telegram because they claim to be a company which cares deeply about security and privacy, offering a "200% secure" chat client, while blatantly ignoring the concerns of the security community. Doing things like using a hand-rolled, proofless KDF isn't just a bad idea when considering a nation-state adversary. It's a bad idea against every adversary. It's the cryptographic equivalent of staking an ADT sign in your yard without purchasing an alarm.

It is unethical to market snake oil.

> I keep seeing these dire warnings whenever Telegram is mentioned, and I don't understand the hate.

The hate stems from two main sources:

1. They're claiming to be secure in a very flamboyant (even arrogant) manner by challenging the world's cryptographers to break their protocol, but the contest is structured to be unwinnable regardless of how shitty their crypto actually is.

2. Telegram spends less time improving their crypto (which is full of WTFs) and instead markets themselves to people who aren't technical enough to figure out how shitty it really is.

Seriously, avoid Telegram. If you want Signal to work on more platforms, send a check to Open Whisper Systems and help them build up their team to cover more area.

Terrorists are secure whatever they do.

The 4 or 5 people in the nsa that actually do any work don't stand a chance against several hundred million baby breeders with ak47s.

The press have been bad-mouthing our cars recently based on the fact that they explode violently if they crash.

Are they super-duper safe? No. Will driving our cars grant you immortality? also, No.

But no car can promise this, and driving any car inherently runs the risk of dying - No car is provably 100% safe! If you're really worried about this, just don't drive!

Most car drivers won't care anyway, very few people crash their cars on a day-to-day basis, so it's not really relevant.

</good-natured-sarcasm> exaggerated/straw-man comparisons, or appeal-to-low-standards doesn't really satisfy these kind of concerns... <good-natured-sarcasm>

"Telegram is a messaging app with a focus on speed and security...."

If it's not actually secure then they shouldn't advertise it as secure.

An app that advertises itself as secure but isn't is naturally going to attract more hate than an app which doesn't advertise security in the first place.

Nobody forced them to advertise security. If they just wanted to be a a good chat service with the advantages you listed, they could just do that. But if you advertise security, you had better deliver!

Edward Snowdon recommends Signal from Open Whisper Systems.

And it's a good recommendation, IMO. Still not something I'll ever use because it too slurps up contacts. I mentioned this some time ago, and the responses were interesting - from "that's not a bad thing" to "but they do it in a nice way".

Claiming to be secure, and then taking what's mine away from my control is unacceptable to me.

Signal doesn't upload your contacts anywhere. That was the whole point of their "Private Contact Discovery" blog post. ("How do we determine which contacts are registered with a service, without revealing the contacts to the service?") [1] A hard problem that no other messaging app has bothered to solve, AFAIK.

Yes, Signal The App reads your contacts to construct the blinded signature query. Does it then do something nefarious with them? No: https://github.com/WhisperSystems

What alternative solution to the PKI key introduction problem would you rather see? You could go the iMessage central key broker route, but that means trusting that Apple won't introduce the wrong key to you (or be compelled to do so). [2] Or, you could let users exchange keys in person a la key signing parties. That's a reasonable feature request at this point, but advanced usage and not something that gets you traction with normal people. TextSecure/Signal wouldn't have gotten to where it is today with that much friction around key introduction.

[1] https://whispersystems.org/blog/contact-discovery/

[2] http://blog.quarkslab.com/imessage-privacy.html

I have not carefully checked, but based on the paragraph from your contact discovery link

For RedPhone, our user base is still manageable enough (for now) to use the bloom filter technique. For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out.

I would expect that Signal does share contact information with the server.

I believe that comment is out of date, since there are multiple entries on the support forum about what to do if the contacts bloom filter fails to download. [1] [2]

But now you've got me curious. I'll dig back into the code and find out for sure.

[1] http://support.whispersystems.org/hc/en-us/articles/21274348...

[2] http://support.whispersystems.org/hc/en-us/articles/21247614...

Redphone was only on IOS and there are not similar entries under Android->Signal.

It'd be nice to figure it out, but I guess it isn't that important, Signal still leaks lots of metadata, so anyone that would be burned by sharing their contacts isn't gaining much by using it (or any other mobile comm...).

Phil Zimmermann has developed a new protocol, which Silent Phone uses, which makes it impossible (or very hard) for the server to know the contacts on your phone while doing discovery.

I'm going to write up the protocol and publish a reference server I wrote in Go in a few days. I'll post it here and send it to Open Whisper Systems as well, they may want to integrate it.

Just a bookmarking comment

Just in case you don't know, if you upvote a comment then it becomes available on your profile page under "saved comments."

Obviously, if you're extremely liberal with the upvote button, this may not be useful as a bookmark....

Why not bookmark the link to comment though?

If you mean a browser bookmark, I personally fell out of the habit of using those ages ago, because syncing them was way too difficult.

I think I should make a bookmarklet for HN to do additional things like this.

Useful?

I would call it Show.hn :-)

Thanks, I was unaware

Just a notification comment:

https://github.com/SilentCircle/contact-discovery

Considering the source is available - https://github.com/WhisperSystems/ - it should be reasonably straightforward to take the piece of code out that accesses your contact list? (On iOS, and by the sound of it, latest Android OS, you can also just disallow contact access via the system UI.)

I'll use it once I don't need google services and a google account to run it on my android phone.

I don't know about the Google account requirement, but you can use gmsCore to replace Google Play Services:

http://o9i.de/2015/10/23/howto-gmscore.html

I've been using the unofficial fork[0] that uses Websockets instead of google stuff. Been working awesome for me.

There's even an fdroid repository[1] you can add to track libreSignal apks.

----

[0] https://github.com/JavaJens/TextSecure [1] https://fdroid.eutopia.cz/

I'm in the same boat. I use Telegram. Not because it's secure (I don't know, I believe others that claim that it might not be), but because it works for me.

WhatsApp (most popular?) doesn't. ChatSecure (most secure?) doesn't.

I'd say 'Use Telegram' with the caveat that you shouldn't trust it blindly? Use it as a better and cross-platform SMS/text experience, which might or might not be more secure.

If you're a Telegram user who's cautious with what you say, assuming that anything you transmit could potentially be intercepted, you will certainly be more secure than a {Chat,Text}Secure user with complete faith in their technology.

Edited to add: The same could well be true for someone using plaintext.

Just use Telegram and ignore people with obvious beef against it. At least it's not Hangouts or Facebook chat.

What do you mean "at least"? You're better off with Hangouts or Facebook chat - Telegram flags you up as someone trying to hide, while not offering any actual security.

It has 60 million monthly active users, and it doesn't even encrypt by default.

I think I agree that using encryption on Telegram singles you out though!

and google is probably an open system to the NSA and US government, you dont need to even appear to be someone who has something to hide they will target you because they easy have access to your data.

Obviously the same app will not run on every possible platform. So the question should be; what protocol should I use for casual daily chatting? Message history search would be the part implemented at the client level.

This tendency to talk about the name/brand of the client instead of the protocol is a current problem with IM. The ISIS people should really be writing articles about OTR and TOR to address their particular application.

I have a friend that thinks I use the Pidgin chat system because that is what she uses when she chats with me on XMPP. Since Pidgin does not run on her phone she thinks she can only chat with me when she is at her computer. So far all attempts to explain the idea of an interoperable protocol have failed.

Da'esh, ignoring the fact that they're a terrorist organisation, are actually trying to solve an interesting problem, which is, they need to be both secure, but also engage with/recruit people who are not so tech savvy and are used to easy social media apps with simple UX - basically they NEED to be BOTH secure AND accessible. So whilst they likely know of more secure options like PGP or OTR, these are not what their target audience are using or have the capability to use - they are interested in keeping the dragnet for new recruits wide, so have to tailor their approach for the current generation, hence Telegram, which is supposedly secure and also already making inroads in the current market as an alternative to WhatsApp, and is less geeky than something like Signal.

I remember years back when I attempted the same problem with a thing called Wire, for activists, that I posted on here and combined Facebook/Twitter type stuff with "secure" messaging, which was a web based UI that implemented AES256 based browser encryption based on the Stanford JS library. I got thoroughly roasted by people that knew what they were doing, so I shut the project down realising that what I was doing was dangerous due to lack of qualification. It's interesting seeing all the projects that have sprouted up since, and clearly I was on the money with the initial idea.

https://github.com/radiosilence/wire

Facebook messenger, since privacy wasn't in your list of requirements. At least then you won't have the illusion.

Telegram is private enough (unless you are in a list somewhere)

FB Messenger works fine but of course is not private w.r.t. FB

Seems a good enough reason to use something different

Telegram. For secure things, Signal/ChatSecure or something else by moxie. For 99% of the shit you do, the convenience will usually outweigh the limitations brought on by doing crypto properly, for instance not having a desktop client.

Aside from Windows Phone does CryptoCat cover it?

Message history search? Do you even want to use a secure messaging app?

Considering this or the other blogpost about Telegram "waving their math PhDs" is under literally every Telegram-related comment section I've ever been in on HN, I think people know.

What do you think about https://threema.ch/en?

https://threema.ch/en/faq/why_secure https://threema.ch/validation/

It's closed source.

So did they follow up with the promise to relax the contest framework (as mentioned by Durov in the comments)?

They did, which ended in February (https://telegram.org/blog/cryptocontest-ends) - I've also seen mention of a round 3 with even more relaxed rules due for around now, but I can't find it anywhere now.

It was awesome how the post refuted the challenge using an entertainingly bad protocol.

It really bothers me that VICE Motherboard (I've not read much from their other sections), who markets themselves as a controversial, alternative news source, distinguishes themselves by publishing more reasonable and better researched articles.

I've never gotten the impression from any other reporting (Wired, CNN) on this issue that they so much as skimmed Moxie Marlinspike, Michael Green, or anyone else's criticisms of Telegram.

How can one even remotely think that an app like Telegram can be secure, as long we know the very platforms it's running on are hackable (there are more than enough 0days on the market)?! Yeah, maybe it's expensive and a bit friendly-fire-ish to target platform holes on a large scale, but still...

My bet is that the real bad guys always use face2face when possible, and voice/video with codewords and visual cues when there's no other choice... and maybe an encripted sdcard carried by hand/mail when they really need to cary large volumes. They can't be stupid enough to use anything else for such high risk stuff!

I'd guess that the only people actually depending on good consumer-lever crypto are whistleblowers, anti-goverment protesters and individuals and companies that truly value their privacy for one reason or another! Are these the people we want to hurt here?!

Glad at least one person mentions it albeit near the bottom of the comments. I've been telling them that since before the Snowden leaks. Nice summary of required assurance activities and areas where issues pop up:

http://pastebin.com/y3PufJ0V

The one exception is Ottela's Tinfoil Chat. It needs a robust, low-level implementation instead of Python. Yet, he cleverly dodged much of the TCB problem by creatively applying what he learned from others plus input we gave him on Schneier's blog for high assurance security & general improvements. So, you can build on and use that* but the rest depend on what top-tier and organized crime can buy attacks for. Ridiculous....

* Again, without Python and with TCB enhancements. OpenBSD at the least for its lower 0-days.

The most disappointing thing about Telegram is that they are completely unwilling to accept any kind of criticism or use any outside suggestions for improving their crypto. Kind of goes against the whole "open source" thing they're doing there.

Also the fact that it doesn't even have end-to-end encryption by default means it shouldn't even be in the same class as "secure messengers". It's better suited in the Skype/Hangouts class of apps.

The thing is that as a random user, you might want to keep the content of your message secret for various reason (like ad profiling for example).

Once you are more or less identified as a terrorist, from the point of view of an intelligence organization, they might be sad to not get the content of the messages, but is they can have the graph of your contact, they'll be more than happy (and find the weakest link in there).

Incidentally I have also checked that the Telegram and Signal app are requesting a Location permission on Android. I don't know if it is sent to some sort of central server, but this does seem not safe if youe life depends on it.

Misleading title. This has nothing to do with privacy and encryption. Just to quote a couple of recent Pavel Durov's tweets: "To media covering us this week: Telegram channels are public broadcasts. They are the opposite of private chats. Please don't mix the two."... "Our policy is simple: privacy is paramount. Public channels, however, have nothing to do with privacy. ISIS public channels will be blocked."

Here's why Telegram is important: it is the only communication service with mass worldwide adoption that isn’t backed by a corporation, venture capitalists, or a government.

Everything else—including the company's cocky and downright insulting attitude—doesn't matter nearly as much. I actually think a lot of what they say gets lost in translation.

We recently integrated with Telegram (without their knowledge, support, or blessing, of course—because Telegram), which sent me on a little research journey. Results are here: https://sameroom.io/blog/announcing-support-for-telegram/

You mean its security or impressions from a pro looking at its code matter less than who backed it? I think not. Its design, implementation, and evidence they're correct matter more than who backs it. It has to measure up before those things are even an issue.

Confirming ISIS uses your app probably isn't the best way to secure future investors. ;)

A number of intelligence services with growing budgets would be happy to invest in such an app.

No idea about credibility of the sources used, but I stumbled over this: http://revolution-news.com/us-government-funds-favorite-nsa-...

edit: atm. 111 points and I love that. Wish pg could fix my karma, I really like even numbers and I feel that the karma crave is addictive..

btw. I agree with you. It's clever and the tools intelligence services have created for these purposes are fascinating

Depends on what kind of investors you're looking for

I thought it was actually pretty good for marketing.

probably not if the headline is "Telegram probably isn't as secure as ISIS thinks"

I found this headline quite refreshing, every other news source I've seen cover it discusses terrorists using Telegram and Signal to "go dark."

Well, the headlines in regular news outlets are completely different. Something along the lines of "The terrorist have been using encrypted 'app', were stopped by owners".

If the headline is true then that is excellent.

But I think Pavel Durov should make a system that gives up terrorists' communications if it detects indicators eg words that will lead to planning a violent attack. And without informing everyone about it.

Nicely implemented chat services are in demand, or so it seems. They might be sold into the billions and monetized with ads, and I guess the negative spin comes from purely business origin, though disguised as concerns of crypto professionals.

BTW, if Telegram crypto was that much insecure why members of the so-called "security community" haven't yet compromised the Telegram chat for real (regardless of any contests and petty rules) and proven they had been right?

I don't rule out this as impossible - I just think that without such proof it's all just a kind of stupid whining.

All of the metadata problems he complaind about also apply to Signal.

Reply on news.ycombinator.com