Hacker News Reader

That's the same as saying that a car model is safe because there have not been any crashes yet with this make and model. No cars are safe because there are industry standards that a manufacturer is tested to ensure they are following.

Closed source (both in code and implementation) has no place in the security world and anything security related should always be open for anyone to scrutinize.

View on HN

Feel free to scrutinize Telegram's crypto and E2E implementation for secret chats. It's open source and you can find it here: https://github.com/tdlib/td

Yep, did it, not going to use Telegram now.

Love the unsecure TLRPC objects deserialization that actually makes the native client crash and to not verify what other clients have sent: https://raw.githubusercontent.com/DrKLO/Telegram/e397bd9afdf...

and the tons of magic and undocumented numbers in the code: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

Crashing in the face of invalid and likely malicious input is a secure approach (fail fast).

Depends on whether the crash is intentional :/

RSA encryption is potentially exploitable by quantum computing. Still people are using it everywhere.

Reply on news.ycombinator.com