It's amazing to me that people still consider Telegram a legitimate contender in choosing a messenger.
This blog post is far too charitable.
This blog post is far too charitable.
It's still likely better than WeChat FB Messenger in terms of privacy. You just get to choose the devil, and some consider Russia no worse than Facebook (and all that it represents) or China.
[1] https://en.wikipedia.org/wiki/Pavel_Durov#Dismissal_from_VK
>left the country with no interest in returning
Well, except for when he does
https://tjournal.ru/tech/52954-durov-back-in-ussr
http://uip.me/2016/04/dark-side-of-the-telegram/
https://lenta.ru/news/2017/03/20/durov/
https://medium.com/@anton.rozenberg/friendship-betrayal-clai...
https://theoutline.com/post/2348/what-isn-t-telegram-saying-...
The problem with Telegram's crypto is that Nikolai Durov is super-smart - he has two Ph.Ds in mathematics - but he thinks he's smarter than everyone else in the world put together, so Telegram roll their own crypto all the time, and keep being a worked example of why "don't roll your own crypto" is a saying.
So please stick to facts and what can be reasonably proven, please. The rest is meaningless noise and mindless hate.
The author himself admits it's much more likely this was an amateurish mistake than some man-in-the-middle conspiracy. Did you make it until the end of the article?
> Anyway, it’s been a while, the world is a different place now, and maybe Hanlon’s razor cuts deeper than I thought.
How else would you interpret it?
Neither is a good look for a security team, of course.
That’s not what the post is saying.
> It's very biased and uncharitable
It’s not “very biased”, if you actually look at what Telegram did the balance of probabilities leans heavily towards “backdoor” and not “not backdoor”
Besides, look at Pavel Durovs flagkilled reply here. The lady doth protest too much, methinks.
> The lady doth protest too much, methinks.
Solid criticism with well laid-out arguments from you, no doubt.
> Besides, look at Pavel Durovs flagkilled reply here.
Since when do upvote / downvote count mean anything at all about somebody's opinion or statements? (I haven't read the comment though.)
Look, it's obvious you have a beef with Telegram / Durov. But you are not giving any arguments, only snark. That's breaking HN's guidelines last I checked.
Maybe do that. Not being snarky, you’re missing important context.
Still, he's an official public face and should know better. That I fully agree with.
I am no cryptography expert. I judge by all the times I've seen programmers imagine they could do professional cryptography by themselves. Literally every time they fail. Thus, in my eyes it is more likely that Telegram's coders fell victim to the same illusion.
But I am not denying that it's possible it's the [beginnings of a] backdoor. The whole sub-thread is (a) my opinion on what's more likely and (b) calling out people who act snarky, offer no facts and demonstrate general negative bias.
It's really, really fishy.
The fact that a cryptographer might scoff and laugh at the proposition doesn't mean that a normal programmer couldn't fall victim to that illusion?
In any case -- yes. Both things are likely and you made a strong point for the "malice" side.
Still, it makes me wonder why would Durov run from Russia if he was willing to backdoor Telegram? Why not remain in Russia and backdoor it while being there? Why the extra trouble? Or maybe he didn't want to backdoor it for Russia but for other nation(s)?
Thanks for being one of the few to discuss constructively in this sub-thread. It's much appreciated.
Unless you put concrete % numbers on both sides then your replace is identical with the original.
...Bad faith? Most of HN has bad faith when it comes to Telegram. This place devolves to Reddit / 9GAG levels of childishness when Telegram is mentioned.
I think that's quite fascinating and it's a strange outlier. Yes -- strange, as in "not justified". They did nothing more wrong than a ton of other, much more widely used software, yet any mention of Telegram on HN brings about a big bandwagon of haters. Why do you think that is?
Would be curious to read a statement from Telegram's team though -- not that any team would ever admit to putting a backdoor...
Case in point: the Hanlon's Razor mention definitely did mislead me in terms of your stance.
In any case, no hard feelings were intended anywhere.
But that's what mostly what I was saying (granted, I got worked up at one point because the blind stereotyping puts a black mark on HN's reputation in my eyes) is that indeed the situation is ambiguous and both possibilities are [mostly] equally likely.
They shipped a backdoor. It's pretty clear that Telegram is actively malicious. They haven't been caught again? They probably realized that the front door of not encrypting chats was sufficient.
>The author himself admits it's much more likely this was an amateurish mistake than some man-in-the-middle conspiracy
This is not at all what the author is saying.
Unless you have another interpretation of the Hanlon's Razor, it seems that he is saying this is a mistake and not a backdoor.
> They shipped a backdoor.
Did they? Might be. I am 50/50 about it, people do dumb mistakes with self-rolled crypto all the time and that's a sad reality. But who knows, it might be the first try to embed a backdoor.
My point is: being too sure one way or the either makes you biased. I err on the side of incompetence but I am open to the possibility that it was a first sloppy attempt at backdooring Telegram. Sadly we have no proof of either, so we speculate based on what's available.
As said in another comment, I am no cryptography expert. I simply argue against the very visible negative bias against Telegram which is accentuated even more by very childish snarks on almost any Telegram HN thread. That gets to me and it's not how HN should be.
I never argued that my opinion is a fact. I said how I arrived at my opinion and debate with people whether that's plausible or not [based on limited info]. The rest can be proven/rebuked by specialists.
What's this "Telegram behaviour"? Seriously, enlighten me -- this is not a snark. I've been following HN Telegram threads for a long time and I've only seen the two things I mentioned above.
It's really puzzling, especially in a world where a ton of very public and everyday software has much more flaws than Telegram. The whole very directed and non-HN-esque hate towards it does stands out.
Multiple official Telegram clients do not even support the "secret chats".
Right from their own website https://telegram.org/
>Private
>Telegram messages are heavily encrypted and can self-destruct.
This is a lie.
>Secure
>Telegram keeps your messages safe from hacker attacks.
This is a lie, you can even pull someones telegram message history by sim swapping them FFS.
> This is a lie, you can even pull someones telegram message history by sim swapping them FFS.
Well, the mobile telecoms still have no solution for SIM swapping and most software uses SIMs as a way to uniquely identify users. I've heard of -- and used -- messengers like Signal and Matrix and the added inconvenience for not using a SIM is definitely off-putting even for me as a techie. So I can't blame Telegram or any other app for using SIM identification -- it's flawed, that's well-known in the tech community, but I suppose somebody made the call to risk this because they wanted adoption and didn't want to make onboarding too hard?
---
I can agree on a generally somewhat misleading marketing being a reason for negativity. Even a functioning backdoor might still mean that messages are safe from most hacker attacks though; the backdoor is only used on demand (it's infeasible to use it all the time, that would take too much server resources and would put the onus on the eavesdroppers to provide extra infrastructure I think?) and the unencrypted data is served to whoever asked for it behind closed doors. That does not mean that any hacker can get their hands on it though, right?
But even a somewhat misleading marketing can't explain the violent reaction of most of HN when Telegram is mentioned -- at least it can't explain it to me. There's so much popular and very shady software out there and somehow Telegram eats all the flak while many other software packages receive very generous benefits of the doubt.
It just sounds like the author simply doesn't want to get sued, after all it's generally impossible to prove that a backdoor is actually a backdoor.
>people do dumb mistakes with self-rolled crypto all the time
I've seen a plenty of those, this one just happens to look rather different than the typical implementation mistakes you see. There's no possible reason for this code to exists except to allow Telegram to decrypt secret chats.
In the end, we've got nothing to gain and a plenty lose by giving Telegram the benefit of the doubt.
You seem to be exposing a bias.
If by calling out people who break HN's guidelines I am exposing a bias then okay, I am exposing a bias then.
Last I used Riot/Elements (the app the uses the Matrix network), I almost pulled my hair out. It was slow and buggy. Felt like I was using an alpha version of a software from the late 90s.
Telegram and WhatsApp are two very positive outliers in a sea of very bad messaging apps IMO.