Hacker News Reader

protocol is weird

You’re repeating weird, but working with both bot api and tg api weekly or so (tg api through a wrapper, but I’ve read about lower level calls and used these in gramjs) I can’t see what do you mean by that.

View on HN

Maybe they are referring to the fact that Telegram rolled their own cryptographic protocol that had a vulnerability that was fixed with a cryptic message [1] and still has some dubious choices [2]. I am not a cryptographer by any measure, so I don't whether there was a reason why they didn't pick an existing protocol like OTR. But, it doesn't make sense to me that they didn't switch to another protocol that is audited several times but released a second version of their protocol with the same criticisms.

[1]: https://words.filippo.io/dispatches/telegram-ecdh/ [2]: https://crypto.stackexchange.com/questions/31418/signal-vs-t...

Meaning MTProto. Not the bot API.

So, crypto part or mtproto in general? I’m not a fanboy who is going to defend tg crypto, and personally I wonder why they didn’t use the same security stack e.g. my browser uses for gmail access. But apart from that it feels to me like a regular rpc protocol, clumsy sometimes, but nothing particularly weird. Working also with many stock exchanges protocols, I can tell these are sometimes weird af, despite being mostly over-https. E.g. bitfinex and iirc bitmex are funny ones, not to mention FIX/FAST or large exchanges native protocols.

Reply on news.ycombinator.com