Hacker News Reader

Comment by ge0rg | Hacker News Reader

I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud":

MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing the data, and passes that to importContacts() [1], which performs an RPC call to "the cloud", passing the contact list upstream and obtaining a server-processed list as a reply.

For me this is a major trust breach, and makes all the fuzzy claims about the app's security absolutely worthless.

[0] https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

[1] https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

View on HN

That is correct, Telegram does upload names and numbers — naturally, after receiving permission to do so. (see also: http://telegram.org/privacy)

Apart from identifying Telegram users among the user's friends, this also enables us to use proper names in notifications on the iPhone, as well as facilitates moving between devices.

But you have highlighted an important issue. Our android developer relied on the system prompts when it comes to uploading contacts, which is definitely not enough for the issue at hand. We will add another prompt in the coming version. (As well as update the GitHub code to the current generation soon, it's been becoming a little stale.)

naturally, after receiving permission to do so.

This is not quite true. I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services. You can not actually imply that permission from all contacts merely by asking the user.

this also enables us to use proper names in notifications on the iPhone

I do not know enough about the iOS internals, but my naive assumption would be that after receiving a push notification, you can run code locally (like get the contact name from a local database), not merely get the notification displayed by the OS.

We will add another prompt in the coming version.

This is an improvement, but unfortunately does not tackle the first issue I mentioned, with implying consent from the actual contacts.

> This is not quite true. I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services. You can not actually imply that permission from all contacts merely by asking the user.

Thank you, that was exactly my first thought.

In general, since we all are represented in other peoples' contact lists, it's worth considering what those other people are going to do with our data.

And it's not just the people you correspond with directly. I have a lot of people in my Thunderbird and email provider lists who I have no idea who they are, because someone in a chain of someones sent out a broadcast email with their address and my address.

Which means that if I were the sort of person to "upload my contacts!" I would have exposed people two or more hops away from me to whatever "service" I'd just submitted to.

Uploading your contacts may become the net equivalent of farting in public; it's rude.

They're actually correct about the notification use case - the server has to generate the message text that is displayed, and no application code can be run unless the user taps the notification and launches your app.

"I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services."

On Android you do by granting rights to access your contacts and give full network permissions. So you never know what a program will do with your contacts and a network connection.

But in the real world,your contacts never told you "feel free to upload my name and all my phone numbers wherever you want, so we can be linked by some cloud service to improve their click-through rates". An app that uploads your contacts is violating the privacy of your friends, even if it asks you about it.

> That is correct, Telegram does upload names and numbers

Ugh, this is such douchebag behavior for something that purports to be a "secure" app. Stop it immediately, please.

Just read the rights dialog instead of clicking "ok" and deny that right. Problem solved!

How can I deny one right from the rights dialog in Android?

They need todo this to know which numbers are also using Telegram. Whatsapp does the exact same thing.

Sorry, but this is just a lame excuse. There is no need to upload the personal names for this feature.

Also, there are approaches to make number registration lookups more secure, e.g. bloom filters: http://en.wikipedia.org/wiki/Bloom_filter

I would expect such an approach from a "secure" app.

Don't Bloom filters provide just an illusion of privacy when talking about phone numbers because its easy to iterate through every possible number?

I am not quite sure how the dimensioning of the bloom filter affects the false positive probability. Of course it is easy to iterate through many phone numbers, but at least you can not know for sure if a probed number is actually in the filter or just a false positive, giving means of plausible deniability.

I did not want to imply that there is a perfect zero-knowledge synchronization mechanism for your contact book.

Also, how can you claim to have a secure app when it runs on a closed-source operating system? (Even more, we know about Microsoft handing over security holes to the NSA - why would Apple or Google not do the same?).

It's like saying "this heat is really cold". In other words: a contradiction in itself.

Only open-source apps on open-source operating systems can start making claims about security and trustworthiness.

Only open-source apps on open-source operating systems [..]

...running on Open Source hardware.

Many modern smartphones employ a baseband processor and an application processor with shared memory. While the app processor might be running an open-source compiled Android, the baseband processor is usually on a closed, not externally verified (and very buggy) RTOS provided by the manufacturer (Qualcomm, MediaTek, TI, ...)[0].

Owning the baseband is sufficient to gain access to the raw RAM of the application processor, to read any IM messages and keys, to manipulate data, code and whatever else you like. And all this is completely undetectable by any "antivirus" software running on the app processor.

[0] http://www.youtube.com/watch?v=fQqv0v14KKY

> running on self-manufactured hardware

FTFY. Open sourced hardware by itself is of no practical use because the guy who manufactured it for you might have altered it in production.

And let's not forget to consider a "trusting trust" attack on the hardware you use to manufacture the processor.

Reply on news.ycombinator.com