The story of Telegram or “Why you shouldn’t listen to Hacker News”
paulmillr.com
paulmillr.com
I think the gap in understanding here, is that when it comes to security, cryptography in particular, it's not the case that the critic has to demonstrate where something is broken , the responsibility is on the part of the developer to prove that, in every possible manner, the system is secure.
The telegram people, on the surface, don't appear to be familiar with the crypto-community best practices, and, as a result, are unlikely to have made a product that would survive any real scrutiny, and highly unlikely to survive any actual attack on their protocol, should any adversary desire to do so.
Telegram are advertising a system which they claim is encrypted end-to-end, which means that even with physical access to the servers which are routing messages, one would not be able to perform MITM attacks. However, the contest is an obvious farce because they're asking only to demonstrate flaws which can be done externally without the same access to servers that Telegram have.
It's obviously simpler for someone knowledgeable in cryptography to be critical in a few sentences than to demonstrate vulnerabilities with actual proof of concepts which require lots of work for no apparent gain other than to make a point. If Telegram were offering $100k for every flaw found in their system though, you can bet that there would be less mouthing on HN, because people would direct their effort at demonstrating the flaws.
- Telegram said they were super-secure
- A bunch of skeptics on HN posted long comments saying why Telegram wasn't actually secure
- A few days later, someone broke Telegram
- Therefore, don't listen to HN?
This is fine in art, but it runs into problems when you start doing engineering and it makes absolutely no sense whatsoever in cryptography.
This piece is garbage with a very clear undertone of bitterness that is completely unrelated to Telegram.
But I see post on page 3 from 3 hours ago with 3 upvotes so this should be somewhere on 1-2nd page.
HN mods don't like criticism?
Or enough people found your arguments so astoundingly bad that they flagged it off even those pages...
As DanBC posted[1] in the other thread:
>>You seem to be mistaken about why they do this. It's nothing to do with pushing their app or their approach. They'd welcome good well-formed apps to compete with them. But when they see an app that claims to be secure they have an ethical duty to let people know if it is obviously not secure.
>>Most people are not bashing just for the sake of bashing. Some people need good cryptography software to avoid imprisonment, or torture, or state-killing. This isn't about stopping someone's teen-angsty poetry from being discovered by a sibling, it's about protecting political dissidents from an oppressive regime. In that context pointing out that a software is broken is not mindless bashing, it is a crucial part of the cryptography process.
>Go make your own stuff and don’t listen to HN or any other skeptical community.
Unproven cryptographic systems masquerading as secure need to be criticized. It is very, very dangerous when non-crypto people pretend to be crypto people and call their systems secure.