Is Telegram really an encrypted messaging app?
(blog.cryptographyengineering.com)
from solrize@lemmy.world to privacy@lemmy.ml on 26 Aug 00:16
https://lemmy.world/post/19053192
from solrize@lemmy.world to privacy@lemmy.ml on 26 Aug 00:16
https://lemmy.world/post/19053192
Blog post by crypto professor Matthew Green, discussing what Telegram does (I wasn’t familiar with it) and criticizing its cryptography. He says Telegram by default is not end-to-end encrypted. It does have an end-to-end “secret chat” feature, but it’s a nuisance to activate and only works for two-person chats (not groups) where both people are online when the chat starts.
It still isn’t clear to me why Telegram’s founder was arrested. Green expresses some concern over that but doesn’t give any details that weren’t in the headlines.
#privacy
threaded - newest
Only under very specific circumstances.
same subject 3 hours ago ☞ lemmy.dbzer0.com/post/26612132
Hmm, so this is kind of a dup thread. I wonder if there is a way to lock and forward it, or at least mark it as a cross post. Thanks.
I mean really, we don’t need an entire article to explain how encryption works on Telegram.
Chats by default aren’t fully e2e. Your key must be kept on the server(s) to enable instant sync with other devices
There is a full e2e chat, you can enable this at any time. But, it doesn’t do groups, it’s only between 2 parties, and it doesn’t sync across devices.
Telegram’s encryption isn’t open source, so no one can verify it’s soundness or risks.
None of this is new info, it’s been talked about for 2 years now.
We really don’t need more than #3 for a reason to stay far away from Telegram. Security through obscurity is not security, and neither is rolling your own crypto.
Just note that the comment was inaccurate, in that their weird encryption is indeed open source at least.
Are there any programs that can do e2e in a group chat? My limited knowledge of e2e and encryption makes me think that’d be extremely difficult and even clunkier
Messages app by Apple. Not extremely difficult, but has its trade offs, and easier when all devices share a CA.
CA?
Certificate Authority
Doesn’t the concept of using a CA (which are generally also central authorities) go against the idea of E2EE that only required to (or more) endpoints or am I missing something? Signal group messages (and the protocol/concept behind it) work without a CA. I think I’m missing something, can you connect the dots for me?
The CA is purely a way to provide validation that the endpoints being connected are who they say they are; the actual signing certificates are still private. Apple uses a central directory; Signal depends on certificates linked to one way hashes of phone numbers.
Signal
Ah yes, the metadata collection app for the NSA.
Isn't Signal's whole thing that they reduce metadata as much as they can? What do you recommend? Matrix and XMPP certainly aren't options if you value metadata protection.
The phone number is the most important piece of metadata, and collecting numbers of people who want to use e2ee and are willing to use an app that’s inconvenient, then building graphs of these people and cross referencing the numbers with all the other data the government has is clearly valuable.
Whether other apps are better or worse in terms of collection of metadata is completely irrelevant when evaluating whether Signal itself is safe. However, as far as alternatives go Simplex simplex.chat seems to be one of the better options.
Even if no chat app protected metadata properly, that’s still an important fact to acknowledge. Furthermore, it may be more important for people to protect their metadata from a specific government that has agency over them. If you live in US or a US protectorate, then data being leaked to the US government is your primary concern.
I mean, Signal has over 100 million downloads on the Play Store alone. Even on the odd chance those phone numbers do somehow end up in the hands of the NSA or whatever the chances of it actually relaying any real information about you is second to none.
Even then, you can't assume everyone who uses Signal wants to use e2ee explicitly. Some might just like the app's style, some might have family members who only use Signal, some might have an ethical problem with corporate apps but aren't computer-brained enough to know how SimpleX or Jabber or some other obscure alternative works.
Is the phone number requirement bad? Yes, absolutely. Does that instantly rule out all opportunity for it being a good app, privacy wise? Definitely not.
Further; privacy should be simple. Signal is designed to be as close to perfect as it can be without compromising too much privacy. They have decided that a phone number is necessary to prevent spam, and to combat the privacy implications of that they have chosen not to block temporary numbers for those who are more concerned.
Private chat apps are useless if noone knows how to use them. Signal tries to fix that, and I think they're doing a pretty good job even if it does have it's pitfalls.
I think you missed the point there. The value for the NSA is in knowing which phone numbers communicate with other phone numbers which is precisely the metadata that Signal leaks. This allows you to build networks of users who are doing private communication. Next, you can cross reference the phone numbers with the data from Google, Meta, etc. and then if you see that one of them is a person of interest, then you immediately know the other people they talk to who are now also of interest.
The fact that people keep trying to downplay this is truly phenomenal to me. Once again, Signal is an app that uses a central server based in the US, that almost certainly shares data with the government. Anybody who minimally cares about their privacy should be concerned about this.
Signal is not an app that’s private. Period. If you don’t understand this then you don’t understand what the term privacy means.
Has this been confirmed? I had this theory before but got told this ain't true...
If the metadata is being leaked then you have to assume it’s being used in an adversarial way. Privacy can’t be trust based. Either the protocol is secure and it guarantees that your metadata is private, or you’re taking it on faith that people operating Signal servers are good actors and will never leak this data to anybody you wouldn’t want them to.
Also worth noting that thanks to US laws, Signal would not even be allowed to say they’re sharing data with the government even if they wanted to.
I have no doubt that signal will turn over whatever they had but does they have the info about who is contacting who?
I was explained that they don't
Obvi all this shit is a trust me bro
As far as I know, nothing in the protocol prevents the server from connecting who is talking to whom. In fact, given that the phone number is how an account is identified, the server effectively has to do this in order to pass messages between people.
Even then, you're jumping to the conclusion that
a) Signal sends this data to the NSA
and
b) Signal doesn't protect phone numbers in somr way
Neither of these do I care about enough to keep entertaining this conversation. Goodbye.
Assuming that data that can be leaked is being leaked is the only sensible thing to do if you care about privacy. Clearly this is too difficult a concept for you to wrap your head around.
Thanks for at least being honest that you don’t actually care about privacy. Bye.
Aint this is the rule among cryptography types anyway?
Right, and it’s strange to me that such a fundamental rule is being ignored when it comes to Signal. All of a sudden people start making all kinds of excuses as to why it’s not a problem in this case.
Group chat is a tricky problem and the modern crypto group (moderncrypto.org) talked about it at great length a few years back. I don’t know whether any software exists that incorporates all those ideas, but that’s mostly because I haven’t really been looking for it.
There is the MLS standard now that was explicitly developed with e2ee group chat applications in mind. From what I have read so far, this new standard seems well regarded by cryptography experts.
Thanks, I’ll ask my crypto homies about it. I remember they were trying to handle some subtle problems.
MLS info: en.m.wikipedia.org/wiki/Messaging_Layer_Security
Element (really any Matrix client that supports e2ee) but rooms with hundreds I’d people and having encryption enabled is going to to have lots of messages with key exchange errors.
PGP/GPG encryption. It works with any IM, social network, anything (at least if the platform/program/app/medium allows for sufficiently lengthy messages so to carry the encrypted payload). There are some IMs that bring PGP/GPG natively, as well as extensions for existing IMs that also adds PGP/GPG feature, but PGP/GPG doesn’t need to be native to the app to convey encrypted messages, it’s a base64 text. It’s really an E2EE.
Sure, I just have never used telegram or paid attention to it until that guy got arrested. So the quick overview by a cryptographer was helpful.
2 years? Try ten!
This is not true, it is available in the open-source Telegram clients.
What you probably mean is that it is using an unusual and not well studied encryption algorithm. This means you need to be a real cryptography expert to spot flaws in it.
Telegram justifies this with a bit of FUD about well known encryption algorithm being NSA sponsored etc, but when cryptography experts did look at Telegram’s homegrown algorithm they were less than impressed.
As I recall, Telegram put up bounties for people actually demonstrating exploits in its encryption. Have any of these cryptography experts actually shown exploits?
telegram put up bounties relating to specific properties of their encryption, yes but there’s more to private messaging than just encryption… for example afaik it’s trivial to do things like replay attacks
their encryption may not be flawed, but they failed to design an algorithm that protects against the wide array of modern attacks, as they are mathematicians; not security experts. they understood the maths, but not the wider scope of implementation
a good example of these is linked down thread about MLS
the telegram bounties afaik only cover 1 security property
But can you provide an example of an actual flaw being demonstrated by anybody with or without a bounty?
i neither have the time nor inclination to research to that degree - i’m merely saying that the bounties prove very little, and change nothing about how people should treat non-standard protocols and algorithms. in fact, the lack of substance is proof that they don’t fully understand the scope of what’s required in the field of security
And I’m saying that despite people constantly throwing shade on the protocol, nobody has actually showed any flaws in it over many years. The whole dogma that non-standard protocols and algorithms should be shunned out of principle is just that. Meanwhile, plenty of exploits have been found in standard protocols. Not only that there are known cases where US security agencies introduced exploits into popular protocols. theverge.com/…/nsa-paid-10-million-for-a-back-doo…
This is pretty good, a discussion of possible motivation of the founder’s arrest, and comparison with an earlier scuffle involving the RIM Blackberry.
oblomovka.com/…/pavel-durov-and-the-blackberry-ra…
They can shut off that server whenever they want and then it won’t matter how encrypted your unsent message is.
Telegram is service as a software substitute.
Not quite
SaaSub is when you have a server do your computing for you. This is just delivering messages. You technically could make a Telegram server if you were motivated enough. The server is just a relay for the most part.
That doesn’t make it good by any stretch.
No
Although Telegram is probably better than Instagram, WhatsApp or whatever other spyware.
Functionality-wise it definitely is, but secure wise no. There’s probably same kind of tracking for profit going on in the background like with WhatsApp and signal. SimpleX is a better alternative privacy and security wise, but it’s still in heavy development
en.wikipedia.org/…/Betteridge's_law_of_headlines
Is Betteridge’s law always correct?
<img alt="close-up of sweating guy from two buttons meme" src="https://lemmy.ml/pictrs/image/0f83ce8c-7130-47fd-a25f-962d8a3fccfc.png">
No.
There is a reason the Russian government allow the use of it and even let their military use it - and it is not due to security! They have a backdoor into the chats and UAE it actively for listening in on things and spreading propaganda and disinformation.
Then why do the Ukrainians also use it?
Nør for military communication. Just for public info