CryptoFails

I was just about to post something similar. I'm actually surprised to see a positive post of Telegram on HN. For the love of crypto, please stick to Signal protocol-based messaging applications. https://en.wikipedia.org/wiki/Signal_Protocol Edit: add link http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co…

> As RSA and finite-field DH aren't broken No, but their implementations often are. For a recent example (Zend Framework, just at the end of 2015): http://framework.zend.com/security/advisory/ZF2015-10 More famously: http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1 RSA has more knobs to turn than EdDSA, and leads greater room for implementor error.

If you use bcrypt (which we recommend), you're technically using a variant of BASE64 too. The title is a reference to a meme ("You wouldn't download a car!") and also a reference to some absurdly bad cryptography, e.g. http://www.cryptofails.com/post/87697461507/46esab-high-quality-crypto…

http://cryptofails.com -- I believe they're referring to 46ESAB the worst password hashing algorithm ever

http://blog.cryptographyengineering.com/ He posts more regularly on Twitter, and his tweets are pretty interesting: https://twitter.com/matthew_d_green https://www.imperialviolet.org/ http://www.cryptofails.com/ http://blog.cr.yp.to/index.html (new) https://whispersystems.org/blog/ (good team to follow on their progress) https://moderncrypto.org/ (new)

Eh, thanks for the info on MTProto2. They made poor decisions initially, and doubled down on them, and thus I didn't (and still don't) think it worth my time to follow their changelog. The contests are not remotely sufficient. Here's a good article: https://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-c… "I’ll repeat it again: If you want to show that a system is secure, give the adversary as much power as possible, and if they still can’t break it, the security is good." Secure protocols take a lot of expert analysis to build consensus that they're worthwhile. That requires engaging with the community of researchers on their own terms and using established best practices. Finally, Telegram's server code is still closed source and thus can't be reasonably audited. Could an attacker (or state actor) with server access decrypt stored messages? Maybe! That's why default e2e encryption with well-audited, open-source code is the gold standard...

The blog post in question (which I wrote) literally opens with a link to https://www.cryptofails.com/post/75204435608/write-crypto-code-dont-pu… that encourages people to learn about it! Yes, even if that type of learning means (privately) writing crypto code. Why would you expect the comments about it to argue in favor of "still learning" when the blog post never advocated against learning? They aren't making this point because I didn't make the contrary one, so there's nothing to argue with. That you're only seeing negativity and discouragement is a cognitive distortion. I'm not qualified to help people with those, but I hope pointing that out might help you see that the world isn't against you. That software developers presently and generally are bad at understanding cryptography doesn't mean it's impossible to learn, or that you should be discouraged from learning.

wat Look here is the most criticism that was given https://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-c…

Telegram does not use Signal's protocol, Telegram's protocol is designed from scratch. https://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-c…

Telegram is far from perfect, according to this investigation: http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… Why not use, say, Ricochet? Or any other secure messenger (https://prism-break.org/en/all/#instant-messaging)

Telegram is the company that ignores proven crypto standards, rolls their own crypto without any verification or audit, then offers a $200k bounty to "break" their crypto by requiring developers to work with an arm tied behind their back by reducing the types of attacks that could be made in the real world. Seems MTProto is the same as its always been https://news.ycombinator.com/item?id=6931457 http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co…

Encrypted with their home-grown crypto. Telegram is not fully free and open source. Encryption by default? That has to be new, it was not when I recently checked. And of course there is http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… Use Signal/Textsecure, folks.

“Never ascribe to malice that which can adequately be explained by incompetence.” Remember stuff like this: http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1 (Which, possibly unfairly, is one reason I'm leaning more towards ansible than saltstack to this day -- I mean, if stuff like that got through... what else, in more complex areas of the system?)

http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… Also, messages are not encrypted by default, and there is afaik no way to encrypt group chats. You have to create a special "secret" chat for the messages to be encrypted.

I think you're probably right there. Here are moxie's comments on it: http://thoughtcrime.org/blog/telegram-crypto-challenge/ And here's a thorough trashing of their crypto: http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… I'm not a cryptographer either, so I can't comment on how accurate that last link is, but I tend to trust moxie, and if he thinks it stinks, well.....

Did they redesign their protocol? I jumped on the TextSecure bandwagon. http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co…

Why is this on top of HN? Their protocol is not secure and they do not encrypt 1:1 chats by default and encrypting group chats with end to end is not even possible!!! Guys, please read http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… and http://thoughtcrime.org/blog/telegram-crypto-challenge/ and go to more secure things like Threema or Textsecure!

you shouldnt trust closed source software also there are numerous complaints about their security model. See http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… for example. Why not use an open source, cross device alternative? https://www.surespot.me/

Telegram is a centralized service. Also, consider this http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co…

Taylor Hornby has written a good introductory explanation of the Known Plaintext Attack model and the more powerful attack models, in the context of the Telegram cracking contest: http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co…

I have an alternate explanation: It's easier this way. I'm not attempting to downplay Dropbox's (or anyone else's) efforts, but Crypto Is Hard. Really Hard. Once you try to implement zero-knowledge full encryption, it gets Really Freaking Ridiculously Hard, some cool things stop even being possible (Web access? Sorry, no can do.), and it becomes easy to fail while appearing to work (see e.g. http://www.cryptofails.com/2013/07/synergy-integer-overflow-key-reuse-… ). Also, there isn't (yet) a mass demand for such features, and there are smaller providers offering those.

The sad truth is that even libsodium can be misused (and the article explicitly mentions that twice). Even pretty high-level constructions like libsodium's crypto_secretbox can be misused, and most of the constructs that libsodium exposes are quite low-level: crypto_sign_detached, crypto_kdf_hkdf, crypto_kx, crypto_generichash. I think we should understand and teach "do not roll your own crypto" in the context of what constructs are used for what purposes. AES is proven to be secure and "military-grade" if you need to encrypt a block of data which is EXACTLY 128 bit (16 bytes) in size. If you want to encrypt more (or less) data with the same key, or make sure that the data is not tampered with or even just trust encrypted data that passes through an insecure channel, then all bets are off. AES is not designed to help you with that, it's just a box that does a one-off encryption of 128 bits. If you want do anything beyond that, you go into the complex realm of chaining (or streaming) modes, padding, MACs, nonces HKDFs and other complex things. The moment you need to combine more than two things (like AES, CBC, PKCS#7 padding and HMAC-SHA256) in order to achieve a single purpose (encrypting a message which cannot be tampered), you've rolled your own crypto. Libsodium's crypto secretbox is safe for encrypting small or medium size messages that will be decrypted by a trusted party that you share a securely-generated and securely-managed key with. It's far more useful than…

WhatsApp is almost certainly safer and more privacy respecting than Telegram. Telegram uses highly nonstandard cryptography (the founder hired a bunch of math competition winners and told them to design encryption from first principles), doesn't have E2E by default (unlike Whatsapp), and is owned by a quite sketchy Russian oligarch who started spending on democracy-related causes after a falling out with Putin. Telegram uses dubious encryption and lies about their business (for ex calling themselves a nonprofit when they aren't), and they retroactively retracted and then narrowed their bug bounty program. WhatsApp hired the company behind Signal to help them implement Signal's encryption protocol.[1] While it's not as good as Signal because it's not open source and thus can't be independently verified, if Facebook deliberately lied about the security of a product used by governments around the world they would face serious consequences.[2] See for example previous discussion [3]. For a detailed analysis of the flaws in their protocol, see [4] 1: https://techcrunch.com/2014/11/18/end-to-end-for-everyone/ 2: https://www.nytimes.com/2019/10/26/world/asia/afghanistan-whatsapp-tal… 3: https://news.ycombinator.com/item?id=15281788 4: https://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-c…

Basically, the problem is that they invented a lot of their own crypto from scratch. When asked about this, they said "it's fine, we're smart" and then claimed to prove their security with a red herring contest. Here are some publications about security problems with the platform: - A class project at MIT found several problems (May 2017) [0] - They were featured on Crypto Fails (Dec 2013) [1] - Jakob Jakobsen @ Aarhus University published a vulnerability discovery (May 2015) [2] and then did his Masters thesis on additional problems (Sep 2015) [3] -Tomas Susanka @ Czech Technical University in Prague published additional vulnerabilities (2016) [4] Plenty more out there. [0] https://courses.csail.mit.edu/6.857/2017/project/19.pdf [1] http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… [2] https://eprint.iacr.org/2015/1177.pdf [3] http://cs.au.dk/~jakjak/master-thesis.pdf [4] https://www.susanka.eu/files/telegram-article.pdf

There is a lot of hype over encrypted chat programs. Telegram's encryption is not end-to-end unless you opt into "Secret Chats"[1] and many claim their crypto is not secure[2,3] as they rolled their own[4]. The latest Google chat app Allo also backed away from defaulting to end-to-end encryption for all messages as it lessens the quality of their auto-assistant[5]. The Axolotl protocol (developed by Moxie and Trevor[6]) is available in Signal and was later adopted by WhatsApp. Signal has far fewer features than other chat applications, and people aren't clamoring much about it; I would guess because many people place features > crypto. Wire (wire.com) uses this protocol as well[7]. WhatsApp being part of Facebook has already called into question their handling of privacy[8], the feature they were originally advertising as their main strength. [1] https://telegram.org/faq#secret-chats [2] http://security.stackexchange.com/questions/49782/is-telegram-secure#4… [3] http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… [4] https://news.ycombinator.com/item?id=6916860 [5] https://news.ycombinator.com/item?id=12547130 [6] https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm [7] https://wire.com/resource/Wire%20Security%20Whitepaper/download/ [8] http://www.nytimes.com/2016/08/26/technology/relaxing-privacy-vow-what…