Unhandled Expression

It's a bit worrying that the two main links in the rebuttal are no longer functional. Edit: the two links I was talking were likely linking to the following: http://unhandledexpression.com/crypto/general/security/2013/12/17/tele… https://web.archive.org/web/20171213214126/https://moxie.org/blog/tele…

This is called profile-guided optimization.[0] Slightly off-topic, but even Rust has it, courtesy of LLVM.[1] It doesn't seem very popular unfortunately. Most web/tech companies are obsessive about capturing user interaction data for UX purposes, but it would be nice if that data could be fed back into a profile-guided optimizer. In theory the compiled WebAssembly output would always be optimized for the latest usage trends, provided there were frequent builds. Depending on the product, it may even be possible to classify users into various high-level categories based on their behavior, and serve them a binary that's optimized for their specific use case. The latter's level of specificity probably wouldn't be worth it though. [0] https://en.wikipedia.org/wiki/Profile-guided_optimization [1] https://unhandledexpression.com/2016/04/14/using-llvm-pgo-in-rust/

I still don't really understand this all discussion around Telegram. MTProto is used just with the regular chats and they decided to use a custom protocol "In order to achieve reliability on weak mobile connections as well as speed when dealing with large files (such as photos, large videos and files up to 1,5 GB)" (from the FAQ). There is also a pretty long discussion here http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-… between Telegram developers and another "security expert", where the practical reasons for their choices are explained (might be outdated, but it's still interesting to see why certain more secure algorithms might not be always the best solution). Providing cloud services, robustness and reliability can come at a cost unfortunately. If you care about having a really private conversation, just instantiate the Secret Chat. It's state of the art in terms of security. Just one of the many benchmarks https://www.eff.org/secure-messaging-scorecard.

In the case of Telegram, MTProto’s implementation leaves a lot to be desired[1][2]. Additionally, home rolled crypto does not usually get the kind of security review from the cryptography community which makes it very likely that bugs of all kinds exist. [1] https://words.filippo.io/dispatches/telegram-ecdh/ [2] http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-…

There's been some good work on eBPF programs written in Rust at least. https://unhandledexpression.com/general/rust/2018/02/02/poc-compiling-…

This blog showcasts a way to orchestrate eBPF scripts in Rust, but the eBPF itself is still written in C. That's super cool, but if combined with [0], we would gain the ability to write the eBPF script itself in Rust. [0]: https://unhandledexpression.com/2018/02/02/poc-compiling-to-ebpf-from-…

I think the encryption has been known to be bunk for quite some time now [1] [1] https://eprint.iacr.org/2015/1177.pdf [2] http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-sup… [3] https://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know…

It's always smelled bad. http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-… https://eprint.iacr.org/2015/1177.pdf

Telegram is known for having dodgy security: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-…

A little something to catch-up: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-… http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-sup…

I guess stuff like that: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-…

A blog post on the protocol built by Telegram: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-… sigh

There are some serious issues with Telegram's cryptography it seems: https://security.stackexchange.com/questions/49782/is-telegram-secure and http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-… See also http://thoughtcrime.org/blog/telegram-crypto-challenge/ (comments: https://news.ycombinator.com/item?id=6936539 )

They say Telegram is the most secure messenger out there. Have you even tried to google (or yandex) this? There has been a lot of discussion about their hand-rolled crypto. http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-…

Telegram clients (ios,andriod,windows,osx,linux) are open source. Server is closed but client code and protocol provides user with verified secrecy. Most criticism seems emotion based but no smoking guns. See comments on http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-… also see response to the post you linked to http://telegramteam.tumblr.com/post/70588130319/telegrams-cryptanalysi… anyway i dont work for them and Surespot also looks nice. though nodejs+coffeescript at the server worries me a bit.

fwiw, here's a rather relevant post: http://unhandledexpression.com/2014/04/07/revisiting-zookos-triangle/

Windows suffers some famous dain bramage wrt to DLL loading paths: http://unhandledexpression.com/2010/08/23/fixing-the-dll-loading-vulne… Basically, even when "safe" DLL loading is turned on, the search path still includes the current directory. I'm guessing that Notepad and friends all look for some (legacy?) DLL that isn't always installed, so if an attacker puts a malicious DLL by its same name in the same path as the file being opened, it'll be loaded and executed. The part about network drives is probably just an assumption about trust boundaries: Microsoft assumes that attacker can't ordinarily put a malicious file in the same local folder that you're opening a text file in, but on a network drive anything goes. This is all just speculation. I don't code for Windows, and I don't know anything more about this vulnerability than what's stated in the advisory.

> For self-referential datastructures (your first point above), using an Rc or Arc shouldn't have any overhead. I agree that it would be nice to be able to express this, but it's not really that big of a problem. I don't see how that could be true. It means using a separate heap allocation for each referenced piece (although the owning_ref thing steveklabnik mentioned might minimize that), a bit of extra RAM for the counter, and a bit of bookkeeping. I'm not saying the overhead is huge, but how could it be zero? fwiw, I finished this section of my code, and the context approach I mentioned worked out well for me. It was just a bit of a puzzle to find a way Rust would like. I'm pretty happy with Rust so far even though I've had to restructure parts of an apparently-working program to fit its model. My program is now more obviously correct, benchmarks are pretty good so far (though I wish profile-driven optimization were supported/mature: https://unhandledexpression.com/2016/04/14/using-llvm-pgo-in-rust/), and the open source library situation seems better than C/C++ for what I'm doing and actively improving where C/C++ is stagnant.

A number of security professionals have expressed serious concern about Telegram, including Moxie Marlinspike [0] [1] and Geoffroy Couprie [2]. It's really painful to see Telegram gaining popularity, when it has such glaring errors. You should instead use OTR on Jabber (ChatSecure [3]), or TextSecure [4] (which now has an Internet delivery mechanism). [0]: http://thoughtcrime.org/blog/telegram-crypto-challenge/ [1]: https://news.ycombinator.com/item?id=6936539 [2]: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-… [3]: https://chatsecure.org/ [4]: https://play.google.com/store/apps/details?id=org.thoughtcrime.secures…

Yes, let's see * Not end-to-end encrypted by default * No end-to-end encrypted groups * No end-to-end encryption on any desktop client by the vendor, forcing cross-platform users to drop secret chats. This includes 81% of working age people who sit on their computer during work day, and 100% of college students and IT workers. * No post-quantum key exchange * No future secrecy * No per-message forward secrecy * Bullshit claims about distributed keys https://security.stackexchange.com/questions/238562/how-does-telegrams… * Lacks ALL metadata protection from server like phone number, IP-address and thus geolocation, contact list, group memberships, quantity and schedule of communication, data types. In fact -- * Secret chats leak additional metadata about intent to hide content from TG as the vendor. Also, History of poor encryption implementation * 2013: A cracking contest https://news.ycombinator.com/item?id=6932648 * 2013: Telegram, AKA "Stand back, we have Math PhDs!" http://unhandledexpression.com:8081/crypto/general/security/2013/12/17… * 2015: IND-CCA issues https://eprint.iacr.org/2015/1177.pdf, * 2015 64-bit complexity MITM attack https://web.archive.org/web/20160425091011/http://www.alexrad.me/disco… * 2021 Valsorda "The Most Backdoor-Looking Bug I've Ever Seen"…

> I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me. Please read the link I provided before[0], it features links to a bunch of people saying Telegram is not secure[1][2][3][4]. It's not just Moxie. I actually have not seen any expert saying that Telegram is secure, but I'm interested in such thing. As the Telegram protocol is open, everybody is able to see how flawed it is. We know that. With a closed client that allegedly implements a secure encryption method (we also know it's good because it's open as well) there's a chance it doesn't work the way it's supposed to work, but there's also the chance it's working as intended. I'd rather take one percent chance over zero. [0] https://security.stackexchange.com/questions/49782/is-telegram-secure [1] https://eprint.iacr.org/2015/1177.pdf [2] https://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know… [3] http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-sup… [4] http://thoughtcrime.org/blog/telegram-crypto-challenge/