[the_mitsuhiko]

> This is absolutely dangerous thinking. There are a lot of people researching crypto and making sure it's secure. If you're using non-standard crypto, you don't have that safety net.

Absolutely dangerous thinking is to declare cryptography off limits. With that in mind eventually you just scare more people to participate in this process and eventually be left with a tiny core community.

And this discussion is very moot anyways as telegram uses standard cryptographic primitives.

> They're using primitives that are proven to be insecure against certain types of attacks (non-checked DH, MAC-then-encrypt, etc).

Except they are not using them in any insecure way and they are doing this for very good reasons. This Twitter thread is also full of misinformation collected together from an age old post that was itself misunderstanding how the protocol actually works.

> You can't just invent something and claim "last time I checked it's not broken".

Sure, that's exactly how SSL works. We invented crypto systems and we are using them until they are broken, then we phase them out for something else.

[glogla]

> Absolutely dangerous thinking is to declare cryptography off limits. With that in mind eventually you just scare more people to participate in this process and eventually be left with a tiny core community.

Cryptography is not "off limits". Cryptography is just a place where Not Invented Here approach is not just stupid, and incompetent, but dangerous.

[the_mitsuhiko]

> Cryptography is not "off limits". Cryptography is just a place where Not Invented Here approach is not just stupid, and incompetent, but dangerous.

That should apply equally to all parts of software engineering and with a big exception that says: unless you know what you are doing.

[epimenov]

There was a TOR talk where a person from China told that he recommended two systems to different people: TOR and some other one. The people he recommended the other one ended up in prison.

This kind of consequences you get when you falsely claim security. This is the main reason I want people stop saying that Telegram is somehow secure. It's just another messenger, people who need security should use something else. There must be no confusion about it.

[epimenov]

>Absolutely dangerous thinking is to declare cryptography off limits. With that in mind eventually you just scare more people to participate in this process and eventually be left with a tiny core community.

Anybody can participate, just don't claim it's secure.

> Sure, that's exactly how SSL works. We invented crypto systems and we are using them until they are broken, then we phase them out for something else.

The only difference is there's a maillist with actual cryptographers (https://www.ietf.org/mail-archive/web/tls/current/threads.ht...), that iterate over design. If you look at the history of TLS, you'll see how tricky is to get crypto right. There has been lots of attacks on the protocol, that no one person could've think of. You don't have that if you roll your own and/or have "very good reasons" when people point your mistakes out.

[mehrdada]

> If you look at the history of TLS, you'll see how tricky is to get crypto right. There has been lots of attacks on the protocol, that no one person could've think of.

You'd hope so, but contrary to popular belief, actual cryptographers relatively rarely manage to prevent errors in the standards. For instance, Phil Rogaway warned against MAC-then-Encrypt used in TLS which led to the Padding Oracle attacks many many years before they were exploited, but the suggestions were ignored by the "practitioners" designing the protocols. In fact, the TLS example was one that is relatively easy to get right if the designers wouldn't have gone crazy and listened to actual cryptographers. Telegram will someday fall into the exact same bucket.