Hacker News new | ask | show | jobs
by cynic_ 4048 days ago
What's wrong with Telegram?
3 comments

Arguments as far as I'm aware (please correct me where I'm wrong):

- Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven

- End to end encryption isn't the default

I'm looking at this: https://core.telegram.org/techfaq#q-why-are-you-mostly-relyi...

While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems.

So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.

So to me a 'cryptosystem' is the way the elements are combined.

Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem.

Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either.

Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.

You're right; that was poor wording. At the link they talk the "crypto algorithms" not cryptosystems that they combine.
That's wrong in comparison to Viber/WhatsApp/Skype or just in general?
>> What's wrong with Telegram?

"Hey look! We invented this novel cryptosystem and, despite it being unproven and not having it validated by anyone, we reckon it's the most secure thing ever!"

Added to that: why don't the just build on XMPP? Why lock users to their servers?
Back in the day, one of the main arguments were that they're "rolling their own crypto", although I don't know how it stands today[0].

[0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...