Telegram, the most popular messenger in urban Ukraine is by default plaintext db

https://twitter.com/moxie/status/1497001286444617746

by mderazon • 4 years ago

15 7 4 years ago

rvz• 4 years ago

Exactly. Moxie is right. Telegram isn't secure by default. Signal is the way for tons of dark net criminals, terrorists and extremists to use it to conduct their activities without seeing any side of the conversation, thanks to E2EE which that is a known double-edged sword by many. [0]

The real problem is what Moxie doesn't want to tell you is that they want to release a private untraceable cryptocurrency called MobileCoin [1], which not only the majority of the coins are owned by the founders. [2][3] so basically orchestrating a pump-and-dump, this coin (like Monero) enables these dark net criminals, scammers and extremists to fund their operations anywhere in the world and it is totally untraceable.

Now I see why Moxie is out there hyping the Signal / MobileCoin pump-and-dump scheme again?

[0] https://www.theverge.com/22872133/signal-cryptocurrency-paym...

[1] https://support.signal.org/hc/en-us/articles/360057625692-In...

[2] https://mixin.one/assets/MobileCoin-Whitepaper-EN_FINAL.pdf

[3] https://github.com/UkoeHB/Mechanics-of-MobileCoin/blob/maste...

0xy3• 4 years ago

Why does this matter if Signal's database encryption has been pwned by Cellebrite and others? [1] [2]

It might as well be plaintext.

[1] https://www.forbes.com/sites/thomasbrewster/2021/02/08/can-t...

[2] https://cellebrite.com/en/cellebrites-new-solution-for-decry...

throwaway2903• 4 years ago

Are we seriously equating e2e encryption defeated more than a year ago by owning the physical device in a certain state (previously unlocked and with keys in-memory) to plain text messages stored on a central server?

And never forget Telegram's promise to cooperate with Roskomnadzor in the name of fighting 'extremism' (https://www.independent.co.uk/news/world/europe/telegram-rus...).

I am not even looking at Cellebrite’s plug all the way from 2020 (because https://signal.org/blog/cellebrite-vulnerabilities/).

0xy3• 4 years ago

Signal is subject to the same warrants. And yes, because the OP is specifically talking about privileged attacks. Why would it matter if the database was plaintext? It's only a problem if your adversary has privileged access to your device, either physically or via an exploit.

So Signal's "encrypted" database is literally marketing. It doesn't prevent anything. Cellebrite can access it, as can another app with the right series of zero days.

Signal's encrypted database is as secure as Telegram's plain text database, because both require privileged access, and Signal isn't more secure (the encryption has been pwned by multiple companies).

Telegram, the most popular messenger in urban Ukraine is by default plaintext db

Related Stories