Telegram founder claims Signal has a US government backdoor

by mappu • 2 years ago

83 55 2 years ago

Voultapher• 2 years ago

Funny, given I've heard from multiple infosec people, that they believe telegram is a honeypot.

simfree2• 2 years ago

This is pretty rich coming from the founder of Telegram, which doesn't have any End to End encryption by default, nor are group chats encrypted in any way.

Client devices have many routes of compromise available, it's very possible that the data exfilaration is occuring there rather than server side.

You'd think the backers of Matrix (largely European Governments) or the privacy focused userbase of XMPP would go beyond forklifting in the same double rachet library that Signal and ilk use, but apparently they all think it's the best available option.

Arathorn• 2 years ago

On the Matrix side, we explicitly didn't forklift the same library - we wrote our own cleanroom implementation from scratch, first in C/C++ as https://gitlab.matrix.org/matrix-org/olm and then in rust as https://github.com/matrix-org/vodozemac. They have no code at all in common with libsignal, and are Apache licensed rather than copyleft, and have been independently audited, independent of whatever Signal gets up to (https://matrix.org/blog/2016/11/21/matrix-s-olm-end-to-end-e... and https://matrix.org/blog/2022/05/16/independent-public-audit-... respectively)

pjfin123• 2 years ago

To be fair trying to do encrypted group chats isn't at all straightforward.

vetrom• 2 years ago

You don't need government backdoors when os trust isnt user-trustable and you could chain whatever into a sesame backdoor: https://eprint.iacr.org/2021/626.pdf (for the tldr crowd; this explains a fairly glaring failure mode in signal's post-compromise security when any secondary devices are involved)

throwaway74354• 2 years ago

Durov, bring back the wall!

thomas34298• 2 years ago

Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones.

I remember Telegram not publishing their Android source code for extended periods of time, which caused Telegram-FOSS to be significantly behind:

https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/1...

I'm not up to date on the current state of affairs, but I hope this has improved since then.

anthk2• 2 years ago

If you want security and a paranoid like setup just use Tox. If you want a no-brainer chat app with video support, there's GNU Jami. If you want resilence on natural disasters, keep Braid somewhere.

thisislife22• 2 years ago

Does GNU Jami work in the middle-east where most voip are banned, and only middle-eastern intelligence agency run apps like BotIM are allowed?

anthk2• 2 years ago

Tox might.

anonbanker• 2 years ago

Tox is not secure. Jason Donnenfeld (of Wireguard fame) filed a very alarming issue about how obviously bad the handshake was implemented[1], and lead developer Andre Almeida (iphydf/noavarice) continued to downplay the severity in public, while fashioning exploits based on it inside his "Club Cyberia" Tox group to weaponize said issue.

Stay away from Tox.

1. https://github.com/TokTok/c-toxcore/issues/426

Moldoteck2• 2 years ago

Says the guy when his messenger is not e2ee by default(meaning the same as plain text), groups not encrypted e2e at all and uses some shady encryption mechanism

WhereIsTheTruth2• 2 years ago

that's why it is the prefered one, naked is privacy, but for you to understand, you need to not work for any of these agencies ;)

there is a reason why the source of most content from the NATO/RUS war comes from telegram

because being naked works better than "being anonymous and encrypted", protonmail users wants to interview you:

"Encrypted services Apple, Proton and Wire helped Spanish police identify activist" - https://techcrunch.com/2024/05/08/encrypted-services-apple-p...

adboofer5• 2 years ago

because telegram has group chats and channels, which are also accessible cross platform, it doesn't make sense to turn on e2e by default. secret chat feature is encrypted and thus only available on the device you start it from.

jacooper6• 2 years ago

What does being multi platform have to do with E2E? Matrix does the same thing yet supports E2E, whatsapp allows multi platform access while also having full E2E support.

SahAssar3• 2 years ago

While I agree in sentiment please don't equivocate plain text with non-e2e but encrypted. They are very different.

Moldoteck2• 2 years ago

If it's not e2ee, they can decrypt any data at will, so plain text

thisislife22• 2 years ago

Want to bet that any messenger service that requires your phone number to register and id you on their network is compromised?

For those interested, watch this interview of the Telegram founder by the US right- media as it offers an interesting insight about the politics and competition behind these messenger / social networks - https://www.youtube.com/watch?v=1Ut6RouSs0w ... (And this is, by the way, the original source of the story - https://www.city-journal.org/article/signals-katherine-maher... - which also seems to be US right- media. Looks like a concerted Republican / Trump followers attempt to have their flock use Telegram now.)

bionhoward• 2 years ago

How?

WhereIsTheTruth2• 2 years ago

Anything that operates in the US, specially telecom, is subject to American law, therefore weak to US intelligence agencies, that's how it is, since 9/11

geor9e3• 2 years ago

There's no US law requiring encryption weakening.

HumanProtractor• 2 years ago

That typically comes in the form of a national security letter.

bvinayakh• 2 years ago

I never use Signal because the moment you provide your phone numnber, there is no more annonymity.

moe_sc• 2 years ago

To be fair, anonymity never was one of signals claims.

aquatica• 2 years ago

Says the guy who had a backdoor in their super-secure e2e secret chats

https://words.filippo.io/dispatches/telegram-ecdh/

zaik• 2 years ago

super-secure e2e secret chats

Which aren't enabled by default so almost nobody uses them. Telegram users are often surprised to find out their messages aren't end-to-end encrypted at all.

adboofer5• 2 years ago

Telegram can be used on multiple devices simultaneously. Syncing the private key for each chat across multiple devices can be an issue. That's why secret chats are only available on the device they were created on, and having encryption on by default would not make sense.

binary132• 2 years ago

“Some people say” isn’t really good enough evidence to support this claim. It perhaps casts doubt but I wouldn’t consider it trustworthy either.

jacooper6• 2 years ago

Apart from telegram not having any kind of actually used E2E Encryption, they store everything, which means the cost of running their service is crazy high compared to something like whatsapp which AFAIK only stores stuff up to 3 months when the device isn't online.

So we have an app which has access to everything you send, and has incredibly high hosting costs with no real income, you put 1 and 1 together and you can see it for yourself.

Ironically they claim cloud storage as the reason for not having E2E, yet matrix seems to be able to do just that.

not_me_ever2• 2 years ago

The random number generator in signal is fully predictable. There is no need for a back door -- when the front door has no lock.

:sigh:

SahAssar3• 2 years ago

Do you have a source for that?

longitudinal93• 2 years ago

Of course he doesn't have a source for that

roastedpeacock• 2 years ago

That is a pretty damming accusation. Can you provide more details? This should be the sort of thing you should be hearing from a disclosure or ideally a vendor advisory - not an HN comment thread on a vaguely related article. Failures of randomness are almost always fatal to a cryptosystem.

geor9e3• 2 years ago

Source: made it up

not_me_ever2• 2 years ago

Source: Read and understood the original whitepaper. Plus verified it in the (probably fake) source code.

You can do it too. Might take a decade or two depending on your mathematical background.

windrim• 2 years ago

FWIW the underlying article[1] is written by Chris Rufo, a prominent right-winger[2]:

[1] https://www.city-journal.org/article/signals-katherine-maher...

[2] e.g. https://www.newyorker.com/news/annals-of-inquiry/how-a-conse...

thebeardisred• 2 years ago

I know & trust the founders of signal personally.

Every time I've used telegram it smacks of a data collection tool for an Eastern Bloc nation.

I'll stick with what I know, thanks.

Edit: Also the article linked is just a hit piece on the current signal leadership by a guy promoting a book about "the radical left". This is just reinforcing my tendency to say "fuck telegram".

stufffer• 2 years ago

Tucker Carlson interviewed the founder of Telegram, interesting interview. Telegram is based out of UAE to avoid jurisdiction of Russian and Western intelligence agencies.

Tucker Carlson also revealed that he's had the contents of his private signal messages leaked to media (allegedly by US Intel agencies monitoring his communication).

VagabundoP• 2 years ago

Very hard to trust Tucker, is there any way of verifying his bullshit?

Telegram founder claims Signal has a US government backdoor

Related Stories