Telegram protocol defeated. Authors are going to modify crypto-algorithm

http://translate.google.com/translate?hl=en&sl=ru&u=http://habrahabr.ru/post/206900/

by xytop • 13 years ago

360 207 13 years ago

translate.google.com

xytop5• 13 years ago

In short: telegram in secure chats (http://core.telegram.org/api/end-to-end) was using modified version of Diffie-Hellman algorithm: key = (pow(g_b, a) mod dh_prime) xor nonce (original: key = pow(g_b, a) mod dh_prime) That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed chats by request.. Authors of Telegram agreed that it is a big hole and their algorithm needs modification. User, who found the issue will get a prize (not 200,000$, but good enough).

Jemaclus• 13 years ago

Why not the 200K? Was it outside the parameters of the contest or something?

oakwhiz• 13 years ago

Their contest had very restrictive parameters if I recall correctly.

hdevalence• 13 years ago

Yes. The contest is not about actually exposing flaws in their cryptosystem, which is why the rules are rigged up in a way that would allow even a terribly insecure protocol (like Telegram's, or Moxie's counter-challenge protocol) to pass as "secure".

xytop5• 13 years ago

Yes, outside. Although the underground of this contest was to prove security and inability to read messages by 3rd parties contest was about decrypting Durov's chat. Chat is not decrypted and as many say - it's nearly impossible (http://thoughtcrime.org/blog/telegram-crypto-challenge/). But "bookmark" is found and it means that all the PR was shit. Telegram already removed 'xor nonce' from their documentation and added a new layer to their api but who knows where they will put a next bookmark. Probably it will be hidden in a deeper place. But trust is already lost. It appears that either their secure protocol was containing the bookmark specially or that protocol is getting written by non-specialists which cant guarantee any security.

MatthewWilkes• 13 years ago

Their contest was based on a sample packet capture only.

dewiz• 13 years ago

So this was supposed to be secure/robust/mature/trustworthy ? Not impressed, still too many companies around pretending it's sooo easy to make something better, how hard can it be ?

knodi• 13 years ago

200k gone just like that, better now then later.

charlesdm• 13 years ago

He's not getting it apparently, even though he discovered a major flaw. Sounds like a great PR stunt gone bad for Telegram. What a joke.

danabramov12• 13 years ago

He's getting $100 000.

https://vk.com/wall-52630202_7858

notastartup2• 13 years ago

I hope this person will get the full $200,000. I definitely don't think we can ever trust Telegram's strength again. They won't be paying him the full $200,000 even though he has rendered the Telegram to be weak. Major, major backfire for Telegram stakeholders.

lososerg2• 13 years ago

They gave him $100 000. And yet the flaw he pointed out doesn't help you read encrypted messages and has been already fixed/

makomk3• 13 years ago

The flaw he pointed out renders one of the main advertised features of Telegram - end-to-end encrypted chats that they can't eavesdrop on - broken to the point of total worthlessness. Telegram had the ability to undetectably MITM and spy on the supposedly secure communications, as did anyone who managed to compromise them.

They'd have achieved exactly the same level of security by having no end-to-end encryption whatsoever and just promising that they wouldn't log or look at people's messages - this flaw is seriously that bad.

nly2• 13 years ago

Why does Telegram provide the generator (g and p) and then suggest validation and caching? These can be hardcoded parameters

xytop5• 13 years ago

in cryptography nothing is hardcoded (or at least hardcoded values should have enough entropy) :) if client doesnt use caching - then every message user sends should obtain a new pair of p/g (which is expensive) - and it will make telegram not only insecure but also "slow" messenger :P

nly2• 13 years ago

The only things that aren't hardcoded in your typical secure cryptosystem is your key and a few nonces. In ECC the analogous components to p and g are defined extremely carefully and certainly wouldn't be changed willy nilly. I'm aware classic DH parameters are more liberal, but changing them for every session seems unnecessary.

tigerweeds• 13 years ago

cool stuff. Give the guy his prize

a3n• 13 years ago

He didn't break the message. They weren't offering a prize for what he did.

danabramov12• 13 years ago

He gets $100 000:

https://vk.com/wall-52630202_7858

sillysaurus28• 13 years ago

TextSecure's protocol, on the other hand, hasn't ever been compromised. Don't use Telegram. Use TextSecure. https://whispersystems.org/

foobarqux• 13 years ago

Better still, fund TextSecure not Telegram.

moxie• 13 years ago

That's absolutely true, but I think the reason this seems so devastating for Telegram is not necessarily because there was a vulnerability, but because they were so dismissive of the feedback they got and so willing to immediately make such strong claims.

The way I hope TextSecure can be different from Telegram is not by having an absolutely perfect security record forever (although that'd be great), but by publicly talking about the protocol choices we've made, employing constructions with proofs where possible, and actively soliciting feedback. Thanks for being involved!

110014• 13 years ago

To be fair, no one here mentioned anything related to the found vulnerability. Instead people seemed to have focused on their choice of SHA1 and IGE.

frenger• 13 years ago

What about iOS? I wish there was one go-to secure messenger for iOS, and I thought telegram would be it.

justinzollars• 13 years ago

That didn't take long.

hcarvalhoalves• 13 years ago

Demoralized twice, first for finding a flaw, second for not giving the prize.

genwin3• 13 years ago

Why give the prize for not doing what was needed to win the prize, namely reveal the message?

shawabawa3• 13 years ago

As others have already said, the prize was essentially meaningless because the terms were so narrow.

If the spirit of the prize was "if you break our crypto you win", this guy should win it. If the spirit of the prize was "we don't want to give away 200k, but we want to pretend we're secure", he shouldn't

xentronium• 13 years ago

They did give a prize.

danabramov12• 13 years ago

He's getting $100 000, and note that the vulnerability he found was outside the first contest's scope.

HN seems to hate by default.

https://vk.com/wall-52630202_7858

droopybuns2• 13 years ago

Excruciating evidence that supports Moxie's position.

Vuln rewards should exist for two purposes:

1)An act of good faith on the part of the developer that says "I am interested in securing my product and I won't prosecute direct disclosure"

2) The Dev knows exploitable vuln discovery has value, but cannot compete with black market pricing. Instead, the reward is a token of appreciation for a shared code of ethics.

I wish bug bounties could compete with the budgets of nation states. They can't.

Companies shouldn't pretend to compete. Shame on telegram for stupidly false promises.

danabramov12• 13 years ago

I have no idea what you are trying to say here.

The guy is rewarded half the bounty: https://vk.com/wall-52630202_7858

droopybuns2• 13 years ago

Vuln reward programs that payout at this level are broken.

1) They don't achieve their objective of securing a product. Moxie eloquently captured why here: http://thoughtcrime.org/blog/telegram-crypto-challenge/

2) At this level of payout, they are inefficient and unsustainable. There were less expensive ways to discover implementation flaws, and certainly more direct ways to discover design flaws. Was the lesson they just learned really worth $100 grand from some random dude on the Internet? Seems to me you could find more problems per dollar by directly engaging with some of the top class security consultancies out there.

So to summarize, telegram's reward was an extremely inefficient stunt that did not achieve it's likely real objective. I imagine the team is licking it's wounds right now and regretting their approach. We'll be able to tell by whether or not they continue their offer under the same rules and same budget.

I expect this to continue for another couple of rounds because random security people on the Internet will be smelling blood right now.

rdtsc• 13 years ago

Well nice knowing you Telegram. I don't see a good way for them to recover from this. First the bogus contest that Moxie debunked. Now this. The best option is to close shop, open a new company, new names and do something else.

sillysaurus28• 13 years ago

The best part is that the debunker wrote this in Russian. The language barrier has probably been responsible for them getting so many users. So now everyone is very clear that Telegram is snakeoil.

danabramov12• 13 years ago

The language barrier has probably been responsible for them getting so many users.

What do you mean?

Trufa3• 13 years ago

As a side note, I didn't notice it was google translate until half way through the article. It's getting really good.

Is Russian an "easy" language to translate to English?

lukeqsee• 13 years ago

I noticed it instantly (the title). I also noticed many irregularities throughout the article. I don't know if you're a native speaker, but to me it was obviously computer translated.

mynameishere• 13 years ago

I had to struggle to read it. I mean:

After logout, one of the key interlocutors for chat will regenerate, and to check that I have the same key as the source, I can only look in his eyes phone.

...did it translate "iPhone" to "eyes phone"? I'm not sure. If that isn't what happened, then something far more horrible must have.

Trufa3• 13 years ago

The thing is, I though it was poorly written English, written by a non native speaker, rather than a computer.

I must also clarify that I was a little distracted.

110014• 13 years ago

The original:

После логаута одного из собеседников ключ для чата будет перегенерирован, а проверить то, что я имею тот же ключ что и собеседник я могу только посмотрев в его телефон глазами.

My (human) translation:

After one of the participants will log out, the key from the chat will be re-generated, but in order to check that I have the same key as them, I would need to see their phone with my own eyes.

This sentence has a particularly non-English word order, plus some missed punctuation. I can see how it would be a hard case for machine translation.

bane• 13 years ago

My understanding is that it isn't but recent-ish statistical approaches have had lots of success. I know that almost overnight Arabic went from an unreadable mess to about as good as a basic non-native speaker.

I wish it'd find its way into usage for East Asian languages more, but I suppose finding dual-equivalent corpuses to build the models off of is hard.

https://en.wikipedia.org/wiki/Statistical_machine_translatio...

Trufa3• 13 years ago

Interesting, thanks!

moron4hire• 13 years ago

English to Russian is a bit easier than Russian to English. Word order doesn't mean as much in Russian as in English, so the translation is lossy.

symbix• 13 years ago

Does this seem good to you? Damn, I feel I should stop worrying about my English.

paveldurov2• 13 years ago

I'm excited by the insight and modesty of this guy. I will see to it that he gets a mighty prize.

It's great to see how open software can leverage the power of the community to find weak spots and become stronger.

yourad_io• 13 years ago

How much might a mighty prize be, if I may ask?

lososerg2• 13 years ago

$100 000 http://vk.com/wall-52630202_7858

Эта история заставляет в очередной раз восхититься российскими программистами. Целую неделю маститые американские криптографы на HackerNews безуспешно цеплялись к протоколу — в основном, с требованием заменить наше решение на алгоритмы, которые продвигает АНБ в своем Suite B. А российский программист, называющий себя "новичком", смог в рамках статьи на Хабре с ходу определить потенциально уязвимое место в секретных чатах.

На всякий случай, поясню для массовых пользователей: утечки данных не было, уязвимость закрыта, опасности нет.

Еще раз убедился в том, насколько правильным решением было полностью открывать протокол и исходный код. Это позволяет привлекать тысячи умных людей, которые могут помогать нам постоянно совершенствовать систему, находя потенциально уязвимые места.

Разработчик, нашедший слабое место в нашем алгоритме, заслужил награду в $100,000. Подобную награду заслужит любой, кто найдет возможности схожей атаки (напоминаю, за расшифровку потока трафика мной была объявлена награда в $200,000). Продолжаем искать — вместе мы сделаем протокол нерушимым.

This story makes us once again admire the Russian programmers . Whole week at the venerable American cryptographers HackerNews unsuccessfully clung to the protocol - mainly with our decision to replace the requirement for algorithms that promotes its NSA Suite B. A Russian programmer who calls himself a "newcomer " could under Article Habré stride identify potential vulnerabilities in secret chats .

In any case , I will explain the bulk of users : data leakage was not a vulnerability is closed, there is no danger .

Once again convinced of how the right decision was fully open protocol, and source code. This allows you to attract thousands of smart people who can help us to constantly improve the system by finding potential vulnerabilities .

The developer, who found a weak spot in our algorithm , deserve a reward of $ 100,000 . Deserve such an award anyone who finds the possibility of similar attacks (remember, for decrypting traffic flow me was declared a reward of $ 200,000) . Continue to seek - together we will make a protocol indestructible .

andr• 13 years ago

He has essentially defeated your protocol, so he deserves the full $200,000. After Lavabit, it is no longer a fair assumption that you (or government agencies forcing your hand) will not interfere with the protocol to compromise it.

josephlord3• 13 years ago

It is good to see that you recognise modesty as a virtue.

May I suggest that you guys take a leaf out of his book and rewrite the security claims in your FAQ to reflect the fact that the protocol is new and at this point there are likely to be some bugs but that you are working hard to make it secure.

danabramov12• 13 years ago

This, a thousand times.

Somebody finally expressed this thought politely.

im3w1l• 13 years ago

This is a very respectable move.

eliteraspberrie• 13 years ago

Great work! I hope this person gets a big piece of the prize, if not all of it. Perhaps they should have waited for the challenge to be expanded. (That's what I'm doing. I just hope nobody spills the beans first.)

pjscott• 13 years ago

There's a lesson here. I genuinely don't mean to sound smug, but -- remember how confident the Telegram guys were? Remember how sure they were that their protocol would be able to resist the eavesdropping efforts of the NSA and whatever other nefarious interlopers may come along? Remember how they said they'd been working on it for years, and presumably expected for it to last many more years?

Remember how that was, like, five days ago?

onedev• 13 years ago

Never forget.

RIP Telegram (2013-2013).

This whole thing has been interesting to follow because it seems this same thing happens every time someone make macho Crypto-claims. From seeing how confident the Telegram team was to reading all the detractors who were so ready to criticize. It's an interesting dynamic in the Crypto community.

hawkharris2• 13 years ago

RIP Telegram (2013-2013) would make an interesting T-shirt. No one except a few cryptography buffs might understand it, but it would be a funny way to start conversations about information security.

notastartup2• 13 years ago

    RIP Telegram (2013-2013).

omg made me lol super hard

yatsyk7• 13 years ago

Hate tone discussion makes me sad.

Telegram is very young project and it has bugs for sure. Some guy found potential issue in protocol and developers committed to fix it soon. There is no information that any messages were revealed due to this bug but Telegram should go away and developers should do something else.

Whatsapp is less secure then Telegram but I have not seed “Whatsapp RIP” messages. Not so hard to save videos in snapchat but no one propose to close the application. About a year ago YAML vulnerability was found but no one proposed dhh to stop development and focus on race driver career.

I think that we need more competition for TextSecure.

Terms of bug bounty are very hard to satisfy even with bad protocol but Durov seems decided to play safe with such amount of money. Guy that found problem in MTproto doesn’t win money according to conditions of the bug bounty because message is not decrypted.

Disclaimer: I don’t have any affiliation with telegram besides living in the same city as telegram developers.

paveldurov2• 13 years ago

By that logic, Linux, Chrome, Android are RIP at least a hundred times.

jimmytucson• 13 years ago

Did you write the encryption algorithm? Did you have the balls to put 200 grand on the table for anyone who could break it? Did you rise to the challenge and claim the cash?

No, you just stood on the sideline and waited for somebody to fail so you could come down off your branch and peck at the corpse.

Indeed, there is a lesson here. Don't expect anybody to pat you on the back when you put it all on black and win. Because, sure as shit, they'll be there to kick it in your face when you lose.

thom2• 13 years ago

Are you suffering from testosterone poisoning or something?

Nursie• 13 years ago

I didn't write the algorithm, and neither did they, that would have been another bad move on their part. They used public, known algorithms and did it wrong.

They also didn't put 200k on the table for anyone that could break it. They put 200k on the table for anyone that could break it in a very specific way that proves nothing.

They used a combo of known bad and unproven stuff in weird ways and then claimed it was the best thing ever, which is just crazy.

110014• 13 years ago

Here are some of their comments:

ibeatle

Большое спасибо, автор поста полностью прав. Со своей стороны хотим пояснить, что сделано это было из лучших побуждений: исправление плохого рандома на клиентах. С настоящего момента в nonce всегда будет приходить ноль, и в следующем слое мы обязательно удалим это поле из схемы и поясним в документации. Автор топика безусловно заслужил награды, просьба обратиться хабраюзера x7mz на email support@telegram.org для уточнения деталей.

Translation:

Thanks very much, the author is absolutely correct. Just wanted to explain that the intentions were good: to correct bad "random" on the client side.

From this point on nonce will always be set to 0, and next we will definitely remove it from our diagram and explanations in the docs.

The author definitely deserves a prize, please enquire at the following email for details.

W_K

Товарищ прав — похоже, сервер в принципе может с помощью манипуляции с nonce выполнить MiTM на DH между клиентами. Не знаю, кто именно внедрил этот nonce в такой форме, хотя и знаю, какое предъявлялось обоснование — он был нужен для того, чтобы защититься от слабого рандома на клиентах, которых в принципе может писать кто угодно. Очевидно, нужно сделать этот nonce нулём и написать, что клиенты впредь не должны принимать секретные чаты с ненулевым nonce.

Удивительно, что человек, называющий себя «чайником» в криптографии, нашёл действительно серьёзный недостаток протокола, в отличие от многих якобы «профессионалов», постоянно придирающихся не по существу.

Не знаю как насчёт 200k$ — расшифровать трафик это не поможет, а сервер не знает ключа от секретного чата, поскольку на нём нет такой закладки. Но мне очень не нравится, что в будущем такая закладка могла бы быть в принципе кем-нибудь добавлена.

Тем не менее, считаю, за это ценное наблюдение Вам положен ценный приз. Пусть и не такой большой. Если Вы или кто-либо ещё найдёт какие-либо ещё потенциальные дыры в протоколе — сообщайте, будем награждать.

Translation:

He is correct, looks like the server can manipulate nonce and succeed at MiTM on DH between the clients. Not sure who's idea it was to introduce that nonce in this form, but I do understand the motivation, to protect against the "weak random" on the clients that can in theory be written by anyone. Obviously, we need to make nonce=0 and refuse secret chats with non-zero nonce.

It is quite amazing that the man who calls himself "a crypto noob" found a real vulnerability, as opposed to all those so-called professionals whose criticisms were largely unfounded.

Not sure about the $200k since this vulnerability won't really help to decipher the traffic and the server doesn't know the key from the secret chat, because it doesn't have any "bookmark". But I really don't like that in the future such a bookmark could be added.

However, I think this is a valuable observation and you do deserve a prize, even if not such a big one. If you, or anyone else, will find other potential vulnerabilities, please let us know, we will be rewarding.

d0mine• 13 years ago

A small correction: use "irrelevant" instead of "unfounded" to translate "не по существу".

"unfounded" is closer to "не обосновано".

It is a English-speaking forum, put English text first.

110014• 13 years ago

I agree, "irrelevant" would be a better choice.

jaxb• 13 years ago

and it's "backdoor", not "bookmark"

alan_cx• 13 years ago

Does "nonce" here have a meaning I don't know? Its just that here in the UK, its common meaning isnt exactly positive.

SwellJoe2• 13 years ago

https://en.wikipedia.org/wiki/Cryptographic_nonce

Confusion2• 13 years ago

  as opposed to all those so-called professionals whose 
  criticisms were largely unfounded.

Those criticisms still stand. Your perjorative 'so-called' is the only thing unfounded. And actually, the DH modification was one of the red flags mentioned.

zAy0LfpBZLC8mAC• 13 years ago

The criticism was mostly very well founded. Just because you don't understand it, that does not mean that it is unfounded. Just because a civil engineer only tells you that a newly built bridge will collapse in about 30 years due to corrosion and then a day later someone points out that you can make it fall down right now by parking trucks on it from end to end, that does not mean that the warning of the civil engineer was unfounded, it simply means that she pointed out a different weakness, and possibly one that you lack the knowledge to tell whether it is reasonable or not.

Or in short: We don't generally consider things safe until they collapse/explode/poison/... and people are actually dead. When an expert understands that something is not safe anymore for reasons that you don't understand, that still is a well-founded reason for considering it unsafe.

yurylifshits• 13 years ago

Second comment (W_K) is by Nick Durov, the leading author of MTProto, Telegram's protocol.

raverbashing• 13 years ago

Ah this explains a lot. About the whole thing, not just the comment.

Aloha• 13 years ago

Would this hole allow him to decrypt chat text?

xytop5• 13 years ago

no, but it allows server to decrypt it. Government in case of the need can "ask" them to forward your chat and they will do it, but it was stated in their PR that server is unable to decrypt your messages.

rikacomet3• 13 years ago

exactly, the prize was at their own discretion(telegram) in the first place. And it was still for breaking their End-to-End encryption process.

To simply put it, you don't have to break a wall, just find a loose brick, once that is gone, the wall will have even more loose bricks, and eventually it will fall.

oddx• 13 years ago

This hole allows server (or somebody who can control connection between client and server) to read "encrypted" messages between clients.

User1398• 13 years ago

This is great news for Telegram. With such a weakness, the NSA will soon be encouraging wide spread use of their protocol.

sciguy77• 13 years ago

Am I the only one who read this in my head with a Russian accent?

rikacomet3• 13 years ago

nope.. lol!

gohrt4• 13 years ago

Why is Telegram in the HNews so much? Are they part of the YC fraternity? Why do pay so much attention to crypto hucksters?

It hasn't been so long since the last snake oil peddlers had their roasting -- I forget the name, it was some cutesy web-browser "secure" chat thing.

It's cool to report debunkings, but if it weren't for HN, I (and most others?) never would have even seen these products in the first place.

pgeorgi• 13 years ago

I think the idea is that you get to see the product early so you can warn your activist friends (or your mom) when you happen to see them using it.

frankzinger• 13 years ago

"It hasn't been so long since the last snake oil peddlers had their roasting -- I forget the name, it was some cutesy web-browser "secure" chat thing."

Cryptocat?

DanBC5• 13 years ago

HN is (rightly) interested in easy to use secure software.

So when something easy to use claims to be secure HN waits for some of the well known cryptographers here to kick the tires.

In this case many people kicked the tires and pointed out some weird obvious flaws. People hoped that Telegram would listen, and seek help and advice, and continue to make a great product.

Telegram's actions made the situation worse, and created a pile-on.

Telegram made a few mistakes.

1) Smart people without crypto experience designed crypto software, but without getting involvement from cryptographers.

2) They released this product as finished, secure, ready to use.

3) They dismissed concerns.

4) To try to quash those concerns they created a rigged challenge with a high value prize. This is a well known red flag for cryptography software, and it's surprising they weren't aware of it, but as soon as people saw that the pile on accelerated.

OoTheNigerian2• 13 years ago

This is my first comment on the Telegram bruhaha.

Sometimes, I get embarrassed by what I experience here on HN. The gang up, the unnecessary pride.

To those saying RIP, Telegram will succeed. Without using it (I use a Blackberry), it looks to be top two of the chat apps when you combine usability/security. I will download it once I get an Android phone in January.

I will not wish failure on anyone that is confident in his product. Of course they could have shown more humility but it he face of "take downs" on all sides especially the ones sponsored or initiated by the Whispersystem/Texsecure chaps, I do not see why they should have bowed down to be crushed.

Considering the type of responses given by Pavel Durov, I am almost certain he would have been much more humble if his attackers toned it down a notch.

To the person that found a flaw, kudos to you on doing something and not spending all your time doing take downs of telegram on HN threads and blogs.

Pavel, I am hopeful that you will reward the chap even though the discovery was not within the "guidelines". it is all about the spirit of the competition.

As for the TextSecure/WhisperSystems guys, stop being like the politicians we hate who campaign by slinging mud on opponents instead of selling their stuff. Focus on selling the TextSecure app and not looking to takeout anyone who has a different approach.

PS: I have no relationship with either party. I am a neutral observer that has his own opinions.

DanBC5• 13 years ago

To those saying RIP, Telegram will succeed. Without using it (I use a Blackberry), it looks to be top two of the chat apps when you combine usability/security. I will download it once I get an Android phone in January.

But it is not secure! That's the entire point.

Never mind "not secure against a well funded government agency", it's not secure against other attackers.

There are lots of usable chat apps that do not give you the illusion of security.

and not looking to takeout anyone who has a different approach.

You seem to be mistaken about why they do this. It's nothing to do with pushing their app or their approach. They'd welcome good well-formed apps to compete with them. But when they see an app that claims to be secure they have an ethical duty to let people know if it is obviously not secure.

Most people are not bashing just for the sake of bashing. Some people need good cryptography software to avoid imprisonment, or torture, or state-killing. This isn't about stopping someone's teen-angsty poetry from being discovered by a sibling, it's about protecting political dissidents from an oppressive regime. In that context pointing out that a software is broken is not mindless bashing, it is a crucial part of the cryptography process.

(I'll accept that a few people are missing the mark with their criticisms.)

Pointing out flawed crypto software is part of a long tradition going back many years. It's part of the culture. Most cryptographer will start by analysing other software and finding flaws before implementing their own software.

OoTheNigerian2• 13 years ago

I like your commentary it is level headed and explains the position of the non biased "other side".

I think the conflicted position of the lead bashers did not help their position. It would have been much more useful for a neutral party to do a comparative analysis and stated the pros and cons of each side.

As for me and most normal users, the security we need is not from NSA type of snooping but from mid level risks. There may be some sacrifices that may have to be made. Just like the position Ubuntu plays where Linux distros are concerned

For people like Snowden, Greenwald and others with NSA level adversaries, I do not expect them to rely on any third party application at all.

Now your argument may be that they have created stuff for sexting teens and claimed to be good enough for Snowden. In that case, I would argue that it could have been pointed out that in a different and perhaps more polite way.

I would worry about anyone who has created any crypto tool who is not over confident in his product. I will also expect the person to be receptive to constructive feedback NOT "leave your product and join us" or "This is shit because no noted crypto person is on your team"

I remember when cperciva that built Tarsnap, an online "backup for paranoid users" launched, he was rather confident in his product and I did not see any intense bashing of him. As expected,there have been bugs in his system and he has fixed them as they have arisen.

We should help things grow right here on HN not hope for things to fail if they do not support the view of the crowd.

schrototo• 13 years ago

Telegram is making ridiculous claims that have the potential to hurt their customers. They are lying and/or incompetent. They absolutely deserve to be made fun of.

Confusion2• 13 years ago

  he would have been much more humble if his attackers toned 
  it down a notch.

Conversely you can argue that the 'attackers' would have toned it down a notch if Telegram had been more humble and receptive of the comments. The initial comments were quite civil and they were just dismissed.

  looking to takeout anyone who has a different approach.

It's not just a 'different' approach. It's an approach that's likely to be dangerously flawed, as just demonstrated. It's unfortunate that the people involved have a 'rival' product and they could do with pointing to it a bit less, but it doesn't make any of the criticisms less valid. Painting them as 'politics' is just slander.

josephlord3• 13 years ago

The wishing of failure isn't great, my personal wish would be for the Telegram people to learn the errors of their ways rather than necessarily completely fail.

Overstated claims of privacy could get people killed if they trust them so it is a serious issue.

Telegram have an arrogance that is inappropriate in security/crypto protocol development. Most crypto protocols, even those developed by experts initially have problems (at the protocol design level even ignoring the implementation bugs) which is why even experts only come up with new ones when there isn't any existing one with the required properties and even then reuse as much existing battle tested technology as possible and submit it to worldwide evaluation tentatively and nervously.

The competition was set up in a way that clearly excluded most threats and was either another sign that Telegram didn't understand most of the threat space OR that they did and wanted to rig the competition to be unwinnable while claiming that it validated the security in some way.

So at least until yesterday Telegram were arrogant and either completely clueless about crypto protocols or PR bullshitters with some clue and a poor protocol. They need to get a clue AND drop the arrogance to get support from me.

Until these things happen Telegram are a danger that people should be warned about and not regard as secure.

I am also a neutral party with no relationship with either party.

danabramov12• 13 years ago

Pavel, I am hopeful that you will reward the chap even though the discovery was not within the "guidelines". it is all about the spirit of the competition.

He does reward the chap—with $100 000: https://vk.com/wall-52630202_7858

I figure it's fair.

techquery• 13 years ago

They did give him a reward. Telegram has just posted the translation on twitter. Moved to separate discussion: https://news.ycombinator.com/item?id=6950129

runn1ng• 13 years ago

Really?

The protocol is bad, this competition protects only the most basic attacks and still was broken in about 5 days.

It's not "unnecessary pride". You have to be really cautios with cryptography. Not use the first thing that has "Secure!" sticker on it.

salient2• 13 years ago

The app was far from being a "secure" app. And going by how far they've to promote it as a "secure" app, of course there should be an equal amount of response for why it's not secure (since it isn't!). This is not just about some "guys making an app and being taken down for it". This is serious stuff. They're claiming their security is one of the best in the world, when it couldn't be farther from the truth. Why would you want such an app to be popular and make people think it's actually secure, when it's not?

h0cked2• 13 years ago

well, if someone causes you significant lose, will you turn down a norch? That's why we are bashing on them as they are making BS claims about how secure their protocol is.

classicsnoot• 13 years ago

This trend of ignoring the content because of the tone is pervasive and troubling. I understand that tone matters in regards to reception, but in this place i assume we all, grammar nazis and privilege checkers alike, choose to asses the technical aspects of comments and largely disregard the "gift wrap". In this situation, the problem with Telegram is their words right big checks their work cannot cash. The TextSecure chaps are defending their turf viciously, but i have yet to see one of them make a personal assessment as the predicate for their assault. I have been following it very closely, comment wise, and all it has really been is long winded explanations (on the TextSecure side) of why the Telegram contest was a sham (it was) and why TextSecure is better (i have no way to judge). On the other side (Telegram), all i see are pleas to leave the Telegram guys alone, hate toward Moxie et al., and general pseudo-martyr comments about how mean Hacker News is.

Good. Let's be hard to please. This is not [spoiler]fucking[/spoiler] macaroni paintings we are making and using to please mommy. These are the apps we all use to continue our work and edify our lives. I want it to be a gauntlet; i think it is great that people's products are critiqued so meticulously, and i am happy that a competition with such glaring inconsistencies (to whomever wrote the alternate competition explanation...thank you)did not survive for long. As an American, i am so tired of security theater. If something is touted as secure and is not, i want to know about it.

And as for the ridicule, if you obfuscate and misrepresent, you invite a harsh response.

forgottenpass• 13 years ago

As for the TextSecure/WhisperSystems guys, stop being like the politicians we hate who campaign by slinging mud on opponents instead of selling their stuff.

It's funny that you mention politicians at the end of the post, because as I was reading your posts in this thread, I couldn't help but think you were feeding into the huge cable-newsification of this disagreement. It is what happens when a bunch of lookie-loo viewers want to be involved in the debate but can't keep up on the issues. I struggle to completely follow the tech here but my job occasionally brings me close enough to crypto that if nothing else I understand the huge disparity between the technical discussion and the superficial one at play here.

Attempts to fit this disagreement into the same oblique, non-existent, ideal behavior for a disagreement subverts the ability to productivity disagree and makes behavior worse overall. Your remedy is for them to not disagree. I take it differently. I want them to disagree, but I don't want anyone involved in the disagreement to dishonestly play to the masses. But that would involve conceding a point, and what would that do to the bottom line?

Focus on selling the TextSecure app and not looking to takeout anyone who has a different approach.

You mistakenly seem to think that TextSecure exists primarily for profit. It is obvious the aim is good crypto. They're playing a different ball game than Telegraph's freemium model, one where marketplace success doesn't determine if they implemented their crypto right. Promoting _that_ involves explaining why the Telegraph tech is deficient.

Back to the cable news analogy, in a post of yours further down the thread, you bring up what the right level of security is for this app. That's a good question, one moxie (I think) brought up days ago by pointing out they didn't have threat model and tptacek (I think) called them out for using nation-state actors as the adversary in selling the app. They played that card in technical criticism, you bringing it up here for goalpost shifting now that they're starting to look bad and you want to keep driving down the middle of the disagreement.

PS: I have no relationship with either party. I am a neutral observer that has his own opinions.

Oh, I know. You're playing into the US-politics detached observer rote well. You should know that the system adapted to account for that stance years ago. You're getting played as hard as everyone else.

ateevchopra• 13 years ago

The first thing they teach in hacking class is "Nothing is 100% secure. Even the brain.exe is vunerable.".. Well proved again. Nice work !

rikacomet3• 13 years ago

Lol, I don't know whats so bad in Telegram being a bit "braggy" about their stuff. I mean, it took them a lot of hard work, in the first place since they did a lot of things on their own, instead of using pre-set standards. Everyone can loose a grip on self control, more than a few times. So what!

Besides, its only to inspire someone to crack their program, it is necessary to come across as a bit arrogant, so someone would loose a screw and crack it. never mind the buttery language post-cracking, since that usually comes from appreciation for each other.

Putting up a challenge publicly is a great PR tool, I feel its not reasonable to only bash 1 company about it. Unless, there is something I don't know, about what they said/did earlier on HN.

xternl• 13 years ago

Interesting. I'm wondering about Threema, I think Moxie is already on them.

jokoon• 13 years ago

Noone should trust a service that advertises itself as being safe from governments ears. Pure and simple.

First, there's a risk the NSA is actually the one initiating those services.

Secondly, in cryptography, it's very hard if not impossible to effectively prove your messages are not read by someone else. Cryptography experts do not tend to work for people's interests. And if some do, the NSA has too many resources to just defeat those who try to not be listened to.

I understand the intention is noble, but if you release such a safe tool, the NSA will view it as a terrorist threat, because that's the job they have been given, and they will end up listening anyways.

I can't understand the paranoia about all this. If you're really afraid the NSA might use information against you, it's because you made political enemies, in this case, why use digital means of communication at all ?

I really tend to think it's being cool to use those cryptographic features, rather than anything else, and that's worrying.

solyanyk2• 13 years ago

The Telegram guys chose to view it as a proof of inherent superiority of humble Russian programmers over NSA-backed American haters (I wish I was kidding!). Here is what Pavel Durov had to say on the matter (translated from his public post on vk.com http://vk.com/wall-52630202_7858):

This story makes me once again admire Russian programmers. For a whole week esteemed American cryptographers on HackerNews were picking on the protocol fruitlessly - mostly demanding to replace our own solution with algorithms from NSA-backed Suite B [sic!]. An yet a Russian programmer, who calls himself "a novice", could immediately recognize the weak spot in the secret chats, in the context of an article on Habrahabr.ru.

Edit: To make it clear, that is not the whole post, just the first paragraph relevant to my point

ge0rg2• 13 years ago

Not sure if the VK post was edited later on, but you are missing the other important statements by Pavel:

* There was no data leak, the vulnerability is fixed, there is no danger. * It was a good idea to open the source and protocol for review. * The founder of the vulnerability deserved a reward of $100k, and comparable rewards will be made for further attacks of similar grade.

solyanyk2• 13 years ago

I didn't mean to present his whole post. It was the first statement that I had issue with. I amended my comment to make it clear.

ge0rg2• 13 years ago

On http://vk.com/wall-52630202_7858 Pavel Durov writes that the finder of this vulnerability will receive a reward of $100k, and that comparable awards will be given for other findings. It looks like they are slowly making progress from a rigged show to a proper crypto evaluation situation.

lawnchair_larry• 13 years ago

The bad thing about this is that it further advances the delusion that this contest is a reasonable idea. Nothing was "improved" by finding this. It's just going to reinforce their bad behavior.

morj• 13 years ago

There is another "tab" for MITM (at least in android client and in the documentation there are no clues of it) :

Even in the corrected version of Diffie-Hellman (with nonce removed) the server can slip customers a number which is zero modulo p as g_a or g_b (since the documentation says about the 2048- bit sequence -- it can be either 0 or p itself). Then both clients will see the same identicon ("visualization key", 'cause it will be a presentation of SHA1 applied to zero).

However, judging by further manipulation with the "shared secret" key (because MTProto doesn't use Diffie-Hellman method of multiplying by g^ab^-1 or any multiplication by the shared key whatsoever) the multiplication by zero will not happen with client messages and they will successfully flow through the "bare" AES ( and therefore users will think that everything is fine and will proceed to transmitting sensitive data in this mode ).

P. S.: Correct me if I missed something . This might be a corner case, but, nevertheless, it formally differs from the one with server xor salt not much (at least , need fixes in the client and the doc too). Or am I making a mistake somewhere? P. S.: Original version of this my comment in russian: http://habrahabr.ru/post/206900/#comment_7128970

Telegram protocol defeated. Authors are going to modify crypto-algorithm

Related Stories