Crowdsourcing a More Secure Future

http://telegram.org/blog/crowdsourcing-a-more-secure-future

by techquery • 13 years ago

121 92 13 years ago

telegram.org

growse2• 13 years ago

Seems a little.... arbitrary....?

Don't people who run bug bounties publish their reward structure beforehand?

jonknee• 13 years ago

Yes, they did. This was not the goal of the bounty, but was still a serious issue. They couldn't give away the prize for the contest and instead decided on a still quite generous $100,000.

http://telegram.org/crypto_contest

sillysaurus29• 13 years ago

This was not the goal of the bounty, but was still a serious issue.

To be clear, this bug was enough to compromise the security of every Telegram secret chat session. I can't think of a more serious issue.

adambenayoun• 13 years ago

Other people claimed that the Telegram team might find that bug to be outside of the scope of their bounty contest, so $100k is better than nothing (and to be frank I'm quite surprised they were _that_ generous).

But you're right - they should have a clear reward structure.

jsumrall• 13 years ago

I thought a lot of people pointed out ways to attack the security protocol if they had physical server access.

lelf• 13 years ago

With this bug people who run server have access to your entire chat.

(Of course they won't formulate it that way in the post)

mikegioia2• 13 years ago

Good for Telegram. I haven't downloaded and installed their App yet, but I applaud their effort at putting out a secure chat app that everyone can use.

I've been using TextSecure for a while (as everyone on HN ruthlessly suggests) but guess how many encrypted texts I've sent? 0. That's because they have no iOS app and very few Android users.

There are two problems when it comes to creating a good, secure messaging app: strong, proven security and popularity! Hopefully Telegram either solves both or forces TextSecure to solve the latter.

sillysaurus29• 13 years ago

I applaud their effort at putting out a secure chat app that everyone can use.

They aren't making a reasonable effort to put out a secure chat app. If they were, then they would use some of that $200k to hire a company like Matasano to fly out and audit their architecture for flaws. Matasano probably would've caught this bug, because it was a pretty basic mistake.

mikegioia2• 13 years ago

I don't mean to sound snide, but judging from your comment history on Telegram related posts, are you really the right person to determine what "reasonable effort" means in this context? Every single post you make is biased negatively towards Telegram.

What I applaud is their effort here and I hope it continues and moves in the right direction. This announcement makes it seem like they are in fact moving in the right direction.

paveldurov• 13 years ago

Not sure hiring a US security firm is a safer approach than crowdsourcing using the power of the global community.

After all, Matasano's tptacek obviously did spend some of his time inspecting and criticizing Telegram this week. However, he overlooked the 100K vulnerability that was later discovered by a Russian guy who considers himself a newbie in cryptography.

The other reason that makes me somewhat reluctant to spend money on hiring Matasano is the recent RSA-gate (and the strange role of tptacek in it).

wglb• 13 years ago

I suspect that many students of the Matasano Crypto Challenge would have caught this bug.

chetanahuja• 13 years ago

"They aren't making a reasonable effort to put out a secure chat app. If they were, then they would use some of that $200k to hire a company like Matasano to fly out and audit their architecture for flaws."

I don't know whether user sillysaurus2 is connected to Matasano or not but... oh boy... this does come across as a shameless ad for that company.

sandGorgon• 13 years ago

Just fyi - last week Cyanogenmod started pushing out WhisperPush/Textsecure to Cm11(kitkat). I now have whisperpush by default on my phone.

Considering that they just raised 28mil and that CM is pretty much defacto for older androids, there is a very good chance that this might work.

abus• 13 years ago

This is actually really generous considering it didn't meet the terms of the contest.

They have a long way to go before anyone here trusts them but perhaps we could be more positive and constructive?

sillysaurus29• 13 years ago

perhaps we could be more positive and constructive?

You find DanBC's comment interesting. It explains why there's been a general tone of negativity towards Telegram's security product. https://news.ycombinator.com/item?id=6949842

jes2• 13 years ago

I question whether Telegram is actually delighted with how this unfolded. I also think it's disingenuous to call the discovered issue a potential vulnerability. Either it is a vulnerability or it is not.

sifarat2• 13 years ago

Bravo Son! you have earned respect for your this deed. Appreciated.

On a side note, I am still not sure, if i will ever use this app. This is primarily because, I act on the internet in the same fashion as i do in real life. I won't do anything online, what I can't do in real life. Hence I don't and perhaps would never need an app like this.

As for sending someone 'secret' message, I always whisper that in the ears. It's an old fashioned trick but has proven to be most secured.

im3w1l• 13 years ago

If someone takes a photo in the street, and you are in the photo, then you will probably not mind. But if someone follows you around everyday and takes thousands of photos, then that is slightly creepy.

For me it is the same with my chat messages. If someone reads one or two, I don't mind: they aren't very sensitive. But I don't like it if someone can find everything I've ever written.

sifarat2• 13 years ago

It's not about being creepy, it's about having enough time on hands and why. I would be interested to find someone, who values taking 1000s picture of mine than his time spent making money for himself. In the case of celebrities for instance, they have almost their entire life public, and i don't think it had harmed them any way, unless, they committed something illegal and it was made known.

People over the internet, are little too much over-sensitive. I am not implying 'Privacy' has no value, but we have taken this issue bit too far over the 'internet'.

A prime example of so-called 'anonymity' over the internet is 4chan, you pretty much know what sort site that is.

I am not implying it's an illegal website, but frankly, anonymity mostly leads to creepy, drugs (silkroad), and everything else considered wrong and bad, than something good which is pretty rare. Snowden is an exception, but again, he committed a crime for a good cause. Most people however commit a crime for every possible wrong reasons.

m_mueller10• 13 years ago

These latest news have convinced me that Telegram currently has the highest potential to be the right IM tool at my current workplace. I have one question that doesn't seem to be covered anywhere (FAQ, Google): What about Offline messages? I'd like to be able to send encrypted messages even when people are offline - on smartphones it could make use of push notifications, on the Desktop it would just wait until the client goes online again. Skype doesn't work reliably for this scenario, as in both clients (for the sender even the same client on the same device) need to be online for the message to be sent. The last implementation that worked reliably seemed to be MSN, which is dead now. How does Telegram behave?

sillysaurus29• 13 years ago

These latest news have convinced me that Telegram currently has the highest potential to be the right IM tool at my current workplace.

Why is that? This latest revelation should give less faith in Telegram, not more.

m_mueller10• 13 years ago

See my replies to makomk and ceejayoz.

ceejayoz3• 13 years ago

Really? The fact that they addressed security concerns with "they're bullshit, here, we'll prove it - break out system!" and then had to pay out nearly immediately convinced you they're awesome?

m_mueller10• 13 years ago

Yes it does. Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion. The weakness that they found could have easily been brushed off as non-exploitable, yet they didn't, instead encouraging more security experts to become involved by paying out immediately.

techquery• 13 years ago

Messages in secret chats are stored on server until downloaded by recipient. So there is no such problem like in Skype.

Push notifications also work fine there, except on iOS they don't contain any message data, just "You have a new message", probably because server doesn't know what's inside encrypted message. Although havent tried their android client.

m_mueller10• 13 years ago

Great info, thanks. I didn't expect the message to be visible in Push notifications, it's obvious to me that this couldn't work - especially with client side encryption. Whether 'Secret Chats' are truly client side encrypted is another question (see the discussion with one of your siblings).

makomk4• 13 years ago

Why? They just announced that one of the main advertised features of their IM software - the secret chat functionality - was so badly broken that it was worse than not having it at all. It provided absolutely no protection against them eavesdropping on their users, yet those users were chatting under the illusion that they were secure against such eavesdropping. Worse, it seems like the Telegram developers consider this to be a theoretical problem rather than an actual compromise because you can trust them not to spy on you.

m_mueller10• 13 years ago

That's interesting, I didn't interpret the news this way. I haven't seen secret chat functionality mentioned anywhere yet - I was assuming that secret chat shouldn't be affected by these nonce messages since the secret key shouldn't touch their servers according to their documentation. Do you have any source on this?

s1kx• 13 years ago

While it is very generous, I doubt they would give a sum like that if it wasn't for the publicity. I'm sure news like this can help their image quite a lot in their target audience (security-aware computer people).

h0cked3• 13 years ago

I actually have a theory that this is all a scam... the person who found the bug is actually the authors (or a friend) of the Telegram protocol. They published the security issue and reward themselves so that 1) they don't have to pay anyone else; 2) they get good publicity by doing this; 3) shut others up up front as this is really a very easy bug to figure out (a few others hinted the possibility as the key exchange is unautenticated DH, which is bound to flaws like this)

pearjuice• 13 years ago

What I don't understand is: where do they get the money from if their intention is to be "free forever"? Are they funded by a non-profit incubator? Why is it that a "new" app spends relatively much money on white-hat hacking bonuses? What do they get out of this other than a deemed secure application?

h0cked3• 13 years ago

The same reason as why Google provide Gmail for free, 1) to get a huge user base (fame = money, in today's internet world; 2) get a hold of user data

oskarth2• 13 years ago

The developer who found the potential weakness has earned a reward of $100,000. We have contacted him to find out how he would like to collect his prize.

This is great news. Contrast this with other security contests were finding out-of-scope security flaws weren't rewarded.

People in this thread: Good for Telegram, seems arbitrary, disingenuous, just for publicity.

Short of them being in a conspiracy with the researchers, I can't imagine how this is not good news for everyone. Cool it with the hate, people.

sillysaurus29• 13 years ago

Cool it with the hate, people.

There's no hate for Telegram here. There's concern for people's safety. https://news.ycombinator.com/item?id=6949842

oskarth2• 13 years ago

I don't think you actually read the article.

This article is good news, precisely because they show how willing they are to improve their service.

EDIT: Of course it's good PR. So what? That's how Google, Apple and most other big companies operate. They don't have to be altruistic to work and create value for people.

growse2• 13 years ago

On it's own, it's great news. In context of everything Telegram have said and done before, it's not hard to come to the conclusion of 'disingenuous' or 'just for publicity'. A company that launches a crypto challenge which can only be for publicity / marketing purposes, gets called out on it and then starts handing out cash to anyone who finds a bug looks like a company that doesn't really know what they're doing.

nly• 13 years ago

Given the complexity of bug this in cryptography terms, this was an astonishingly easy earner.

Insanely complex software bugs go for less.

deepuj• 13 years ago

If Telegram is a non-commercial project, who is funding this bounty?

jzwinck• 13 years ago

For the original "$200K" bounty, it was stated that it would be paid out in bitcoin. So it's quite possible that the person or organization funding the bounty simply has some old bitcoin laying around, and it cost them next to nothing to get it initially, and it might even be difficult for them to exchange for their preferred fiat currency today. So don't think of it as "Somebody just spent $100K," think of it as "A bitcoin speculator just traded some coins that were not worth much two years ago for something that is pretty darn valuable today."

alphakappa• 13 years ago

Telegram is backed by Pavel Durov who offered the $200k in non-bit ion currency too in a previous thread here.

Alexx• 13 years ago

Pavel Durov - https://en.wikipedia.org/wiki/Pavel_Durov

blahbl4hblahtoo• 13 years ago

Wow...Telegram. The only thing you will ever get from engaging the "public" on forums like HN is heartache. You will never get them to like you...they just aren't that in to you.

Contact people that are actually in the crypto community and go the normal route. Once their betters tell them to love you there is actually nothing that you could do to make them stop.

rimantas2• 13 years ago

So who are we supposed to listen to more than cperciva, tptacek, moxie?

nhangen• 13 years ago

How about you become smart enough to form your own opinions?

lttlrck• 13 years ago

Maybe they should give him a job too.

rb2k_• 13 years ago

Slightly off-topic, but here it goes:

I always get a bit annoyed when apps use the phone number as the primary identifier.

As somebody that just moved to another country, I now end up with a situation where I can either decide to lose my German whatsapp friends or not being discovered by my American whatsapp friends.

I would love to see the ability to get some sort of ID number and then being able to register more than 1 phone number with it.

vitoreiji• 13 years ago

I read somewhere that moxie is planning that feature for TextSecure.

infinity0• 13 years ago

money is cheap, show me the code.

even if people are being unfair with these criticisms, what telegram should focus on is to make their designs more secure, and ignore all this publicity. if they truly believe in the "importance of keeping the [system] open", then they should understand that all this publicity (good or bad) is insignificant - especially as they say they have rich guys backing them, so they're not relying on public opinion influencing investors.

it's very easy to make statements like "Together we can make Telegram unbreakable"; harder to turn this into a reality. the current round of attention is a red herring, both for Telegram and for us commenters. let's give them a year and see what it's like after that.

josephlord• 13 years ago

This is still in the FAQ:

Q: How secure is Telegram?

Very secure. We are based on the MTProto protocol (see description and advanced FAQ), built by our own specialists, employing time-tested algorithms, to make security compatible with high speed delivery and reliability. At this moment, the biggest security threat to your Telegram messages is your mother reading over your shoulder. We took care of the rest.

While Telegram may be on the way to a secure future it is not there yet and the FAQ needs to be less certain before I can applaud them.

Edit: Actually I think the FAQ been toned down a bit but I think some acknowledgement of how new the protocol is and the risks associated with that should be mentioned.

csomar• 13 years ago

Q: How are you going to make money out of this?

We believe in fast and secure messaging that is also 100% free. Therefore Telegram is not a commercial project. It is not intended to sell ads, bring revenue or accept outside investment.

If Telegram runs out of money, we'll invite our users to donate or add non-essential paid options.

Yeah, but where does there money come from?

chrislloyd• 13 years ago

Pavel Durov[1]. Net worth $260MM[2].

[1] http://telegram.org/faq#q-who-are-the-people-behind-telegram [2] http://en.wikipedia.org/wiki/Pavel_Durov

kolev• 13 years ago

There are a lot of haters of Telegram on HN and I think one of the reason is that they are a Russian company or the fact that a Russian developer found the flaw first. :) But wasn't Pavel Durov the one who offered Edward Snowden a job back then? There are many "secure messaging" apps out there, but they all suck in terms of UX. Telegram looks nice and will only get better. Also, they have an API since day one. Show some respect!

Crowdsourcing a More Secure Future

Related Stories