Slashdot Mirror

$300,000 for Cracking Telegram Encryption. How about that challenge?

https://telegram.org/ has a huge advantage over WhatssApp: your phone number is not shared with all members of a group (I avoid to participate in WhatsApp groups just for this)

Time to look for a WhatsApp replacement..

https://telegram.org/ is not the answer here? It's interface is very similar to WhatsApp: easily to make friends and family members to migrate :P

https://telegram.org/

The serious downside I see is that it is now owned by FB, which I don't use or want to use. But I like WA so much I don't want to drop it.

Your could explore Telegram , which has all the features you mention (with bigger metrics), and more.

quick run to Putin, i found them, they are in the source code: https://core.telegram.org/mtpr... ....
otoh, methinks the fsb will have less success than the us did trying to block the AACS decryption key.

Telegram is cross platform, but has no voice

Yes it does, stop lying.

Telegram is cross platform, but has no voice or video calling (at the moment). https://telegram.org/

WhatsApp pulled that same stunt on older iOS versions just a few days ago. I convince most of my friends to switch to Telegram and Threema.
For business and games we mostly switched to Discord.

https://threema.ch/
https://telegram.org/
https://discordapp.com/ -- replacement for Skype and TeamSpeak

Pissing of their user base ... I really wonder how long companies continue to think they can continue to do that.

How about Telegram? https://telegram.org/
or wire?

Oh, and before we go any further, here is the official reply from Telegram:

"Certain people checked whether some Iranian numbers were registered on Telegram and were able to confirm this for 15 million accounts. As a result, only publicly available data was collected and the accounts themselves were not accessed. Such mass checks are no longer possible since we introduced some limitations into our API this year.

However, since Telegram is based on phone contacts, any party can potentially check whether a phone number is registered in the system. This is also true for any other contact-based messaging app (WhatsApp, Messenger, etc.)."

https://telegram.org/blog/15mi...

I'll just leave this here. https://telegram.org/faq#q-how...

Also, it does not at all apply here. Telegram not just publishes documentation how their protocol works, but it also releases the full source code: https://telegram.org/apps#sour...

So even if the mtproto documentation would have a flaw or be not precise enough to fully specify the behaviour (and that often happens!), you could still look into the source code to find out what actually happens.

Also, it does not at all apply here. Telegram not just publishes documentation how their protocol works, but it also releases the full source code: https://telegram.org/apps#sour...

So even if the mtproto documentation would have a flaw or be not precise enough to fully specify the behaviour (and that often happens!), you could still look into the source code to find out what actually happens.

That's a valid question and there is no single correct answer on how to implement end-to-end (E2E) encryption in a "distributed" fashion. E2E encryption can be done in various ways, either so that it's device dependent or by utilizing the excellent features of public key infrastructure. Here's a simple, and probably not the best, example on how one could go about with E2E encryption and still have access to message backlog, history and so forth:

1) Create a public-private key pair for each client and use the centralized severs to distribute the keys.
2) Store (public key) encrypted messages on the centralized servers.
3) Distribute your private key between the devices you want to be able to access your message history with.

Step 3 could be done for example so that your client encrypts your private key with a 20+ character password and distributes it via the centralized servers. When you want to access your account/messages from another device, you connect that device to your account as you do today. Before you can access your messages, you'd have to download your encrypted private key from the server and enter the 20+ character password to open it. This password would be initially present only on the device where you created the key pair on, but you could back it up on paper too if wanted.

This is a very simple and likely not at all the best way to approach the problem, but it's just an example on how it could be done in a fashion that allows what you described in your post. As you know, Apple does something pretty similar to this with their users' messages (even Apple can't access users' message data) and they're still available for your account when you authenticate.

And finally, as a side note, Telegram's encryption implementation really is strange. There are quite a few excellent blog posts by security experts analysing their encryption schema and they point out pretty well what exactly is wrong with it. To my knowledge, Telegram has stated that they've done many "compromises" in their encryption schema for the sake of improving battery life on mobile devices. While this is a somewhat valid ponit, I personally feel that these days security should go above battery life. "Secure" should be the default and "restricted/private" should be an optional feature.

Telegram is yet to acknowledge the vulnerability, let alone provide a fix for it.

Hard to acknowledge a bug posted only yesterday on an obscure blog, and published what looks like about 3 hours ago on a news site, when TFA states:

Telegram hasn't even publicly acknowledged the vulnerability after the two researchers found no way of notifying the company about the issue.

Hey researchers, I've found a flaw in your notification process.... you couldn't find this page or this FAQ.

Telegram is yet to acknowledge the vulnerability, let alone provide a fix for it.

Hard to acknowledge a bug posted only yesterday on an obscure blog, and published what looks like about 3 hours ago on a news site, when TFA states:

Telegram hasn't even publicly acknowledged the vulnerability after the two researchers found no way of notifying the company about the issue.

Hey researchers, I've found a flaw in your notification process.... you couldn't find this page or this FAQ.

Telegram is superior to Whatsapp in every way - open API, GPL'd clients, multiple simultaneous connections, better security, etc. Run by a nonprofit.

It's less popular (probably around 100M users at the moment), but if you can convince those you communicate with most frequently to give it a shot, it's worth it.

Careful with labelling Telegram as "Open Source", it is not completely open source by any measure.

Have a look at their website.

How is this being funded? Take a look here. They claim that it is free and will always be free.

I just don't understand the angle here. Is it just a honeypot? Is it a long-term investment?

They primary concern I have for both WhatsApp and Telegram is that to use either you *must* disclose a telephone number. By definition that number is tied to some kind of billing account and is traceable. Even if you buy a pre-paid SIM (depending on jurisdiction you may have to provide ID) the number can be traced and located trivially. I've looked into it and there is no way to create an account with either service without using a telephone number. It's almost strange, and I have some grave reservations about what's really going on here.

Anyway, here are some interesting bits from the Telegram FAQ, but I would recommend reading all of it before installing and using the service.

-------------------

Q: Who are the people behind Telegram?

Telegram is supported by Pavel and Nikolai Durov. Pavel supports Telegram financially and ideologically while Nikolai's input is technological. To make Telegram possible, Nikolai developed a unique custom data protocol, which is open, secure and optimized for work with multiple data-centers. As a result, Telegram combines security, reliability and speed on any network.

While the Durov brothers were born in Russia, as were some of the key developers, Telegram is not connected to Russia – legally or physically. Telegram's HQ is in Berlin.

Q: Will you have ads? Or sell my data? Or steal my beloved and enslave my children?

No.

Q: How are you going to make money out of this?

We believe in fast and secure messaging that is also 100% free.

Pavel Durov, who shares our vision, supplied Telegram with a generous donation through his Digital Fortress fund, so we have quite enough money for the time being. If Telegram runs out, we'll invite our users to donate and add non-essential paid options to break even. But making profits will never be a goal for Telegram.

Q: Why not just make all chats ‘secret’?

While all Telegram messages are always securely encrypted, messages in Secret Chats use client-client encryption, while cloud chats use client-server/server-client encryption and are stored encrypted in the Telegram Cloud (more here). This enables your cloud messages to be both secure and immediately accessible from any of your devices, you can also easily find them using server search — which is very useful at times.

The idea behind Telegram is to bring something more secure to the masses, who understand nothing about security and want none of it. Being merely secure is not enough to achieve this — you also need to be fast, powerful and user-friendly. This allows Telegram to be widely adopted in broad circles, not just by activists and dissidents so that the simple fact of using Telegram does not mark users as targets for heightened surveillance in certain countries.

Q: Why not open source everything?

All code will be released eventually. We started with the most useful parts — a well-documented API that allows developers to build new Telegram apps, and open source clients that can be verified by security specialists.

Careful with labelling Telegram as "Open Source", it is not completely open source by any measure.

Have a look at their website.

How is this being funded? Take a look here. They claim that it is free and will always be free.

I just don't understand the angle here. Is it just a honeypot? Is it a long-term investment?

They primary concern I have for both WhatsApp and Telegram is that to use either you *must* disclose a telephone number. By definition that number is tied to some kind of billing account and is traceable. Even if you buy a pre-paid SIM (depending on jurisdiction you may have to provide ID) the number can be traced and located trivially. I've looked into it and there is no way to create an account with either service without using a telephone number. It's almost strange, and I have some grave reservations about what's really going on here.

Anyway, here are some interesting bits from the Telegram FAQ, but I would recommend reading all of it before installing and using the service.

-------------------

Q: Who are the people behind Telegram?

Telegram is supported by Pavel and Nikolai Durov. Pavel supports Telegram financially and ideologically while Nikolai's input is technological. To make Telegram possible, Nikolai developed a unique custom data protocol, which is open, secure and optimized for work with multiple data-centers. As a result, Telegram combines security, reliability and speed on any network.

While the Durov brothers were born in Russia, as were some of the key developers, Telegram is not connected to Russia – legally or physically. Telegram's HQ is in Berlin.

Q: Will you have ads? Or sell my data? Or steal my beloved and enslave my children?

No.

Q: How are you going to make money out of this?

We believe in fast and secure messaging that is also 100% free.

Pavel Durov, who shares our vision, supplied Telegram with a generous donation through his Digital Fortress fund, so we have quite enough money for the time being. If Telegram runs out, we'll invite our users to donate and add non-essential paid options to break even. But making profits will never be a goal for Telegram.

Q: Why not just make all chats ‘secret’?

While all Telegram messages are always securely encrypted, messages in Secret Chats use client-client encryption, while cloud chats use client-server/server-client encryption and are stored encrypted in the Telegram Cloud (more here). This enables your cloud messages to be both secure and immediately accessible from any of your devices, you can also easily find them using server search — which is very useful at times.

The idea behind Telegram is to bring something more secure to the masses, who understand nothing about security and want none of it. Being merely secure is not enough to achieve this — you also need to be fast, powerful and user-friendly. This allows Telegram to be widely adopted in broad circles, not just by activists and dissidents so that the simple fact of using Telegram does not mark users as targets for heightened surveillance in certain countries.

Q: Why not open source everything?

All code will be released eventually. We started with the most useful parts — a well-documented API that allows developers to build new Telegram apps, and open source clients that can be verified by security specialists.

I like telegram ( https://telegram.org/ ) . It gets a 7 on EFF ( https://www.eff.org/node/83766 ) and has clients on android/ios/windows/mac/linux and even on winblows phone that nobody uses

Telegram is better. Open API, open source clients, multiple concurrent connections, end-to-end encryption availability..

Though it doesn't have WhatsApp's userbase (yet), they do have over 50m active users and growing by the day.

Help us displace WhatsApp once and for all!

Telegram offers every feature of WhatsApp, plus end-to-end encryption with visual signatures, arbitrary file sharing, multi-device support (including PC), is open source and the API is published.

They claim to have 40M+ users, so they're a substantial amount of the way to displacing WhatsApp already.

The big deal is that it got so many things right back when no one else could figure it out, and that netted them a ton of users (which of course means that most of our friends are probably already on it.

Here are the features that won me over two years ago:

- Proper functioning chat groups that forward every message type (video, audio, locations, text, etc) to all members
- Location sharing
- The two-checkmark system (one means message reached server, two means message reached user's device)
- Zero configuration; your contacts are scanned (I get why some people have a problem with this, though), and everyone else who has WhatsApp installed appears automatically
- Audio messaging (GMRS-style)

Keep in mind, WhatsApp supported all of these features years ago. It was fast, reliable, simple to install, easy to use... it really was unique. Now everything out there supports all or at least most of this functionality, but it's too late; WhatsApp already has the user base.

Myself, I'm hoping Telegram displaces them.

Ghostery
VPN
Delete cookies on exit
Telegram not Facebook
Don't play angry-birds!!

Join site(s) like 38 Degrees, Avaaz even with the god-awful tories in power, 38 Degrees have made a substantial difference many times.

Donate to EFF, UCL, etc.

I wanted to mean protocols like e-mail etc. are protocols, not e-mail etc. per se.
From the Whatsapp story I've learnt about this as an example :
https://core.telegram.org/api
https://core.telegram.org/mtpr...

Maybe it's not really "universal" in the meaning that everyone and his dog will use it, maybe if you clone it all you're creating an "island" that doesn't interoperate directly with the original app and its users (I don't know). But it's the kind of stuff I wish for. Similarly there could be open API or protocol for a sharing pictures/sending pictures kind of app that is not e-mail or MMS and that doesn't rely on using f...book/whatsapp/google/whatever, or for some kind of app I'm not thinking of.

I agree about setting up your own web hosting for your phone apps, e.g. you could have a notes taking app that saves data on your own server. I'm waiting for Firefox OS hardware, which I might get to do that kind of stuff. Heard that you can set up your own "Firefox Sync" server too.

I wanted to mean protocols like e-mail etc. are protocols, not e-mail etc. per se.
From the Whatsapp story I've learnt about this as an example :
https://core.telegram.org/api
https://core.telegram.org/mtpr...

Maybe it's not really "universal" in the meaning that everyone and his dog will use it, maybe if you clone it all you're creating an "island" that doesn't interoperate directly with the original app and its users (I don't know). But it's the kind of stuff I wish for. Similarly there could be open API or protocol for a sharing pictures/sending pictures kind of app that is not e-mail or MMS and that doesn't rely on using f...book/whatsapp/google/whatever, or for some kind of app I'm not thinking of.

I agree about setting up your own web hosting for your phone apps, e.g. you could have a notes taking app that saves data on your own server. I'm waiting for Firefox OS hardware, which I might get to do that kind of stuff. Heard that you can set up your own "Firefox Sync" server too.

Hello, Telegram. https://telegram.org/

Make sure your friends know about this app, It needs critical mass, nobody is using it.

A competing app did just that, and a guy from Russia won the $100k. Now they're offering $200k.

Still no article on Telegram in /.