Slashdot Mirror
US Intelligence Agencies Tried To Bribe Our Developers To Weaken Encryption, Says Telegram Founder (twitter.com)
In a series of tweets, Pavel Durov, the Russian founder of the popular secure messaging app Telegram has revealed that U.S. intelligence agencies tried twice to bribe his company's developers to weaken encryption in the app. The incident, Durov said, happened last year during the team's visit to the United States. "During our team's 1-week visit to the US last year we had two attempts to bribe our devs by US agencies + pressure on me from the FBI," he said. "And that was just 1 week. It would be naive to think you can run an independent/secure cryptoapp based in the US."
Telegram is one of the most secure messaging apps available today, though researchers have pointed flaws in it as well.
Telegram is one of the most secure messaging apps available today, though researchers have pointed flaws in it as well.
Keep that in mind. If you are using VPN/encryption tool/secure communication network/etc. created by US based company, it is very unlikely that it is actually secure.
... complete lack of surprise.
Appy app apps with crypto apps for the FBI luddites to have crypto back door sessions on apps.
APPS!
Step 1) Create messaging app with no users but strong encryption.
Step 2) Profit from government payoffs!
Step 3) ENDLESS PROFIT
"There is more worth loving than we have strength to love." - Brian Jay Stanley
It would be naive to think you can run an independent/secure cryptoapp based in the US.
Published source makes it a lot easier to spot problems with the code.
Also, with published source code you can, with the appropriate license, legally recompile it yourself using your own set of tools as a hedge against the publisher's tool-chain or binary-repository being compromised.
Granted, if your tools (anything from the bare metal on up) is compromised or if you are using it to talk with someone else who is using a different binary, all bets are off.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Telegraph found Samuel Morse is still alive?!
https://en.wikipedia.org/wiki/Samuel_Morse
When the U.S. tries to bribe Russian app developers to break their app, but Russian government doesn't... so yeah, who are the bad guys again?
U.S. government agencies and news outlets wants us to believe it's every damn country east of Europe... nobody buys your lies and false-flags any more.
If the NSA failed to bribe their developers, it doesn't mean they are just going to give up. A bribe is just the most cost effective solution for the long term. Have no doubt that they will seek or even maybe even create a weakness in the application.
Anons need not reply. Questions end with a question mark.
While I wouldn't be terribly surprised if the various three letter agencies try this... would they really be stupid enough to let him know where they were from? It's not like they would have appealed to the Russian's sense of patriotism for the US.
On the other hand, this sort of publicity could drive users to his product, providing a motive to lie.
Methinks that we should remain a bit skeptical on this one.
I mean, here we got this Russian guy, and then there's Trump, probably offering to buy him out, just as soon as he pays off his other Russian debts.
The czech is in the mail
Manage your own asymmetrical PGP keys and encryption, while using any messaging app. Not as integrated as Telegram or other streamlined apps, but secure communication is possible, just need to take a few extra steps.
Trying to induce a false sense of security:
"they are trying to bribe us so we must be doing something right."
Whereas the ploy may be to make you think that.......
It's not really about the US; the US government's behavior is merely helping to illustrate the deeper errors made by the users.
More generally:
If you are using an app created by a company, which is only compatible with itself rather than complying with a public spec, it is very unlikely that it is secure. (It's also pretty unlikely that it won't suck in other ways too.)
Stop talking about apps, and start talking about protocols. Answer the "which of these apps works best for me?" question later, after protocol selection. If telegram doesn't work with anything else except telegram, then you can be pretty sure that telegram is the wrong choice.
"Believe me!" -- Donald Trump
Published source makes it a lot easier to spot problems with the code.
Demonstrably false in most circumstances. Just because the code is available does not mean competent people are looking at it and finding bugs. It would be safe to say most open source programs are not being looked at by a lot of eyes beyond the primary developers. You need more than published source code to make it easy to spot bugs. Heck a lot of code is so badly written that it would be easier to re-write from scratch than to find a bug in it.
Maybe. Or maybe you're just *saying* it to make yourself look better while bashing the US.
How will we ever know for sure?
"I don't know, therefore Aliens" Wafflebox1
Comment removed based on user account deletion
There's no way any software of US origin can be trusted - paricularly closed source. The US interferes in the affairs of most countries on earth, including in elections and referendums in my own nation. Now they also want to spy on personal communications, and bribe developers from countries that have less invasive surveilence policies. Time to completely isolate this parriah state in my opinion.
Telegram is an alternative to whatsapp or equivalent service from google.
Hopefully European politicians will not be so dumb to break it... (look out to fake "save the children" broadcast)
Any person that does any "professional" work must consider the sharing of contacts,documents, communications as a breach of contract with the client.
I am looking at what happens on the cellphone/tablet market and pray/hope that there will be a NON US based company providing some reasonable platform.
The amount of information that an Android phone share with Google by default (same with Apple) is way too much, real big brother on steroid.
This may be true, and he didn't accept the bribes; he may be saying this after accepting the bribes; he may be saying this as a publicity stunt; he may be saying this to deflect attention away from the backdoors already installed for the Russian government; he may be saying this because... ...we have no fricking idea. How deep down the rabbit hole do you want to chase your favorite conspiracy theory?
Granted, it's hard to be prepared for all eventualities, but it sure would be nice if he had a recording of the meeting, and the words exchanged.
Enjoy life! This is not a dress rehearsal.
While bribing developers to weaken encryption is most likely not above what intelligence agencies do, this could also be a PR move.
By saying an intelligence agency attempted to bribe your devs, it implies that :
- Your app is so secure that it can't be cracked by external means
- That your company standards are so high that bribes don't work
- That the government is watching and using unethical methods, and that an app like the one you offer is needed
- Competitors may have been bribed too, and if they aren't saying anything, they may have fallen for it
Considering the flaws of Telegram, this may be just an attempt to make it feel more secure than it really is.
It's self-grandizing bullshit. Haha. Suckers! Believe! Anything! Here!
Comment removed based on user account deletion
Option 1: Could be Russian/Telegram propaganda.
Option 2: Could be true because seriously, who trusts the FBI/NSA not to violate our privacy anymore?
Really not sure what to believe about this one.
So Russians are accusing US intelligence of weakening their apps security? Meanwhile they hacked whole elections. And have been relentlessly undermining our Intelligence. Complaint seems legit ....smh.
Comment removed based on user account deletion
Technically, it's worth clarifying a few things:
- It's RSA the security company (peddling their encryption solution), not RSA the algorithm (there continue to be no known problems with the RSA algorithm).
- What they were paid the $10 mil for is to use the Dual_EC_DRBG random number generator (this is not a cipher, merely a random number generator for one).
- The Dual_EC_DRBG algorithm was a faulty backdoored standard certified for use by NIST for use in cryptographic software (NIST = the body that certifies crypto algorithms for use and consults with the NSA about security of the algorithms). EC ciphers in general, have not yet been proven to be insecure.
- The settings for Dual_EC_DBRG were not weakened, as it was never a secure algorithm in the first place. The magic constants the NSA defined, allowed them to reconstruct the seed value for the RNG algorithm from a very small number of inputs.
- After the Snowden leaks proved Dual_EC_DBRG insecure, NIST revoked the standard.
Here in the US, intelligence agencies effectively OWN many tech companies and mandate these weaknesses in engineering to their trusted men (or women) in development teams. Of course I'm talking primarily about Google and Microsoft, and many others besides.
conspiracy theory blah blah blah
Too long of an argument to make to defend, but it might suffice to point out how everyone important is invested in every important business and so this mutual investiture forms the mechanism for the 'crazy crazy impossible' conspiracies that many like to comfort themselves by ignoring.
This is 2017 man, you don't need actual users, just a trend-line and PROJECTED users.
If you can't ramp up a nice trend line from India for under $100 well I don't know what to tell you.
Heck if you spend the $100 to buy users from Russia THAT trend line will have the government BEGGING to give you money to weaken encryption.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
You've invented a strawman based upon Left versus Right politics. Or Capitalism versus Centrally Planned economies. Or something, frankly I couldn't force myself to read your whole tortured logic in detail.
Putin is an enemy because he is a totalitarian leader and a kleptocrat. He seeks to destabilize as much of the world as he can get away with in order to increase Russia's power and influence. More to the point he wants to increase Putin's power and influence.
Do you know what intervention from friends looks like? People who identify themselves and state their opinions and motivations openly. Do you know what interference from enemies looks like? People who conceal their identities and use subterfuge and misdirection to achieve a hidden agenda.
Oh, but you're smart! You know what's what, and certainly the Russian campaign of interference had no impact upon you! Nor anyone else, of that you are certain. Well good for you. Your smug ignorance left you open to the Russian campaign of interference and it will do so again.
You ask "So, really, what's the deal?" Yet you appear to need the difference between a "friend" and an "enemy" explained, when everyone already knows the difference. So what's your deal then?