Slashdot Mirror

← Back to Stories (view on slashdot.org)

US Intelligence Agencies Tried To Bribe Our Developers To Weaken Encryption, Says Telegram Founder (twitter.com)

Posted by msmash on from the revelations dept.

In a series of tweets, Pavel Durov, the Russian founder of the popular secure messaging app Telegram has revealed that U.S. intelligence agencies tried twice to bribe his company's developers to weaken encryption in the app. The incident, Durov said, happened last year during the team's visit to the United States. "During our team's 1-week visit to the US last year we had two attempts to bribe our devs by US agencies + pressure on me from the FBI," he said. "And that was just 1 week. It would be naive to think you can run an independent/secure cryptoapp based in the US."

Telegram is one of the most secure messaging apps available today, though researchers have pointed flaws in it as well.

82 of 135 comments (clear)

  1. Don't trust US by qbast · · Score: 5, Informative

    Keep that in mind. If you are using VPN/encryption tool/secure communication network/etc. created by US based company, it is very unlikely that it is actually secure.

    1. Re:Don't trust US by Anonymous Coward · · Score: 5, Insightful

      Before PGP was released there were encryption standards where a company could have encryption that couldn't be broken by a person or another company but it had to be weak enough that the NSA, CIA, etc... could break into it. When PGP was released it made it where companies went against this and could make encryption as strong as they wanted to. A side note they tried to prosecute the creator of PGP for violating the Arms Export Act but were unable to since he put the code online for free and never sold it.

      The thing we are seeing now is the government is either trying to scare companies into giving them the information or bribing the developers into making the encryption weaker.

    2. Re:Don't trust US by jellomizer · · Score: 3, Funny

      Also don't trust, Russia, China, Europe, India, Middle East, East Asia...
      That is why I get all my software from Antarctica, those penguins just don't care about political pressure and they do just what they do.

      However encryption from a bad actor state is still better than no encryption.
       

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    3. Re:Don't trust US by cellocgw · · Score: 4, Funny

      I get all my software from Antarctica, those penguins just don't care about political pressure and they do just what they do.

      So you're saying all Linux software is safe? //bad joke

      --
      https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
    4. Re:Don't trust US by Anonymous Coward · · Score: 1

      Actually, putting the source code online would have violated US law. Selling it was just fine so long as it didn't cross borders as computer code, which is why the complete source code was published, with OCR friendly formatting, see the introduction at http://www.mit.edu/~prz/EN/essays/BookPreface.html.

    5. Re:Don't trust US by Anonymous Coward · · Score: 3, Interesting

      Is there any actual proof that these accusations are true? Or are we suppose to automatically believe everything a Russian company says just like every statement made by Putin is the truth and nothing but the truth? And since this is a Russian company they are required by Russian law to hand over their encryption keys and any other information the state security agencies ask them for or they cannot operate in Russia. And if the accusations are true than at least we have a couple government agencies doing their fucking jobs. It is still amazing people act surprised when they learn that an intelligence or counter intelligence agency actually spies. It's like an avalanche of stupidity has blanketed the world and wiped away any intelligent thought on the planet.

      Good lord! People have picked sides and there is no amount of evidence or facts that would ever get them to alter their opinions. Todays' political upheaval has accelerated because the goal is not to fix any of the problems we currently face it is all about winning the argument and nothing else. And to win the argument all the various sides use lies, obfuscation, and screeching hyperbole. And all of this has been accomplished using the most effective weapon the world has ever seen. The Internet. It is easy to manipulate global public opinion.

      Is it any wonder that this type of thinking is leading us into the next global war? Because WW3 has already started and by the time the mindless proles and trolls on the Internet realize that it will be to late. Every day the world's natural resources are becoming scarcer, the global population is increasing and accelerating the depletion of the natural resources, technology is replacing human workers in a world where there is already a shortage of jobs paying more than minimal subsistence wages, and the intertwined global economies are marching towards a global trade war which will inevitably lead towards real wars. At least the US citizens will finally receive a ROI for all the money spent on creating the strongest military on the planet.

    6. Re: Don't trust US by KGIII · · Score: 1

      I'd also add that, while we may not agree with the government in this matter - it's kinda pretty much what I'd expect them to do. I'm pretty sure they're gonna keep doing this, too.

      That doesn't mean give up, it just means keep resisting.

      --
      "So long and thanks for all the fish."
    7. Re:Don't trust US by Anonymous Coward · · Score: 1

      Agreed. Consider the source. A Russian app maker, who has a Russian app company, where the chance of a backdoor for the Russian spy agencies decides to make some Russian propaganda about US spy agencies.

      If you can't attack a country by force, attack them via propaganda. This worked well in Viet Nam, worked with Iraq 2 and Iran. Daesh, even with all their losses is still going strong, just because they are masters at propaganda.

      Wonder when the US and Europe will learn to not allow the hearts and minds of their population to be handed over people who want to do them harm. China has a Great Firewall for a reason.

    8. Re:Don't trust US by mbkennel · · Score: 1

      And of course the FSB would never, ever ever think to """bribe""" a Russian-based employee into a similar arrangement.

    9. Re:Don't trust US by davester666 · · Score: 1

      They are now (or already have) begun legally forcing companies to redesign their software to permit the company to be able to decode the communication. Yay, freedom.

      --
      Sleep your way to a whiter smile...date a dentist!
    10. Re: Don't trust US by Darinbob · · Score: 1

      This isn't new either. I was first using pre-internet in 1983 and the view had already been well established that the NSA was snooping on everything. The response was to either never put anything important on the net, or to obscure the snooping by putting in keywords in every post designed to overload the NSA.

    11. Re: Don't trust US by Zero__Kelvin · · Score: 1

      It wasn't "pre-internet" ... You presumably mean pre-world-wide-web.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    12. Re:Don't trust US by rogoshen1 · · Score: 1

      I think as an American, less harm would come to me from the Rooskies snooping in on my online activities (If i was doing anything worth snooping in on, of course).

      It's not like the Russians would voluntarily share anything with the US government. In fact they'd make a point not to. Now if I were a Russian, living in Russia, I'd be very cautious about using any kind of service based in Russia.

    13. Re:Don't trust US by MangoCats · · Score: 1

      FWIW, I wrote and published this steganography/cryptography app:

      http://mangocats.com/stegamail...

      and got it registered/approved via "the system." Granted, I did follow all the rules, encryption is only 56 bits, but nobody ever questioned the truth of that claim, nor requested any technical information beyond the simple claim of conformance.

      I'm sure if it were more widely used, like Twitter or something, it would come under closer scrutiny. But, there are two points here:

      First - if you don't use mainstream stuff, you can be as secure as you like, there's nobody to stop you.

      Second - hide in plain sight tech like steganography doesn't seem to be getting serious consideration by these agencies.

    14. Re: Don't trust US by Darinbob · · Score: 1

      It was before various networks were linked together to create an inter net. ARPAnet was not internet.

    15. Re: Don't trust US by Zero__Kelvin · · Score: 1

      The term "internet" was adopted in the first RFC published on the TCP protocol (RFC 675:[39] Internet Transmission Control Program, December 1974) as an abbreviation of the term internetworking and the two terms were used interchangeably.

      So no ... unless 1974 happens after 1983 on your planet.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    16. Re:Don't trust US by johanw · · Score: 1

      Open source software can;t be attacked in that way.

    17. Re:Don't trust US by Plus1Entropy · · Score: 1

      You should never trust closed-source encryption anyway, as it won't have been vetted as well or by as many people. The algorithm doesn't have to be secret for encryption to be secure.

      --
      Only crack the nuts that crack. You don't put the ones that don't crack in the sack.
    18. Re:Don't trust US by AHuxley · · Score: 1

      AC recall "Microsoft handed the NSA access to encrypted messages" (12 July 2013)
      https://www.theguardian.com/wo...
      "circumvent its encryption"
      "pre-encryption stage access to"
      "video calls being collected through Prism"
      "direct access"
      "working with the FBI, developed a surveillance capability to deal"
      "worked "for many months" with the FBI – which acts as the liaison between the intelligence agencies and Silicon Valley on Prism"

      --
      Domestic spying is now "Benign Information Gathering"
    19. Re:Don't trust US by davester666 · · Score: 1

      Yes, it can. While the code itself may not be altered in public, a company running that software to provide some service could be forced to run slightly different code.

      --
      Sleep your way to a whiter smile...date a dentist!
  2. I sense a new business model by SuperKendall · · Score: 4, Funny

    Step 1) Create messaging app with no users but strong encryption.

    Step 2) Profit from government payoffs!

    Step 3) ENDLESS PROFIT

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:I sense a new business model by KGIII · · Score: 2

      Fuck... Now I have to change my password.

      --
      "So long and thanks for all the fish."
    2. Re:I sense a new business model by sconeu · · Score: 1

      Try 12345 for your new password. I use it for all of my luggage.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    3. Re:I sense a new business model by painandgreed · · Score: 1

      That's a better business plan than some companies out there.

    4. Re:I sense a new business model by MangoCats · · Score: 1

      Did this, the government doesn't talk to you, much less offer payment, until you have users.

  3. Published source is a huge help here by davidwr · · Score: 5, Interesting

    It would be naive to think you can run an independent/secure cryptoapp based in the US.

    Published source makes it a lot easier to spot problems with the code.

    Also, with published source code you can, with the appropriate license, legally recompile it yourself using your own set of tools as a hedge against the publisher's tool-chain or binary-repository being compromised.

    Granted, if your tools (anything from the bare metal on up) is compromised or if you are using it to talk with someone else who is using a different binary, all bets are off.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    1. Re:Published source is a huge help here by beelsebob · · Score: 5, Insightful

      Published source makes it a lot easier to spot problems with the code.

      No it doesn't. It has been shown repeatedly that the idea that thousands of people will look at code and magically spot bugs is a myth.

      In practice, people either 1) don't look at the code, or 2) don't have the domain knowledge to know what that very specific function is doing.

      In reality, only the person who write it, and the 1 or 2 people who reviewed it really understand what's going on, and often not even the people who reviewed it.

    2. Re:Published source is a huge help here by alvinrod · · Score: 4, Interesting

      No it doesn't. It has been shown repeatedly that the idea that thousands of people will look at code and magically spot bugs is a myth.

      You don't need thousands of people doing that, and if you had closed code and paid for an audit of it, the auditors wouldn't do that either. But it is by definition easier for me, you, or anyone who actually cares to evaluate open source code because we actually have access to the code.

      If you wanted to evaluate it really well what I'd suggest doing is creating a set of test cases prior to even looking at the code. If something gets caught by some simple black-box tests, it's obviously not very good. Better yet, open source your test cases so then can be reused and built-upon. But since you can access the code, you could also analyze it from a white-box perspective with the test cases and look for any branches or paths that the test cases didn't cover, which may be sources of bugs or intentional tampering.

      Hell, if you want cheap labor, just have an instructor make it a project for a testing or cryptography class. It gives the students something a little more real to work with, as well as the opportunity to get involved with an open source project.

    3. Re:Published source is a huge help here by zifn4b · · Score: 2

      No it doesn't. It has been shown repeatedly that the idea that thousands of people will look at code and magically spot bugs is a myth.

      If you have bad reviewers, you get bad reviews. Garbage in/garbage out. With quality reviewers, you get quality results. It's a qualitative problem not a quantitative problem.

      --
      We'll make great pets
    4. Re:Published source is a huge help here by nine-times · · Score: 5, Insightful

      Also, it's possible to disguise malicious code to look like it's doing something else (e.g. The Underhanded C Contest). It's entirely possible that intelligence agencies try to insert these kinds of things into open source projects.

      But I don't think that was davidwr's point. I take the statement "Published source makes it a lot easier to spot problems with the code." to be pointing out that it's much ore difficult to identify weaknesses if you're provided a compiled binary, as opposed to having access to the source code. It's not that open source code is a guarantee that someone will spot bugs, but with closed source, you're completely at the mercy of the original developer.

    5. Re: Published source is a huge help here by Anonymous Coward · · Score: 2, Insightful

      But if the code is closed, it's impossible. How is that better?

    6. Re:Published source is a huge help here by Frosty+Piss · · Score: 1

      Published source makes it a lot easier to spot problems with the code.

      Who's to say that what is published is what is actually under the hood?

      --
      If you want news from today, you have to come back tomorrow.
    7. Re: Published source is a huge help here by beelsebob · · Score: 1

      It's not - the point is it's not worse either.

    8. Re:Published source is a huge help here by JohnFen · · Score: 2

      Published source makes it a lot easier to spot problems with the code.

      It makes it possible, not easier. When you're looking at the math, it's the next best thing to impossible to notice a weakening of the crypto unless you're a crypt expert. And even if you are a crypto expert, it's not an easy thing to spot.

    9. Re:Published source is a huge help here by wisnoskij · · Score: 2

      often not even the people who reviewed it.

      I don't know about you but as a software developer, sometimes I don't even understand how my code works.

      --
      Troll is not a replacement for I disagree.
    10. Re:Published source is a huge help here by Darinbob · · Score: 1

      And yet closed source is even worse! How do you audit their code, do you just take the company at its word?

    11. Re:Published source is a huge help here by Darinbob · · Score: 1

      There was the attitude in the past that security was best if the code was closed and hidden. Ie, "Security Through Obscurity". However good cryptography does not rely upon secrecy of the methods used, and in the past a lot of things assumed to be secure actually were very sloppy. And we're still making similar mistakes today. Keeping the source closed and hidden is just going to make most knowledgeable people assume there is some security through obscurity going on.

      These days you can get FIPS certifications. Yes, there is a lot of US government involvement there but the point of it is to secure the government's own files. Many of the standards it uses come from outside the government. Many recommendations made actively hurt the governments efforts (ie, to crack iphones). Such as making sure crypto computations are not done in RAM which can be snooped or hacked, automatically wiping keys if a device is compromised, etc. As a company you can basically describe what you're doing (opening the kimono) to the experts and prove that you're doing things securely. Then with that seal of approval you can give confidence to others who are not as savvy on security. FIPS doesn't require your code to change to be weaker.

    12. Re: Published source is a huge help here by Zero__Kelvin · · Score: 1

      If that was the point then you have no point.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    13. Re: Published source is a huge help here by Zero__Kelvin · · Score: 1

      If you don't understand how it works then you don't even know if it actually does.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    14. Re: Published source is a huge help here by beelsebob · · Score: 1

      No, if that was the point, then the parent poster had no point.

    15. Re: Published source is a huge help here by Zero__Kelvin · · Score: 1

      Don't be confused by your +5 rating on your initial comment. It is a phenomenally fucking stupid thing to say. Plenty of highly qualified people have reviewed the source for various implementations of algorithms when the source code is available. It doesn't matter if there are "only a few" as you put it. What matters is it that it is a well qualified few. There are people who know their shit, and those people have reviewed, for a single example, TrueCrypt and those audits matter. You want to claim that because nobody is reviewing some open source script written by a wannabee expert that nobody ever audits the important code. If you think nobody with a clue ever audited Openssh or Phil Zimmerman's code then you are an idiot. If you know they did then you are a disingenuous troll. So which are you?

      I know. Here comes the ridiculous argument that since the vulnerabilities weren't caught earlier, catching them at all didn't really matter.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    16. Re:Published source is a huge help here by nine-times · · Score: 1

      As a company you can basically describe what you're doing (opening the kimono) to the experts and prove that you're doing things securely.

      And what if they leave some things out of that description?

      Because if we're talking about intelligence agencies compromising developers and having them weaken security in their own products, it doesn't seem like they'd then disclose that weakness to security experts. I posited in the previous post that an intelligence agency might try to get some innocent-looking malicious code into an open source project. So what if that intelligence agency had the cooperation of the developer of a closed source project? The code wouldn't even need to look particularly innocent then.

    17. Re:Published source is a huge help here by Darinbob · · Score: 1

      You don't have to stop with FIPS, you can go above and beyond. Nothing is preventing a higher standard of paranoia.

      The standard is there for the government to use itself - it wants to protect information on its own devices, making sure that its own employees are not using equipment that is easy to snoop on. Because the government does use third party software and equipment, including open source. Of course, the government could actually compromise itself and weaken its own security, so that if a government employee lost a phone in a bar that other countries could crack it easily (or worse, the Washington Post). But my guess is that the government actually does want good security for itself.

    18. Re:Published source is a huge help here by MangoCats · · Score: 1

      What the open code can do is expose backdoors, if they're not cleverly hidden.

      If a crypto app is too long for a thorough review, it's poorly written and probably is hiding a backdoor somewhere.

    19. Re: Published source is a huge help here by beelsebob · · Score: 1

      Your comment assumes that no one ever audits closed source implementations of encryption code.

      You may well be right in the case of random implementations by random small shops (in fact, you probably are), but that really just tells you the well known trope "never implement your own cryptography".

      In the case of the implementations built into {mac|i|tv|watch}OS, Windows, Android etc; for all that there are potentially bribable people writing those implementations, I'll take them any day over any open source implementation. In fact, the number of glaring, horrible security holes discovered (after attacks, not by code inspection) in OpenSSL recently has rather reinforced that.

    20. Re:Published source is a huge help here by aknowles · · Score: 1

      Counterpoint: https://github.com/google/oss-... Google is fuzzing a whole bunch of open source projects and filing bugs.

  4. Morse code from the grave... by __aaclcg7560 · · Score: 1

    Telegraph found Samuel Morse is still alive?!

    https://en.wikipedia.org/wiki/Samuel_Morse

  5. Not the end of it. by Gravis+Zero · · Score: 2

    If the NSA failed to bribe their developers, it doesn't mean they are just going to give up. A bribe is just the most cost effective solution for the long term. Have no doubt that they will seek or even maybe even create a weakness in the application.

    --
    Anons need not reply. Questions end with a question mark.
  6. For real? by Corbets · · Score: 5, Insightful

    While I wouldn't be terribly surprised if the various three letter agencies try this... would they really be stupid enough to let him know where they were from? It's not like they would have appealed to the Russian's sense of patriotism for the US.

    On the other hand, this sort of publicity could drive users to his product, providing a motive to lie.

    Methinks that we should remain a bit skeptical on this one.

    1. Re:For real? by Anonymous Coward · · Score: 1

      Where else would they be from? The dairy industry? They were offered bribes, AND got intimidated by the FBI, it was the U.S. gov alright. Wake up dude.

  7. The question is...Did he cave? by Anonymous Coward · · Score: 1

    I mean, here we got this Russian guy, and then there's Trump, probably offering to buy him out, just as soon as he pays off his other Russian debts.

    The czech is in the mail

  8. OpenKeychain by wasteoid · · Score: 4, Insightful

    Manage your own asymmetrical PGP keys and encryption, while using any messaging app. Not as integrated as Telegram or other streamlined apps, but secure communication is possible, just need to take a few extra steps.

  9. Don't trust proprietary protocols by Cajun+Hell · · Score: 5, Informative

    It's not really about the US; the US government's behavior is merely helping to illustrate the deeper errors made by the users.

    If you are using VPN/encryption tool/secure communication network/etc. created by US based company, it is very unlikely that it is actually secure.

    More generally:

    If you are using an app created by a company, which is only compatible with itself rather than complying with a public spec, it is very unlikely that it is secure. (It's also pretty unlikely that it won't suck in other ways too.)

    Stop talking about apps, and start talking about protocols. Answer the "which of these apps works best for me?" question later, after protocol selection. If telegram doesn't work with anything else except telegram, then you can be pretty sure that telegram is the wrong choice.

    --
    "Believe me!" -- Donald Trump
    1. Re:Don't trust proprietary protocols by qbast · · Score: 4, Insightful

      No, it is in fact very much about US and willingness of the government to strong-arm developers into crippling their crypto solutions. All the compliance with public spec won't help you when developers have been pressured into introducing a subtle bug that allows to make encryption easier to break or to modify their official binary builds by adding a piece of code that will store your private key somewhere.

    2. Re:Don't trust proprietary protocols by MobyDisk · · Score: 4, Insightful

      Stop talking about apps, and start talking about protocols.

      This is the problem with computing and the internet over the last 10 years. We switched from developers saying "I want to create a protocol that does X, and I'll make the first app that implements it" to developers saying "I want to sell ads, so I'll make a proprietary app that does X, and refuse to open it up to other developers." It's the pre-1983 IBM -vs- Compaq mentality.

    3. Re:Don't trust proprietary protocols by ctilsie242 · · Score: 1

      The problem is that open protocols don't bolster the quarterly results. This is why we have so many websites that are best served by HTML5 or something else going with apps. Plus, with the fact that most apps want every permission under the sun, it is another way to slurp data to sell to whomever has the cash, or find another way to throw ads as alerts. If it were not for the fact that we have multiple PC web platforms with different languages for coding in, I wouldn't be surprised to see sites require viewing through their app only, with the website just a forward to whatever store has it for download.

    4. Re: Don't trust proprietary protocols by Zero__Kelvin · · Score: 1

      HTML5 is a standard. Complaining about that is like saying "best used with blowfish or SHA512" would be bad.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    5. Re: Don't trust proprietary protocols by Zero__Kelvin · · Score: 1

      I guess you don't know any of us. I am an American, and I can assure you nobody has ever done it better than US, ever ... well until January 2017 anyway ;-)

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    6. Re:Don't trust proprietary protocols by MobyDisk · · Score: 1

      Open standards have the power to break monopolies and make a lot of people a lot of money. For 25 years, open languages, protocols, and specifications caused the PC industry to grow exponentially. IBM lost their hold, DEC died. Apple maintained their hold, but was a small player until they created the iPod. Why won't the same thing work now? Why can't we have, instead of one FaceBook, dozens of FaceBooks all using the same protocol. In the past, whoever invented the protocol received the first mover benefit of defining new versions of the protocol, and charging royalties for it. See VHS and MP3 for examples. Even committee standards like DVD and Blu-Ray created entire industries. It brought us ISA, EISA, VESA, PCI, and x86. It brought us Android which disrupted Apple's hold on the smartphone industry. Blackberry and Windows proprietary OSs fell down and the industry just grew.

      The lesson here is that interoperability is more profitable, for the economy as a whole, and better for the consumers. So why is there a perception otherwise?

    7. Re: Don't trust proprietary protocols by Zero__Kelvin · · Score: 1

      I see that now that you point it out. I guess I am still traumatized by the old "best when viewed with IE6", or better than that the "only works with IE6" sites of old. "Served by" is clearly different than "viewed with" ... mea culpa.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  10. Many eyes theory is mostly a myth by sjbe · · Score: 1

    Published source makes it a lot easier to spot problems with the code.

    Demonstrably false in most circumstances. Just because the code is available does not mean competent people are looking at it and finding bugs. It would be safe to say most open source programs are not being looked at by a lot of eyes beyond the primary developers. You need more than published source code to make it easy to spot bugs. Heck a lot of code is so badly written that it would be easier to re-write from scratch than to find a bug in it.

    1. Re:Many eyes theory is mostly a myth by drinkypoo · · Score: 5, Informative

      Published source makes it a lot easier to spot problems with the code.

      Demonstrably false in most circumstances. Just because the code is available does not mean competent people are looking at it and finding bugs.

      Your logical fallacy is moving the goalposts. GP didn't claim that it meant that problems would be spotted.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Many eyes theory is mostly a myth by Darinbob · · Score: 1

      We've used third party penetration testers. Given access to full code and hardware specs and they'll pour through it with a fine tooth comb and I'm amazed at some of the things they can discover.

  11. "Those Evil Americans tried to bribe us!!!" by Nutria · · Score: 2

    Maybe. Or maybe you're just *saying* it to make yourself look better while bashing the US.

    How will we ever know for sure?

    --
    "I don't know, therefore Aliens" Wafflebox1
  12. Comment removed by account_deleted · · Score: 4, Insightful

    Comment removed based on user account deletion

  13. US is a rogue state by Anonymous Coward · · Score: 1

    There's no way any software of US origin can be trusted - paricularly closed source. The US interferes in the affairs of most countries on earth, including in elections and referendums in my own nation. Now they also want to spy on personal communications, and bribe developers from countries that have less invasive surveilence policies. Time to completely isolate this parriah state in my opinion.

  14. Alternatives, we need alternatives by what+about · · Score: 2

    Telegram is an alternative to whatsapp or equivalent service from google.
    Hopefully European politicians will not be so dumb to break it... (look out to fake "save the children" broadcast)

    Any person that does any "professional" work must consider the sharing of contacts,documents, communications as a breach of contract with the client.

    I am looking at what happens on the cellphone/tablet market and pray/hope that there will be a NON US based company providing some reasonable platform.

    The amount of information that an Android phone share with Google by default (same with Apple) is way too much, real big brother on steroid.

    1. Re: Alternatives, we need alternatives by Anonymous Coward · · Score: 1

      Citation needed for the Apple part. Apple
      Is a hardware company that respects your privacy, as they don't collect any data like
      Google does. I've ran wireshark, little snitch and checked my firewall/proxy logs(logs all traffic). No signs of Apple sending my data to their servers for advertising purposes. No I don't use the App Store.

      Google on the other hand, you are the product. They give you free stuff so they can sell you out to their advertising network.

    2. Re:Alternatives, we need alternatives by AHuxley · · Score: 1

      Re "Hopefully European politicians will not be so dumb to break it"
      Germany is working hard on that "Germany to pour cash into mass surveillance"
      http://www.dw.com/en/germany-t...
      "..BND says it needs much of the extra money - some 73 million euros over the next few years - to set up "Panos," a new project specifically aimed at decrypting messaging systems by finding weaknesses in the apps."

      --
      Domestic spying is now "Benign Information Gathering"
  15. Rabbit hole... by bradley13 · · Score: 4, Insightful

    This may be true, and he didn't accept the bribes; he may be saying this after accepting the bribes; he may be saying this as a publicity stunt; he may be saying this to deflect attention away from the backdoors already installed for the Russian government; he may be saying this because... ...we have no fricking idea. How deep down the rabbit hole do you want to chase your favorite conspiracy theory?

    Granted, it's hard to be prepared for all eventualities, but it sure would be nice if he had a recording of the meeting, and the words exchanged.

    --
    Enjoy life! This is not a dress rehearsal.
    1. Re:Rabbit hole... by Khyber · · Score: 1

      You hit exactly what I was thinking. I'd bet money this is a ploy to get more people to use the app, so that more spying can be done.

      Good thing I don't trust/use apps which require my phone number. That's none of their fucking business.

      --
      Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    2. Re:Rabbit hole... by JonnyCalcutta · · Score: 1

      Yup. The problem now is - to what degree can you trust anything?

  16. Is it true? by GuB-42 · · Score: 5, Insightful

    While bribing developers to weaken encryption is most likely not above what intelligence agencies do, this could also be a PR move.
    By saying an intelligence agency attempted to bribe your devs, it implies that :
    - Your app is so secure that it can't be cracked by external means
    - That your company standards are so high that bribes don't work
    - That the government is watching and using unethical methods, and that an app like the one you offer is needed
    - Competitors may have been bribed too, and if they aren't saying anything, they may have fallen for it

    Considering the flaws of Telegram, this may be just an attempt to make it feel more secure than it really is.

  17. Re:It's a bluff by AvitarX · · Score: 1

    This:

    It seems just as likely that this is a misinformation campaign to sow distrust of American vendors, or even all others, while their product is backdoored by the Russian government.

    I'm not saying that's the case, but it seems just as likely with the Russian propaganda machine being so efficient.

    --
    Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
  18. Comment removed by account_deleted · · Score: 5, Informative

    Comment removed based on user account deletion

  19. Not sure what to believe by Aequitarum+Custos · · Score: 1

    Option 1: Could be Russian/Telegram propaganda.
    Option 2: Could be true because seriously, who trusts the FBI/NSA not to violate our privacy anymore?

    Really not sure what to believe about this one.

  20. Re:Who are the bad guys again? by Anonymous Coward · · Score: 5, Insightful

    Russia don't really need to break into civillian communications - because they have other methods:

    If a "little guy" piss them off - he get beaten by some thugs and possibly a couple of years in prison. Maybe he learns his lesson, maybe he dies - there are enough people anyway and they can't sue the government.
    If an oil billionaire pisses them off, he suddenly finds all assets frozen and gets a decade or two in prison.
    If someone try to be clever and hide in the west after pissing them off - they might get the polonium diet.

    So you may communicate securely in Russia. The day they really want you, they just kick down your front door anyway. No need for any "proof" first. No search is "unreasonable".

    Russian authorities simply don't need to be subtle. American authorities still need to appear nice, so they need to snoop in silence. They can't blatantly beat information out of people, or tell them to "speak now, or you disappear to some fearsome interrogation camp for some years." So they want to listen in on everything instead. As long as nobody notices enough to prove anything, they aren't visibly violating the constitution or other laws.

  21. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  22. Re:Tried? by Anonymous Coward · · Score: 2, Insightful

    Technically, it's worth clarifying a few things:
    - It's RSA the security company (peddling their encryption solution), not RSA the algorithm (there continue to be no known problems with the RSA algorithm).
    - What they were paid the $10 mil for is to use the Dual_EC_DRBG random number generator (this is not a cipher, merely a random number generator for one).
    - The Dual_EC_DRBG algorithm was a faulty backdoored standard certified for use by NIST for use in cryptographic software (NIST = the body that certifies crypto algorithms for use and consults with the NSA about security of the algorithms). EC ciphers in general, have not yet been proven to be insecure.
    - The settings for Dual_EC_DBRG were not weakened, as it was never a secure algorithm in the first place. The magic constants the NSA defined, allowed them to reconstruct the seed value for the RNG algorithm from a very small number of inputs.
    - After the Snowden leaks proved Dual_EC_DBRG insecure, NIST revoked the standard.

  23. That is the story abroad, but the one here is wors by kelanos · · Score: 1

    Here in the US, intelligence agencies effectively OWN many tech companies and mandate these weaknesses in engineering to their trusted men (or women) in development teams. Of course I'm talking primarily about Google and Microsoft, and many others besides.

    conspiracy theory blah blah blah

    Too long of an argument to make to defend, but it might suffice to point out how everyone important is invested in every important business and so this mutual investiture forms the mechanism for the 'crazy crazy impossible' conspiracies that many like to comfort themselves by ignoring.

  24. Re:It's a bluff by AHuxley · · Score: 1

    AC that VPN use will be tracked.
    https://en.wikipedia.org/wiki/...
    "Showing the usage of virtual private networks (VPNs) and machines that can potentially be hacked via TAO"

    --
    Domestic spying is now "Benign Information Gathering"
  25. Get with the times by SuperKendall · · Score: 1

    This is 2017 man, you don't need actual users, just a trend-line and PROJECTED users.

    If you can't ramp up a nice trend line from India for under $100 well I don't know what to tell you.

    Heck if you spend the $100 to buy users from Russia THAT trend line will have the government BEGGING to give you money to weaken encryption.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley