Slashdot Mirror
Telegram Loses Supreme Court Appeal In Russia, Must Hand Over Encryption Keys (bloomberg.com)
Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports: Supreme Court Judge Alla Nazarova on Tuesday rejected Telegram's appeal against the Federal Security Service, the successor to the KGB spy agency which last year asked the company to share its encryption keys. Telegram declined to comply and was hit with a fine of $14,000. Communications regulator Roskomnadzor said Telegram now has 15 days to provide the encryption keys. Telegram, which is in the middle of an initial coin offering of as much as $2.55 billion, plans to appeal the ruling in a process that may last into the summer, according to the company's lawyer, Ramil Akhmetgaliev. Any decision to block the service would require a separate court ruling, the lawyer said.
Putin signed laws in 2016 on fighting terrorism, which included a requirement for messaging services to provide the authorities with means to decrypt user correspondence. Telegram challenged an auxiliary order by the Federal Security Service, claiming that the procedure doesn't involve a court order and breaches constitutional rights for privacy, according to documents. The security agency, known as the FSB, argued in court that obtaining the encryption keys doesn't violate users' privacy because the keys by themselves aren't considered information of restricted access. Collecting data on particular suspects using the encryption would still require a court order, the agency said.
Putin signed laws in 2016 on fighting terrorism, which included a requirement for messaging services to provide the authorities with means to decrypt user correspondence. Telegram challenged an auxiliary order by the Federal Security Service, claiming that the procedure doesn't involve a court order and breaches constitutional rights for privacy, according to documents. The security agency, known as the FSB, argued in court that obtaining the encryption keys doesn't violate users' privacy because the keys by themselves aren't considered information of restricted access. Collecting data on particular suspects using the encryption would still require a court order, the agency said.
If I had any friends, and used Telegram, and lived in Russia, I would be frightened. Since I have no friends, only use SMS, and live in the USA, I already gave up any pretense of privacy.
I’m so blown away by this. I can’t believe this could happen in Russia of all places.
Next thing you’ll tell me is the USA is next!
It's interesting how people in power assume that they are immune to the negative consequences of the same mechanisms they create or force to subdue others. It will be interested to see what happens when all these backdoor backfire on Putin's regime and how they try to downplay it when it happens.
"Imagination is more important than knowledge" - Einstein
Telegram has been launched by brothers Durov's, Nikolai and Pavel. They previously launched Russian FB equivalent VK, which was "socialized" by the owners that are supporters of Putin. As a response, secure and private Telegram has been launched. So, they lost a case in Russia, and now privacy is compromised. I have to make a bet that their next product will be the developement of decentralized communication protocols that cant be subpoenaed or litigated. Such protocols already exist, albeit not yet well scalable. However, at the very moment brothers Durovs are putting the company for IPO, and it will be interesting to see how will they handle the situation.
on his election 'victory'. I don't like McCain, but at least he called Trump out on it.
It genuinely frightens me that we're so quick to support dictatorships. Everybody's looking the other way because they want Russia's gas & oil. Then again I've got to drive to work every day the same as everybody else...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Nieve much? Seriously what is with this article? You're in Russia, expecting privacy?
Why in the hell is yet another service built like this? It's like building a shower in the middle of a mall and telling people not to look. Don't put the damn shower in a mall and stop using tech that requires centralized encryption. Why is this so hard to understand?
And this has nothing to even do with Russia or Putin. Thanks to the five-eyes, many countries have implemented similar laws.
Furries live on Telegram. Do the russians really want access to hundreds of thousands of erotic RP logs and huge dicked furry art? Perhaps Putin is a closet furry... @yiffyrussianbear69 anyone wanna rp uwu
This is why perfect forward secrecy is needed in secure messaging apps. There's no reason the service provider should be able to hand over keys that can be used to decrypt users' messages. A properly designed secure messaging app would make this impossible. The protocols to implement this are not difficult.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
In Soviet Cambridge Analytica, data encrypts you.
http://www.pulse.ng/the-new-yo...
You are welcome on my lawn.
"Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports"
:)
Is this anything like the FBI taking Apple to court to hack a suspects iphone. The whole thing being most probably a scam as the FBI already has a backdoor into Apple and Microsoft and Dell
Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports
This is Putin's victory, because of course, Putin took care of the case on its own. Perhaps he even did it without an attorney.
There is the risk that - if the FSB has the keys - they can decrypt conversations that were captured in the past. Access could put at risk the safety of Russian citizens and others they have communicated with the expectation that those conversations were protected. This could include US citizens as well.
If they have an upcoming IPO and their 'sell' is that they provide secure communications then they would likely make more money from upholding their message to their customers than they would from selling into Russia
Someone should involve the US State Department in this
What's so appealing about Russia now, where they were so terrifying and worthy of warfare, say, oh, just before this US administration?
It's a very odd shift in demeanor, for such a large and vocal community.
Is it REALLY just "well, Trump likes 'em?" Is that really enough to push aside every single moral fiber of your being, on basically every subject?
Hand me the keys, you F**king c**ksucker
WARNING: Smartphones have side effects--most of them undocumented.
Move to Turkey and Georgia and include free VPN.
That's what I'm thinking. The FBI makes this big show of going to court in an effort to secure the right to do what? Get access to Apple's key? No, to try to force Apple to build decryption tools. The FBI said it could ask for Apple's signing key... but they didn't. Obviously they already have that? Why would you assume Apple can keep their key secret from agencies that can put insane pressure on any employee they decide to?
No. Assume that all the three letter agencies already have the keys, they just don't want the public to know that. Poor show Russia, that's not how you misdirect the public.
Telegram is not secure by default, but requires you to start a secure chat separately. Which requires both users to be online and enable it at the same time. Something that I never got going with anyone. So it was already pretty useless, as compared to Signal.
Also, its own custom security protocol was more than a little sketchy to me. I don't trust any random person to get security properly right. There are far too many caveats for me to trust somebody with their custom solution. It would have to be proper experts, and audited by other proper experts too.
Don't get me wrong, I like Telegram due to the amount of features it has.
But I'd rather wish they would integrate those features into Signal (Usage optional, of course.), and use their servers merely as an alternative to Google's push service. (I'd even pay for my share of the server costs, as long as it's non-profit.)
Moxie had no problem giving it to WhatsApp (even though it is pointless there, as the tunnel is between a closed-source app made by Facebook employees and Facebook-owned servers).
I can understand that a European (like a Russian) would have a problem using code by such a high-profile western service. It might as well be a giant trap. But I still figure it would be quicker and safer, to properly audit an already-designed system than to completely develop it oneself.
Most (all?) commercial messengers have a problem of being centralized. Block a few servers and the messenger is dead. Compare Telegram or Whatapp to generic email. A dictator can easily block messengers, but can't block email in general. It can block can block say Gmail or Yahoo mail but blocking individual email servers is much harder. Messengers need to move to the same model. We need something like https://github.com/tinode/chat to run our own servers. We need 1000s of telegrams and whatsapps running a distributed federated messaging network.
The whole thing was a marketing scam by Apple. "Look, we have secure phones. The FBI rants about them."
Looking at what Paypal and Facebook are doing, you wonder if the brothers haven't already sold it many many times over in private. There seems to be a big market in private data and no consequences for selling it.
Remember Blackberry and it's FBI friendly backdoor into its own encryption?
In their heads they thought the good guys would only get access for catching terrorists. Yet here Putin gets it for catching protestors, witnesses, interfering in elections worldwide, finding the location of people to nerve gas, and tracking US troop movements.
He's using chemical weapons on our streets, attacking US military positions with faux 'independent' army units, and yet it's OK to sell him the location trace /pictures / purchases / friends list/ contacts list, of every US politicians family? Thank you Zuckerberg and your co-investor Yuri Milner.
https://np.reddit.com/r/politics/comments/85p30j/deletefacebook_movement_gains_steam_after_50/dvz4y6o/
"Collecting data on particular suspects using the encryption would still require a court order, the agency said."
Well that's reassuring. Seeing as how Russia's courts are so independent and the judges so fearless and incorruptible. I'm certain the agency (that's the FSB) would never use the encryption keys in their possession without a court order.
If the British confirm that Kremlin was behind the poisoning of the Russian ex-spy double-agent, I am afraid the CIA will have to poison Snowden in retaliation
To say Signal is equal to default Telegram is ridiculous. Telegram uses a master key by default; Signal uses ephemeral keys and forward secrecy.
Saying that it is not secure because it "passes through their servers" is like saying Tor isn't secure because it passes through someone's servers. Everything passes through someone's servers; that's how the internet works. The point of having FOSS in your client and encryption protocol is so that it doesn't matter that it's passing through someone else's servers.
You are confusing encryption/security with centralization/federation; they are NOT the same thing.
Everyone should use Signal.
When Bush bombed the Middle East it was bad.
When Obama bombed the Middle East it was good.
When Bush bailed out banks it was bad.
When Obama bailed out banks it was good.
When Bush spied on Americans it was bad.
When Obama spied on Americans it was good.
The delusion is stunning. Fact: the government is evil and it's always going to be bad no matter who is 'elected.'
Yes, pro humanity. Just ask the tens of millions of people murdered by communist regimes in the 20th century, or the starving people of Venezuela, or the oppressed citizens of North Korea.
Glad to see Russia finally catching up with USA/NSA.
I thought it was just full of guys in Abibas tracksuits drinking beer, squatting on street corners and spitting sunflower seed husks at passersby
Are these guys even literate?
How do these street thugs afford courthouses?
What about that shirtless putz? What's his name? Is he, like the alpha silverback of the street thugs?
So assuming the Russians are like the NSA and have recorded much of the traffic for the past few years. How would that go for everyone who discussed Putin and his friends in the past over Telegram "secure" chat? How does Telegram handle the keys, can Putin and friends now just go and get the keys for all the past conversations and send in some accidents to everyone who disagrees with anything?
C'mon. Be it Trump or Seehofer, May, all of them. You're drooling over the things Putin. Erdogan, Xi Yinping get away in front of their people (and their people seem to like it!).
So now support Putin in his interminable quest to quench Terrorism. Later he'll help you.
(For the sarcasm challenged: this was sarcastic, yes).
Just because Google and others are too stupid to use it, does not mean we have to be. I force my family to use XMPP apps (there are many) and GPG. They complain. I don't care.
Recently my XMPP service provider disappointed me, so I just moved my domain to a different provider, just like I can do with email. Bam. Done.
I'm pretty sure that Apple and Microsoft do comply with such court requests unlike Telegram. In fact EULAs tend to spell out that any user's data can be shared given valid court order. The problem here is that Telegram has such a key that could decrypt private messages in the first place. Meaning that not only they could use it to comply with court orders but also that they could grep private communications for stuff like credit card numbers, login credentials and material for blackmail. In order to achieve proper privacy messaging services need to be fully decentralized, like TOX for example.
Source of this? Your ass, right? Your wishful thinking is quite strong but, if it makes you happy...
" . . . obtaining the encryption keys doesn't violate users' privacy because the keys by themselves aren't considered information of restricted access. Collecting data on particular suspects using the encryption would still require a court order, the agency said.
The keys are Not considered information of restricted access? So how many people leave passwords lying around? And of course, they would ALWAYS get a court order. Sure they would . . . . .
If you have even the most modest security needs (e.g. you don't want burglars to read a message to your wife that you'll be home late) then you shouldn't use anything where the same company provides both the service and the software.
If you want secure messaging, then you'll pick a protocol, and then pick one of the two-or-more competing implementations of that protocol.
I have to use Telegram at work, and it isn't interoperable with anything else (so you don't even have to research it, to know it's very likely insecure). Oh, and what a great first impression it made: I installed their client on my phone (which selected a fuckload of unnecessary permissions, and this was on Android 4.4 at the time, where revoking and denying was a total pain in the ass) and on my workstation. Right away on the workstation it suggested I add my brother, thereby tipping its hand that it had raided my phone's contact list and uploaded all that information to their servers.
I guess I should be happy that at least they showed me that they had stolen my data, instead of letting me remain angry and nervous that I had given it access to that data, leaving me waiting for the other shoe to drop. So that's the nice thing I'll say about Telegram: On day 1, it openly attacked me, letting me know how they look at their relationship with their users.
Telegram is absolutely untrustworthy, and I recommend against anyone using it for any purpose. The sooner they go out of business, the sooner my company can try something else, and this is easily a case where a random roll of the dice (we don't even need to try to select something good) will almost certainly be better.
http://foreignpolicy.com/2012/...
That's what Presidents do. You don't burn bridges unnecessarily.
Telegram uses centralised keys for normal chats, but you can also have "secret chats" which use end-to-end encryption. They can't be shared across devices, but that's the only drawback.