Slashdot Mirror
Telegram Loses Supreme Court Appeal In Russia, Must Hand Over Encryption Keys (bloomberg.com)
Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports: Supreme Court Judge Alla Nazarova on Tuesday rejected Telegram's appeal against the Federal Security Service, the successor to the KGB spy agency which last year asked the company to share its encryption keys. Telegram declined to comply and was hit with a fine of $14,000. Communications regulator Roskomnadzor said Telegram now has 15 days to provide the encryption keys. Telegram, which is in the middle of an initial coin offering of as much as $2.55 billion, plans to appeal the ruling in a process that may last into the summer, according to the company's lawyer, Ramil Akhmetgaliev. Any decision to block the service would require a separate court ruling, the lawyer said.
Putin signed laws in 2016 on fighting terrorism, which included a requirement for messaging services to provide the authorities with means to decrypt user correspondence. Telegram challenged an auxiliary order by the Federal Security Service, claiming that the procedure doesn't involve a court order and breaches constitutional rights for privacy, according to documents. The security agency, known as the FSB, argued in court that obtaining the encryption keys doesn't violate users' privacy because the keys by themselves aren't considered information of restricted access. Collecting data on particular suspects using the encryption would still require a court order, the agency said.
Putin signed laws in 2016 on fighting terrorism, which included a requirement for messaging services to provide the authorities with means to decrypt user correspondence. Telegram challenged an auxiliary order by the Federal Security Service, claiming that the procedure doesn't involve a court order and breaches constitutional rights for privacy, according to documents. The security agency, known as the FSB, argued in court that obtaining the encryption keys doesn't violate users' privacy because the keys by themselves aren't considered information of restricted access. Collecting data on particular suspects using the encryption would still require a court order, the agency said.
If I had any friends, and used Telegram, and lived in Russia, I would be frightened. Since I have no friends, only use SMS, and live in the USA, I already gave up any pretense of privacy.
It's interesting how people in power assume that they are immune to the negative consequences of the same mechanisms they create or force to subdue others. It will be interested to see what happens when all these backdoor backfire on Putin's regime and how they try to downplay it when it happens.
"Imagination is more important than knowledge" - Einstein
Telegram has been launched by brothers Durov's, Nikolai and Pavel. They previously launched Russian FB equivalent VK, which was "socialized" by the owners that are supporters of Putin. As a response, secure and private Telegram has been launched. So, they lost a case in Russia, and now privacy is compromised. I have to make a bet that their next product will be the developement of decentralized communication protocols that cant be subpoenaed or litigated. Such protocols already exist, albeit not yet well scalable. However, at the very moment brothers Durovs are putting the company for IPO, and it will be interesting to see how will they handle the situation.
on his election 'victory'. I don't like McCain, but at least he called Trump out on it.
It genuinely frightens me that we're so quick to support dictatorships. Everybody's looking the other way because they want Russia's gas & oil. Then again I've got to drive to work every day the same as everybody else...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
This is why perfect forward secrecy is needed in secure messaging apps. There's no reason the service provider should be able to hand over keys that can be used to decrypt users' messages. A properly designed secure messaging app would make this impossible. The protocols to implement this are not difficult.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
"Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports"
:)
Is this anything like the FBI taking Apple to court to hack a suspects iphone. The whole thing being most probably a scam as the FBI already has a backdoor into Apple and Microsoft and Dell
Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports
This is Putin's victory, because of course, Putin took care of the case on its own. Perhaps he even did it without an attorney.
Hand me the keys, you F**king c**ksucker
WARNING: Smartphones have side effects--most of them undocumented.
That's what I'm thinking. The FBI makes this big show of going to court in an effort to secure the right to do what? Get access to Apple's key? No, to try to force Apple to build decryption tools. The FBI said it could ask for Apple's signing key... but they didn't. Obviously they already have that? Why would you assume Apple can keep their key secret from agencies that can put insane pressure on any employee they decide to?
No. Assume that all the three letter agencies already have the keys, they just don't want the public to know that. Poor show Russia, that's not how you misdirect the public.
Or, they could use them to solve crimes like Bill Clinton's Clipper Chip. He wanted a backdoor into all encryption, and it would have protected the people had paranoid libertarians not stood against it. Things would be much better now if the government could spy on Trump supporters.
I heard Putin meddled in their election. I believe 76% like I believe 239 lbs.
He's getting rather old, but he's a good mouse.
Telegram is not secure by default, but requires you to start a secure chat separately. Which requires both users to be online and enable it at the same time. Something that I never got going with anyone. So it was already pretty useless, as compared to Signal.
Also, its own custom security protocol was more than a little sketchy to me. I don't trust any random person to get security properly right. There are far too many caveats for me to trust somebody with their custom solution. It would have to be proper experts, and audited by other proper experts too.
Don't get me wrong, I like Telegram due to the amount of features it has.
But I'd rather wish they would integrate those features into Signal (Usage optional, of course.), and use their servers merely as an alternative to Google's push service. (I'd even pay for my share of the server costs, as long as it's non-profit.)
It's hard to design a system that's completely lacking in vulnerabilities. It's not hard, however, to design a system where the vulnerabilities are only on the end-user devices. We already have cryptosystems that don't require you to publish anything that's not safely completely public, which makes key exchanges on a single network fairly straightforward. The only complex part is if you want arbitrary parties to be able to make contact without having any data in a central address book that could be used to infer identity.
Most (all?) commercial messengers have a problem of being centralized. Block a few servers and the messenger is dead. Compare Telegram or Whatapp to generic email. A dictator can easily block messengers, but can't block email in general. It can block can block say Gmail or Yahoo mail but blocking individual email servers is much harder. Messengers need to move to the same model. We need something like https://github.com/tinode/chat to run our own servers. We need 1000s of telegrams and whatsapps running a distributed federated messaging network.
(even though it is pointless there, as the tunnel is between a closed-source app made by Facebook employees and Facebook-owned servers).
Don't say it's 'pointless'. Just like Google's strident advocacy of "https everywhere", this prevents third parties from doing MITM stuff and injecting content that Facebook doesn't profit from.
The whole thing was a marketing scam by Apple. "Look, we have secure phones. The FBI rants about them."
Looking at what Paypal and Facebook are doing, you wonder if the brothers haven't already sold it many many times over in private. There seems to be a big market in private data and no consequences for selling it.
Remember Blackberry and it's FBI friendly backdoor into its own encryption?
In their heads they thought the good guys would only get access for catching terrorists. Yet here Putin gets it for catching protestors, witnesses, interfering in elections worldwide, finding the location of people to nerve gas, and tracking US troop movements.
He's using chemical weapons on our streets, attacking US military positions with faux 'independent' army units, and yet it's OK to sell him the location trace /pictures / purchases / friends list/ contacts list, of every US politicians family? Thank you Zuckerberg and your co-investor Yuri Milner.
https://np.reddit.com/r/politics/comments/85p30j/deletefacebook_movement_gains_steam_after_50/dvz4y6o/
In the free West your app hands over the encryption when the software is ready for users.
"Microsoft handed the NSA access to encrypted messages" (12 Jul 2013)
https://www.theguardian.com/wo...
In Russia they still have to wait and see what brands trend in the market and then ask for decryption.
Domestic spying is now "Benign Information Gathering"
See what happens if you question Putin's legitimacy?
If you lived in Russia you could expect worse but then you'd know better than to post such criticism under your username, or even as an a/c.
My understanding is that like so many countries, little guy criticizing is usually ignored.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
To say Signal is equal to default Telegram is ridiculous. Telegram uses a master key by default; Signal uses ephemeral keys and forward secrecy.
Saying that it is not secure because it "passes through their servers" is like saying Tor isn't secure because it passes through someone's servers. Everything passes through someone's servers; that's how the internet works. The point of having FOSS in your client and encryption protocol is so that it doesn't matter that it's passing through someone else's servers.
You are confusing encryption/security with centralization/federation; they are NOT the same thing.
Everyone should use Signal.
So assuming the Russians are like the NSA and have recorded much of the traffic for the past few years. How would that go for everyone who discussed Putin and his friends in the past over Telegram "secure" chat? How does Telegram handle the keys, can Putin and friends now just go and get the keys for all the past conversations and send in some accidents to everyone who disagrees with anything?
76% isn't really unexpected, given that the main opposition candidate was barred from running. What percentage of the vote in the US do you think that Trump or Clinton would have received if the other had been removed from the ballot?
I am TheRaven on Soylent News
Just because Google and others are too stupid to use it, does not mean we have to be. I force my family to use XMPP apps (there are many) and GPG. They complain. I don't care.
Recently my XMPP service provider disappointed me, so I just moved my domain to a different provider, just like I can do with email. Bam. Done.
He didn't meddle in the election, he meddled in the opponents who were basically buffoons with no presidential campaigns whatsoever and his only real opponent was barred from the election under the illegal premises.
There are only two ways for Putin to stop being a Tzar of Russia: either he will die from natural couses or he will be murdered. Democracy is basically a swear word in Russia. Russia had it just once in 1994 and only by chance.
I'm pretty sure that Apple and Microsoft do comply with such court requests unlike Telegram. In fact EULAs tend to spell out that any user's data can be shared given valid court order. The problem here is that Telegram has such a key that could decrypt private messages in the first place. Meaning that not only they could use it to comply with court orders but also that they could grep private communications for stuff like credit card numbers, login credentials and material for blackmail. In order to achieve proper privacy messaging services need to be fully decentralized, like TOX for example.
I believe it. Most russians I talked to support him
http://foreignpolicy.com/2012/...
That's what Presidents do. You don't burn bridges unnecessarily.
What percentages come out if you remove Sanders or Paul from the ballot? Oh wait, we actually did that. And look at the results... Not much better than Russia.
Ashcroft lost a Senate race to a dead man before becoming Attorney General for Bush. That's got to sting.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes