Subverting Telegram's end-to-end encryption (2023)

https://tosc.iacr.org/index.php/ToSC/article/view/10302

70•pona-a•3h ago

Comments

ethin•3h ago

Is this really something new? If memory serves, Telegram has had it's own crypto since the beginning, and I don't remember anything about it ever being audited by... Well, anybody?

Granted, I don't know how MTProto actually works all that well, but IMO Telegram should've just used Noise or something. Would've saved them a lot of trouble. Although that doesn't really resolve the underlying problem that people think Telegram is secure when it's not (i.e., you have to explicitly enable E2EE and it's off by default), at least last time I checked. I haven't used telegram in years so my knowledge might be out of date though.

jansper39•3h ago

> Granted, I don't know how MTProto actually works all that well

I suppose it's what the actual goals of the app are, potentially it works out very well for someone.

dijit•3h ago

It was audited, found to have some serious flaws[0], then those were rectified.

Most people dislike Telegram because:

A) It takes away from Signals market share

B) They don't enable E2EE by default

C) They're owned by Pavel Durov, the Russian Zuckerberg.

I am aware that it's an unpopular opinion, but the FUD spread against Telegram and the hagiographies of Signal make me think something weird is going on.

Telegram has third party clients, so you can just roll your own client that runs another encryption on top if you want, like Pidgin used to do with OTR.

[0]: https://mtpsym.github.io

hiimkeks•3h ago

D) They don't enable E2EE for groups at all

E) (I believe) don't enable E2EE with more than one device

dijit•3h ago

D) True aside from group calls afaik

E) Neither does Whatsapp/Signal; they rely on a backdoor interface to your phone to send messages.

tptacek•3h ago

Signal very definitely does multiparty end-to-end secure messaging.

dijit•3h ago

Weird, every time I mention Signal on HN tptacek responds.

But I'm having trouble discerning what you mean.

Either you're saying group chats are encrypted E2EE - which, I never claimed.

Or, you're mentioning that you can have multiple phones/devices on the same account, which doesn't work the last time I checked.

mahemm•3h ago

You replied to a claim that Telegram doesn't do E2EE for groups saying 'Neither does Whatsapp/Signal'.

That's wrong as `tptacek noted. If you meant something else, that wasn't clear.

dijit•2h ago

> E) (I believe) don't enable E2EE with more than one device

my response was:

> E) Neither does Signal/Whatsapp.

The thread of the "E" topic is relevant here, i'm not claiming that Signal/Whatsapp support (or do not support) encryption for group chats.

Sorry that it wasn't clear, I thought referring to them directly by letter would make it easier to differentiate.

rockskon•3h ago

It does work. How do you think Signal desktop works?

dijit•2h ago

I thought it worked the same as Whatsapp, whereby there's a sort of backdoor connection to the app running on your phone to send messages.

However, after doing a smidge more research it seems like somehow Signal is sharing it's key with the desktop app and only syncing history of messages directly: https://news.ycombinator.com/item?id=15596980

I'm not 100% sure how it works as the server is fake-open-source and not actual open-source.

porridgeraisin•2h ago

Whatsapp doesn't need a connection to your phone anymore either. It used to be the case until a few years ago though.

fsflover•3h ago

E) Yet it works fine on Matrix.

skeledrew•1h ago

I've tried to use Matrix a few times and eventually end up leaving. The idea is good, but it's just missing so many nice features that it kinda isn't worth the pain. Features that Telegram just keeps dropping like candy.

crtasm•3h ago

Signal desktop can send & receive messages while your phone is off, so that doesn't seem correct.

dijit•2h ago

Oh, hey, TIL: https://news.ycombinator.com/item?id=15596980

Wonder how that works then? Weird.

fsflover•3h ago

F) They don't allow E2EE on GNU/Linux, including phones and desktop.

tptacek•3h ago

I like how you sandwiched "the encryption story is bad" between two irrelevant social claims.

s17n•3h ago

People in the US prefer Signal over Telegram because Signal was created by people who took security seriously, and Telegram wasn't.

People outside the US prefer telegram because they assume that Signal is probably compromised, or at least highly vulnerable to compromise, by US intelligence - they trust Pavel Durov's history of expropriation and arrest more than they trust some nerds who claim that our product is secure.

BoredPositron•2h ago

I mean Durov is going down the deep end in the last few weeks. Messaging all Telegram user with an Emergency feature with a doomer manifest.

https://t.me/durov/452

asacrowflies•2h ago

Seems pretty cognizant of the modd of entire HN front page past few weeks honestly

ur-whale•1h ago

> with a doomer manifest

Can you point at anything in his message that's not factually correct?

simion314•1h ago

>Can you point at anything in his message that's not factually correct?

He also got involved in Romanian and Moldovan elections, by sending a message to target users in the day of the elections( when doing campaign is illegal) with claims he presented no evidence for, basically the bastard works for Ruzzia, he might be forced to but the facts do not lie.

skeledrew•1h ago

It's not about the content IMO; it's about the principle. Should not be sending content to users, unless they opted into said content being sent to them.

a57721•26m ago

One factual thing that looks off is "the UK is imprisoning thousands for their tweets". I'm not in the UK and not following closely the situation there, but "thousands", really? Genuine doubt, would love to see some evidence.

Otherwise, the "doomer manifest" is OK, but the comically inflated ego of Durov is annoying, him thinking that such banal and commonplace sentiments are worth pushing as an alert message to all users, wrapping everything into announcing his birthday (that he doesn't want to celebrate, oh no).

jazzyjackson•3m ago

There is a grossly sexist omission in "built by our fathers"

skeledrew•1h ago

I was pretty ticked off about this. I don't disagree with the message content itself, but having political content pushed to me is a big no-no. If this kind of thing keeps up I'll be dropping my premium sub.

weberer•2h ago

D) They moved to the enshittification phase and started displaying ads

hiimkeks•3h ago

Well, the article is from 2023, but what you remember is most likely MTProto version 1, which was even more ridiculously broken, iirc

ProofHouse•3h ago

telegram is NOT safe. Far from it.

tptacek•3h ago

Reminder that Telegram has "end to end" encryption only for direct messages; the rest is client-server, which they seem to believe is just as good as end-to-end.

ynoxinul•3h ago

*for direct messages in secret chats, which you have to enable explicitly and which reduces user expericence in comparison to normal chats.

fsflover•3h ago

*only on non-GNU/Linux systems.

dijit•2h ago

You've said this a lot in this thread, but my client on Arch seems to have secret chats.

https://i.imgur.com/Pft8r3B.png

dijit•2h ago

client-server is good enough, if you trust the server.

If you don't trust the server, then you shouldn't trust them to supply you a client either. Since a client is basically "whatever code they decided".

Very few people are building from FOSS, and those that do will include binary blobs too. It's theatre.

tptacek•1h ago

There are basically zero practicing cryptography engineers who would agree with the logic you've used here, but I acknowledge this is also someting Durov believes.

j45•1h ago

It's weird that you can delete a message for you and for the other person too.

I doubt client-server is the only way to accomplish this.

GranPC•3h ago

(2023)

gruez•3h ago

For people who only read the headline, it's not as bad as the title might suggest. This attack requires backdooring the client, by which point it's already effectively game over in most threat models. The main advantage of this attack is that a compromised client can be sending "encrypted" messages that can actually be trivially decrypted by authorities, but that isn't immediately obvious to someone inspecting network traffic. Needless to say, this is a pretty pointless attack because nobody is manually inspecting every piece of data that their telegram is sending, and the client probably makes so many requests that it's trivial to smuggle data through some other side channel.

tptacek•3h ago

The threat model of the attack is targets relying on binary/source transparency of open source clients to protect against (state-sponsored) client backdoors; in that sense, it most closely resembles the Juniper/NetScreen Dual-EC attack, which functioned basically the same way: a backdoor that was essentially not auditable, as the underlying vulnerability was realized cryptographically.

I'm just clarifying. I agree the practical implications of the attack are not really meaningful to a general audience.

supermatou•3h ago

Excellent article about Telegram's encryption from Matt Green (cryptographer, for those who haven't heard of him):

https://blog.cryptographyengineering.com/2024/08/25/telegram...

defraudbah•1h ago

and another one from king of encryption in golang

The Most Backdoor-Looking Bug I’ve Ever Seen

https://words.filippo.io/telegram-ecdh/

r721•50m ago

HN discussion (2024): https://news.ycombinator.com/item?id=41350530

taminka•3h ago

can anyone explain why telegram doesn't use an audited e2e implementation? is it really because they wanted more convenient and faster cross-device sync? have they been threatened and/or backdoored by the fsb? they basically stole vk from him, but left him alone w/ telegram?

it's suspicious, but at the same time, iirc, nobody's been able to find a vulnerability in their encryption protocol :shrug

tptacek•3h ago

People have found vulnerabilities in MTProto.

dijit•2h ago

The first version of MTProto was found to have weaknesses.

The reason they rolled their own was because it came out before the Double-Ratchet/Axolotl protocol and OtR (which double-ratchet is essentially based on) was extremely inconvenient to use properly and had its own weaknesses.

taminka•2h ago

> The reason they rolled their own was because it came out before the Double-Ratchet/Axolotl protocol and OtR (which double-ratchet is essentially based on) was extremely inconvenient to use properly and had its own weaknesses.

this actually makes a lot of sense lowkey, thanks :)

chupasaurus•2h ago

1,2) NIH syndrome 3) We don't know 4) Expropriation isn't "basically stolen", Telegram was a tiny side project at the time

defraudbah•1h ago

in short, you don't need access to the device, only to the same network

if you are on the same network and manage either intercept key to bruteforce it or guess encryption key with emoji it's possible to decrypt the whole chat. It works because telegram random generator uses time and some device information which is predictable

the study managed to decrypt 500 messages out of 500 on emulator devices. Brutewforcing takes like a few $100 worth of computing power

Honestly, durovs are exceptional people and enterpreneurs, however their encryption and what they say isn't always what it presented as

Show HN: An open source access logs analytics script to block Bot attacks

Sikorsky Converts Black Hawk into U-Hawk, a Battle-Ready Autonomous UAS

TokEstimator – Estimate LLM Inference Performance on Private Hardware

Americans are losing millions to scammers at crypto ATMs

Show HN: Just Enough Linux for Indie Hackers

Rounding up

Systematically generating tests that would have caught Anthropic's top‑K bug

ReCAPTCHA migration to Google Cloud by the end of 2025: what do you need to do

Preparing for AI's economic impact: exploring policy responses

Ready for the Matrix Conference 2025

Show HN: dotfiles for your AI prompts

Coffee and Open Source Conversation – Brian Pontarelli

Just Talk to It – The No-Bs Way of Agentic Engineering

The height at which a hill becomes a mountain, according to data

Mark Twain Wrote the First Book Ever Written with a Typewriter

EU biometric border system launch hits inevitable teething problems

Captcha Welcome Mat

Reverse engineering software: a safe harbour in EU but not safe in the US (2019)

Zorin OS 18 eyes your Windows 10 PC as Microsoft pulls the plug

Declarative Agentic Framework

FCFZ: Compatible Flipper Zero

YouTube's creator economy is about to collapse (AI replacement fact not theory)

Show HN: Lockbridge – Encrypted File Transfers

Show HN: OneUptime – Open-Source Incident.io

Are your users paying the price for your Shiny New Feature syndrome?

Venture Global's Gas Plant Is Done

MG5 electric car became dangerously out of control

An interactive table with the religious composition in 201 countries

What do Americans die from vs. what the news report on

Trump administration canceled the nation's largest solar project

Show HN: An open source access logs analytics script to block Bot attacks

Sikorsky Converts Black Hawk into U-Hawk, a Battle-Ready Autonomous UAS

TokEstimator – Estimate LLM Inference Performance on Private Hardware

Americans are losing millions to scammers at crypto ATMs

Show HN: Just Enough Linux for Indie Hackers

Rounding up

Systematically generating tests that would have caught Anthropic's top‑K bug

ReCAPTCHA migration to Google Cloud by the end of 2025: what do you need to do

Preparing for AI's economic impact: exploring policy responses

Ready for the Matrix Conference 2025

Show HN: dotfiles for your AI prompts

Coffee and Open Source Conversation – Brian Pontarelli

Just Talk to It – The No-Bs Way of Agentic Engineering

The height at which a hill becomes a mountain, according to data

Mark Twain Wrote the First Book Ever Written with a Typewriter

EU biometric border system launch hits inevitable teething problems

Captcha Welcome Mat

Reverse engineering software: a safe harbour in EU but not safe in the US (2019)

Zorin OS 18 eyes your Windows 10 PC as Microsoft pulls the plug

Declarative Agentic Framework

FCFZ: Compatible Flipper Zero

YouTube's creator economy is about to collapse (AI replacement fact not theory)

Show HN: Lockbridge – Encrypted File Transfers

Show HN: OneUptime – Open-Source Incident.io

Are your users paying the price for your Shiny New Feature syndrome?

Venture Global's Gas Plant Is Done

MG5 electric car became dangerously out of control

An interactive table with the religious composition in 201 countries

What do Americans die from vs. what the news report on

Trump administration canceled the nation's largest solar project

Subverting Telegram's end-to-end encryption (2023)

Comments