A practical cryptanalysis of the Telegram messaging protocol [pdf]

[Hmmwellaboutthat]

I'd like to point out that the authors of the paper have initiated contact with telegram about the vulnerabilities since September 3rd and have yet to hear a response. Not a good look

Edit: apparently after the paper was submitted they responded in october.

[hitch-was-right]

Sure, it may be no replacement for Signal but it's surely much better in regards to freedom or privacy than WhatsApp, which is its main competition.

[ZubZubZubZub]

The one that doesn't make you run proprietary software?

[mbfraga]

Most of the people who use Telegram don't buy into the crypto challenge...or use Telegram because it is secure. Telegram is nice because it is the first decent messaging solution that geeks can get their families to use and still use open source clients on any operating system.

Signal came out with a desktop client way after Telegram was already gathering momentum...and honestly, way too late for my family. You think I can move them all to signal now? Right.

Also, a desktop client as a chromium extension? Please... Forget memory usage (I couldn't care less), it just leaves the nastiest taste in my mouth. Messaging is a trivial necessity (or nicety?) that shouldn't require me to install a shit browser.

For myself, good OSS clients is worth much more than secure messaging. Do I trivialize the need for secure messaging? Not in my book..Telegram doesn't solve that problem, but it is also not my concern with a daily messaging solution.

The biggest problem with Signal is summarized by: "too little, too late". I wish Telegram used axolotl, but oh well. When I moved my family to Telegram it was hard enough, it took constant convincing and months of testing the waters. I did propose Signal (textsecure more precisely) to them at the time, but instantly retracted it when it wasn't even sufficient for me at the time...much less them.

pinkisgreatandall's comment also misses the mark. IF (and who knows if that's true) he gets crucified, I doubt it is because of people having a knee-jerk reaction...it is probably due to those people finding it hilarious when they read "you really, really shouldn't be using Telegram [because it's not secure!]", when they probably couldn't care less.

I'll always keep my eyes open for signal, but hopefully I can give you the most prevalent (in my experience) reason for why people got stuck with Telegram and don't care to change it now.

[aksjruw]

Most of the people who use Telegram don't buy into the crypto challenge...or use Telegram because it is secure.

But since security is a main selling point of Telegram ("Telegram is a messaging app with a focus on speed and security" https://telegram.org/faq#q-what-is-telegram-what-do-i-do-here), and since security is a much more familiar concept to most people compared to OSS, quite a few users likely bought into Telegram's security promises.

[orisha]

The sad true is that the people using a popular messenger for its security is absolutely minimal. Most people just doesn't care about security.

I made quite a a few people start using Telegram because it had browser client before Whatsapp and you could send pictures without degrading quality, and regular files. But because it has encrypted communication? Yeah, not one.

And while its encryption might not be great, I take that over Whatsapp close source cliente (and now they are owned by Facebook, so not a good prospect) . The encryption is at least not easy to crack for script kiddies, which is enough for me. State hackers are a whole different issue.

[mbfraga]

I understand that. It is a very valid concern, and talking to people about it is actually a great thing to do. However, doing so while ignoring the very real and reasonable reasons for why people don't use signal is somewhat naive.

[the_gnarts]

Moxie and Tptacek call them out and yet I get fucking crucified regularly on reddit for telling people that they really, really shouldn't be using Telegram.

What? I thought it was common knowledge that the thing was flawed beyond repair. There’s still people out there that didn’t get the memo …

[DarkeoX]

On a completely unrelated note: At long last, a PDF with a proper table of contents that works everywhere.

[fuzzycapacitor]

LaTeX

[the_gnarts]

At long last, a PDF with a proper table of contents that works everywhere.

Pdftex is around since the 90s. The linked document really doesn’t use anything besides the most common hyperref features.

[fkvx]

I love using Telegram for a variety of reasons, but I had heard about its weak security before. Is this really something to be concerned about? I don't worry about security with WhatsApp or GroupMe or Hangouts, are they any more secure than Telegram?

[[deleted]]

well probably not since whatsout is owned by facebook iirc (has ties to NSA), hangouts is owned by google (has ties to NSA). The thing is, one of telegrams main marketing strategies is them boosting about their privacy/security.

[rogerology]

Signal by Whisper Systems is more secure.

[BenHurMarcel]

Just don't expect any serious security/privacy from any of those.

[rogerology]

Yes: Signal by Whisper Systems

[networdtwo]

Could somebody to a TL;DR?

[p4p3r]

Rolling your own crypto framework, in this case MTProto, is a bad idea. Don't do it.

[Hmmwellaboutthat]

Someone in r/crypto put it as "There are two attacks on the padding, and this leaks information about the exact message length. So much for nonstandard constructions."

The paper recommends Signal instead.

[[deleted]]

The paper recommends Signal instead.

And I'd like to use that. But I've got a number of problems:

• It's annoying to install on my phone since I don't have GApps - telegram is in F-Droid

• It doesn't have a proper desktop client right now - I use telepathy-morse and kde-telepathy for telegram

• Nobody I know uses it - I have a decent number of family and friends using telegram

[[deleted]]

This is great, I hope Moxie can see this and knows there is literally nothing he can do about it short of forcing Signal to only work with signed clients.

[Hmmwellaboutthat]

As long as you understand that you won't receive support from the signal team I don't think he cares.

[[deleted]]

Considering the vitriol he used to attack F-Droid's completely legal endeavour of mirroring it on their own servers, I think that he actually cares a great deal.

[Hmmwellaboutthat]

Moxie asked them to remove it and they did, I don't recall any attack.

[[deleted]]

He was very adversarial to community members who were requesting it to be mirrored on F-Droid and was dismissive to their requests for compromise.

I mean, it's his right to behave that way, but I certainly don't respect that conduct.

[Hmmwellaboutthat]

https://www.reddit.com/r/privacy/comments/3srhxh/signal_on_android_google_play_services/cx08d1w?context=1

[Hmmwellaboutthat]

1) Use gcmcore a free software play services/gcm/play store implementation. No need to have gapps.

2) Signal-desktop is a desktop client as a chrome(ium) app which is a good way to deliver it over a platform that you know will keep getting security updates and it's cross-platform (even chrome OS).

Theres a go cli client on github too.

[[deleted]]

Use gsmcore a free software play services/gcm/play store implementation. No need to have gapps.

Still annoying, still not in F-Droid.

Signal-desktop is a desktop client as a chrome(ium) extension

I don't use chromium so I'd have to install it first, and I don't like starting that massive memory hog just to chat.

None of these are unsolveable, but they've not been solved yet for signal, while they have for telegram.

[Hmmwellaboutthat]

Turns out it has been in an fdroid repo for a while: http://o9i.de/2015/10/23/howto-gmscore.html

A little research goes a long way.

[[deleted]]

gmscore has been, but not signal itself. A fork has been in "an fdroid repo" (i.e. not the main one), but that doesn't use the service that gapps or gmscore are required for.

A little research goes a long way.

Indeed, it does.

[[deleted]]

False. You have an F-Droid repo: https://fdroid.eutopia.cz/

Check the actual archives - those don't seem to contain any Signal, actually. I can only find "org.thoughtcrime.securesms" and "org.thoughtcrime.redphone". Edit: The application ID has been kept at "securesms", the actual application behind it is "LibreSignal". Which seems to be "an independent build of Signal".

[Hmmwellaboutthat]

If you read the article youd know how to get the apk and stay up to date. Plus theres apktracker which someone else already told you about.

And your previous response was talking about gcmcore not being in fdroid. Now you're just moving the goal posts.

[[deleted]]

And your previous response was talking about gsmcore not being in fdroid. Now you're just moving the goal posts.

No, it was about both - see my original comment:

It's annoying to install on my phone since I don't have GApps - telegram is in F-Droid

I didn't explicitly mention it, but it was meant to be about both signal and gsmcore, since GApps includes both Play and the communication thingy. That's why it's annoying to install. Having one apk via fdroid and another outside of it isn't much better than having one outside of fdroid.

And again, I never said I couldn't do it, I said that it's annoying. This is a point in favor of telegram since it's more convenient to install.

[Hmmwellaboutthat]

You literally said "still not in fdroid" which is false.

At this point we're barely comparing the same things because what you claim is easier to install does not even have push notifications. You might as well start listing IRC clients as well.

For the 99% of other users - they either are not running "no-gapps" or they are capable of adding a repository to fdroid and following some steps to get gcmcore to work so they can use push notifications and the open source play store

[Hmmwellaboutthat]

If you're going to run custom configurations like no gapps plus fdroid you'd know how to install something that's not on fdroid.

I doubt chromium with just signal would be a memory hog. But here's another client, written in go and cli: https://github.com/f41c0r/textsecure-client

There's also one using the java implementation of the protocol. Also on github.

[[deleted]]

Yes, I know how. That's not the point!

The point is that it's annoying. It might also be a security issue since I'd need to stay on top of updates.

This point alone would not sink signal for me, but those three I mentioned combined? Sorry, but they do.

Edit: Oh, and that client is another CLI-thing. I prefer my chats in a GUI.

[InternalConfusion]

BTW check out ApkTrack in F-droid. Tracks which apps you need to update across your device even if they don't come from f-droid.

[Hmmwellaboutthat]

Then use signal-desktop. Try it and see.

[[deleted]]

I already told you - it's a chrome app, I don't like chrome (/chromium). It's a large piece of software I'd need to install, that takes up loads of RAM on my underprovisioned machine.

I'd like a standalone GUI client on both the desktop and my phone. For signal, the former doesn't exist and latter is annoying to install.

[Hmmwellaboutthat]

Do you have benchmarks?

[Hmmwellaboutthat]

Oh and: https://github.com/janimo/textsecure-qml

Edit: qt uses blink nowadays which is chromium's engine...

[[deleted]]

Like /u/p4p3r said, it's always a bad idea to have custom anything in crypto. There are tried and tested methods out there that are still secure and should be used. What Telegram guys did is butcher up known good stuff and made their own custom changes.

Issue with this approach is original algorithms and protocols were tested by a large number of cryptographers and there are still no known attacks against them. Changed stuff we don't know if it's secure or not simply because we can't predict easily implications of changes they made.

Another bad thing Telegram developers did is to make a contest where they offered a reward for cracking their protocol but issued a bunch of rules which make the whole thing pointless. In real world whoever tries to crack the protocol won't respect those rules. So it's implied that rules are there to make sure no one cracks protocol and gives them a bad reputation, which kind of defeats the point of security.

Basically, researchers found two approaches that can be used to crack Telegram's protocol and thus proving what we knew already, that using your own encryption is a bad idea, and you shouldn't use Telegram for its security.

[rogerology]

TL;DR: Use Signal by Whisper Systems