Security researchers have warned that Telegram, a secure messaging app, could leak metadata and expose users to stalking.
Telegram was launched in 2013 by two Russian brothers and bills itself as a comms tool for those who value privacy and security.
The app has been in the news recently when it was discovered to be used by so-called Islamic State ahead of and during the Paris terrorist attacks earlier this month.
Topic: Gadget for private communication - page 3. (Read 1519 times)
WhatsApp’s acquisition by Facebook surprised everyone last week as it became perhaps the largest startup acquisition in history with the company valued at US$16 billion. Unfortunately for WhatsApp, as if almost on cue, the service went down the day after the announcement for roughly two days delivering at best intermittent connectivity for all 450 million users of the app. This, however, proved to be a boon for other messaging apps, especially Telegram, an open source clone of WhatsApp. Following WhatsApp’s perhaps first major service breakdown since 2009 – certainly not a good start for the Facebook acquisition – millions of people have signed up to Telegram. The service’s Twitter account noted that today it saw roughly five million new users.
So I was going thru this page:
https://privacytoolsio.github.io/privacytools.io/#im
And they specifically imply not to use telegram. I hopped on telegram BECAUSE everyone said it was private. Now I'm in a frenzy trying to find out how private they are and what exactly do they share (esp w/Google, MS, etc) and I can't find anything that makes me feel better.
Is there something I don't know about Telegram?
https://privacytoolsio.github.io/privacytools.io/#im
And they specifically imply not to use telegram. I hopped on telegram BECAUSE everyone said it was private. Now I'm in a frenzy trying to find out how private they are and what exactly do they share (esp w/Google, MS, etc) and I can't find anything that makes me feel better.
Is there something I don't know about Telegram?
A little time ago, we released a story about the Telegram X and its capabilities and why it was welcomed. As mentioned in that article, the Telegram X is in fact the second version of the official Telegram, which has a number of additional features and is approved by the official Telegram website. Telegram X is a faster and more customizable version of the Telegram, which is very popular, and it can be used instead of unofficial and unsafe versions of Telegram to be safe. In what follows, we are going to talk more about the Telegram X security issues and whether it really has the necessary security factors and approval of the official Telegram or not.
Here's how WhatsApp group messaging works: membership is maintained by the server. Clients of a group retrieve membership from the server, and clients encrypt all messages they send e2e to all group members.
If someone hacks the WhatsApp server, they can obviously alter the group membership. If they add themselves to the group:
1. The attacker will not see any past messages to the group; those were e2e encrypted with keys the attacker doesn't have.
2. All group members will see that the attacker has joined. There is no way to suppress this message.
Given the alternatives, I think that's a pretty reasonable design decision, and I think this headline pretty substantially mischaracterizes the situation. I think it would be better if the server didn't have metadata visibility into group membership, but that's a largely unsolved problem, and it's unrelated to confidentiality of group messages.
In contrast, Telegram does no encryption at all for group messages, even though it advertises itself as an encrypted messenger, and even though Telegram users think that group chats are somehow secure. An attacker who compromises the Telegram server can, undetected, recover every message that was sent in the past and receive all messages transmitted in the future without anyone receiving any notification at all.
There's no way to publish an academic paper about that, though, because there's no "attack" to describe, because there's no encryption to begin with. Without a paper there will be no talks at conferences, which means there will be no inflammatory headlines like this one.
To me, this article reads as a better example of the problems with the security industry and the way security research is done today, because I think the lesson to anyone watching is clear: don't build security into your products, because that makes you a target for researchers, even if you make the right decisions, and regardless of whether their research is practically important or not. It's much more effective to be Telegram: just leave cryptography out of everything, except for your marketing.
If someone hacks the WhatsApp server, they can obviously alter the group membership. If they add themselves to the group:
1. The attacker will not see any past messages to the group; those were e2e encrypted with keys the attacker doesn't have.
2. All group members will see that the attacker has joined. There is no way to suppress this message.
Given the alternatives, I think that's a pretty reasonable design decision, and I think this headline pretty substantially mischaracterizes the situation. I think it would be better if the server didn't have metadata visibility into group membership, but that's a largely unsolved problem, and it's unrelated to confidentiality of group messages.
In contrast, Telegram does no encryption at all for group messages, even though it advertises itself as an encrypted messenger, and even though Telegram users think that group chats are somehow secure. An attacker who compromises the Telegram server can, undetected, recover every message that was sent in the past and receive all messages transmitted in the future without anyone receiving any notification at all.
There's no way to publish an academic paper about that, though, because there's no "attack" to describe, because there's no encryption to begin with. Without a paper there will be no talks at conferences, which means there will be no inflammatory headlines like this one.
To me, this article reads as a better example of the problems with the security industry and the way security research is done today, because I think the lesson to anyone watching is clear: don't build security into your products, because that makes you a target for researchers, even if you make the right decisions, and regardless of whether their research is practically important or not. It's much more effective to be Telegram: just leave cryptography out of everything, except for your marketing.
As an extra layer of security, Skype has released a preview of end-to-end encrypted “Private Conversations.” Currently available for Skype Insiders, users will now have more protection over the content they send within conversations.
Using Open Whisper System’s Signal Protocol, Private Conversations provides end-to-end encryption for Skype audio calls, along with any text messages, images, videos, and audio you send. All content will also be hidden while on the app, so any Preview messages you send won’t show up in your Chats or notifications.
Using Open Whisper System’s Signal Protocol, Private Conversations provides end-to-end encryption for Skype audio calls, along with any text messages, images, videos, and audio you send. All content will also be hidden while on the app, so any Preview messages you send won’t show up in your Chats or notifications.
Welcome. What is blackhawk browser? Has anyone heard of him? Worth it to use, he will be able to replace Safari or Yandex from Google? I first heard about it, don't want to download until it is sure of its reliability. And so garbage on your computer is full, do not want another stuff to download.
Hello, everyone. Has anyone used Safari? You know what's the latest version of Windows right now? I can not find the optimal, then in English, the Internet does not work. Or where to download, can you recommend a source? All have already tried, only the trash in the computer is downloaded. I would be very grateful. Or on the official website of the Appl can be downloaded?
As of today, common communication systems do not include E2EE. These systems can only guarantee the protection of communication traffic between client and server, not between the communicating parties themselves. Examples of non-E2EE messaging systems are Hotmail, Facebook, Google Talk, Yahoo Messenger. Dropbox and Google Drive are also examples of non-E2EE storage systems.
Despite E2EE’s absence in everyday use, the competition among tech companies has already begun, creating service offerings that promise better data protection with E2EE. Apple took the lead by announcing last year that its new iOS 8 operating system would encrypt nearly all data on IOS running devices by default, including text messages, photos and contacts. They also announced that the company would no longer be able to unlock client devices as long as they are password protected. Previous versions of the operating system were allowing Apple to unlock devices remotely. Then, Google made the announcement that they would do the same with their next Android software release.
Despite E2EE’s absence in everyday use, the competition among tech companies has already begun, creating service offerings that promise better data protection with E2EE. Apple took the lead by announcing last year that its new iOS 8 operating system would encrypt nearly all data on IOS running devices by default, including text messages, photos and contacts. They also announced that the company would no longer be able to unlock client devices as long as they are password protected. Previous versions of the operating system were allowing Apple to unlock devices remotely. Then, Google made the announcement that they would do the same with their next Android software release.
Telegram blocks 'terrorist-related' channels after Indonesia ban
Better late than never: The messaging service says it was late in removing the channels because of a "miscommunication."
Better late than never: The messaging service says it was late in removing the channels because of a "miscommunication."
Messaging programs are a closely watched application category, with experts scrutinizing how communications are protected from government surveillance dragnets and hackers. The primary defense invariably involves encryption, but just saying an application uses encryption by no means ensures it’s secure.
One of the latest programs to come under fire is Telegram, which is backed by Pavel Durov[cq], who also founded the popular Russian social networking site Vkontakte. Telegram is a free desktop and mobile application launched in 2013 that promotes itself as “taking back our right to privacy.”
One of the latest programs to come under fire is Telegram, which is backed by Pavel Durov[cq], who also founded the popular Russian social networking site Vkontakte. Telegram is a free desktop and mobile application launched in 2013 that promotes itself as “taking back our right to privacy.”
With over a billion users, it’s almost certain that malicious cybercriminals would look to exploit the popular messaging app. WhatsApp announced the launch of a web interface and desktop application in January 2015. Unsurprisingly, hackers were quick to pounce with fake WhatsApp websites and applications that stole data and distributed malware.
They are not cryptographers, but they have some background in maths. Great!
So, what is the system’s architecture? Basically, a few servers everywhere in the world, routing messages between clients. Authentication is only done between the client and the server, not between clients communicating with each other. Encryption happens between the client and the server, but not using TLS (some home made protocol instead). Encryption can happen end to end between clients, but there is no authentication, so the server can perform a MITM attack.
So, what is the system’s architecture? Basically, a few servers everywhere in the world, routing messages between clients. Authentication is only done between the client and the server, not between clients communicating with each other. Encryption happens between the client and the server, but not using TLS (some home made protocol instead). Encryption can happen end to end between clients, but there is no authentication, so the server can perform a MITM attack.
Can I share files in your application?
Right after the horribly tragic terror attacks in Paris, we started to read badly written articles by journalists trying to attract readers with sensational headlines.
The easiest target was encrypted communication tools and one of those is Telegram Messenger. It was said ISIS/ISIL used Telegram to chat securely and that they considered it a good solid secure and trustworthy platform. Does it really deserve that reputation?
I wrote a article on March 2014 that explained some of the shortcomings of this messaging platform.
The easiest target was encrypted communication tools and one of those is Telegram Messenger. It was said ISIS/ISIL used Telegram to chat securely and that they considered it a good solid secure and trustworthy platform. Does it really deserve that reputation?
I wrote a article on March 2014 that explained some of the shortcomings of this messaging platform.
privacy at risk: telegram sanctioned in russia for protecting its users
The Russian government fined Telegram and could block use of the instant messaging app, because the company refused to grant it access to users’ communications. Members of INCLO, including CELS, seek to curb such measures.
The Russian government fined Telegram and could block use of the instant messaging app, because the company refused to grant it access to users’ communications. Members of INCLO, including CELS, seek to curb such measures.
Signal’s claim to fame is that it’s the preferred messaging application of Edward Snowden. It’s among the easiest to set up, as it automatically authenticates your number and can even be used as your default SMS app.
As with Whisper, you can create a group for private banter with an unlimited number of other users. Signal also makes phone calls, which I found to be very clear when testing it out in a couple of different cases.
As with Whisper, you can create a group for private banter with an unlimited number of other users. Signal also makes phone calls, which I found to be very clear when testing it out in a couple of different cases.
Good article with analysis of protection systems in different messengers
https://www.greenbot.com/article/3119449/android/the-best-messaging-apps-with-end-to-end-encryption.html
https://www.greenbot.com/article/3119449/android/the-best-messaging-apps-with-end-to-end-encryption.html
Jump to: