By epimenov
This is absolutely dangerous thinking. There are a lot of people researching crypto and making sure it’s secure. If you’re using non-standard crypto, you don’t have that safety net.
They’re using primitives that are proven to be insecure against certain types of attacks (non-checked DH, MAC-then-encrypt, etc). And their code seems to be not perfect (https://twitter.com/matthew_d_green/status/58291636575066931…).
Signal on the other hand uses a variant of OTR (https://whispersystems.org/blog/advanced-ratcheting/). Which was thoroughly reviewed, and mentioned in NSA documents as not-cracked.
You can’t just invent something and claim “last time I checked it’s not broken”. It’s not broken (yet) if enough competent eyes looked at it, and the more standard building blocks you use, the easier to make those claims. That is absolutely not what Telegram does. I really wish the myth that Telegram is secure would die.
Read more here: https://news.ycombinator.com/item?id=10613766
epimenov comments on "Please Stop Writing Secure Messaging Tools"
No comments:
Post a Comment