this post was submitted on 09 Aug 2024
200 points (97.6% liked)
Technology
59374 readers
7033 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's open source. Look can up the encryption yourself.
No need, all you have to do is read the whitepaper. they home brewed the encryption algorithm and nobody actually knows if it's worth a damn. That's not exactly a secret.
And it isn't even encrypted by default, you manually have to enable that. By default, all your plain text messages are stored on their servers.
After all these years, security researchers still don't know if the encryption is any good?
On that level it usually falls on computer scientists. Formal methods can prove that any implementation is correct, but proving the absence of unintended attacks is a lot harder.
Needham-Schroeder comes to mind as an example from back when I was studying the things.
And not a single one has been able to analyze the encryption in all these years? Fact is, Telegram is the tool the Russian opposition and even Ukrainians use to communicate without Putin being able to infiltrate.
No. It kind of falls on Dijkstra's old statement. "Testing can only prove the presence, not absence of bugs."
You can prove logical correctness of code, but an abstract thing such as "is there an unknown weakness" is a bit harder to prove. The tricky part is coming up with the correct constraints to prove.
Security researchers tend to be on the testing side of things.
A notable example is how DES got its mixers changed between proposal and standardisation. The belief at the time was that the new mixers had some unknown backdoor for the NSA. AFAIK, it has never been proven.
They don't have reproducible builds afaik (unlike Signal). You can have a completely different code running on your phone than on GitHub.
Besides, who is using Secret Chat anyways? All default chats and group chats are unencrypted.
Just use the F-Droid version if there is any doubt.
Probably Russians who used Signal before.
The F-droid version is also not reproducible. The binary you install has a different hash than the one you build from the GitHub.
It's reproducible if you compare it with F-droid's tarball, which has all the source code in it.
F-Droid builds from source, so any suspicion whether the Google Play version has been tampered is completely irrelevant for the F-Droid version.
Can it be proven that that encryption is what's used in practice?
Just use the F-Droid version if there is any doubt.
What about iOS users?
Apple is not selling iPhones in Russia after the beginning of the invasion.
Ah yes, because everyone just throws away their phone after 2 years. People definitely haven't purchased iPhones before the invasion.
It's not about everyone, it's about people needing to hide their communication from the Putin regime.