Technology

39116 readers

365 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 3 years ago

MODERATORS

alyaza@beehaw.org

TheRtRevKaiser@beehaw.org

gyrfalcon@beehaw.org

rs5th@beehaw.org

SemioticStandard@beehaw.org

TheRtRevKaiser@kbin.social

coldredlight@beehaw.org

remington@beehaw.org

168

Telegram is indistinguishable from an FSB honeypot (rys.io)

submitted 2 days ago by rysiek@szmer.info to c/technology@beehaw.org

49 comments fedilink hide all child comments

Investigation by investigative journalism outlet IStories (EN version by OCCRP) shows that Telegram uses a single, FSB-linked company as their infrastructure provider globally.

Telegram's MTProto protocol also requires a cleartext identifier to be prepended to all client-server messages.

Combined, these two choices by Telegram make it into a surveillance tool.

I am quoted in the IStories story. I also did packet captures, and I dive into the nitty-gritty technical details on my blog.

Packet captures and MTProto deobfuscation library I wrote linked therein so that others can retrace my steps and check my work.

you are viewing a single comment's thread
view the rest of the comments

[–] ideonek@piefed.social 2 points 2 days ago (1 children)

Any advice for people that used it in the past? After reading the article, my understanding is that what was sent in "private chat" was in fact encrypted (for the most part) and can be considered secured (to the degree - something is off and, maybe we didn't find out yet, how the encryption is compromised). But it would wise to treat all other conversations as something that is compromised. Is this a fair summary?

[–] rysiek@szmer.info 5 points 1 day ago (1 children)

After reading the article, my understanding is that what was sent in “private chat” was in fact encrypted (for the most part) and can be considered secured (to the degree - something is off and, maybe we didn’t find out yet, how the encryption is compromised).

"Secret Chats", but otherwise spot-on, yes.

I am making a point of clarifying here because Telegram thrives on ambiguity. "Private chat" might mean anything in that system. "Secret Chat" is a specific feature that almost nobody uses but gives Telegram cover to claim they do end-to-end encryption.

But it would wise to treat all other conversations as something that is compromised. Is this a fair summary?

Yes, that's what I would say.

Telegram has access to everything that is not a "Secret Chat". They are responding to data requests. It's unclear what they include in these responses. They are also linked to FSB, through the same Vedeneev guy that owned GNM (the infrastructure provider).

[–] ideonek@piefed.social 2 points 1 day ago

This is the part that resonated with me the most as the casual user. The interface is, so confusing that the differences between various forms of chats seems deliberately unclear. And all that's "useful" is opt-in. And Groups - most used in corporate or project setting, can't be encrypted at all? That's... peculiar.

Again, thanks for the eye-opener.