<story><title>The Arrest of Pavel Durov Is a Reminder That Telegram Is Not Encrypted</title><url>https://gizmodo.com/the-arrest-of-pavel-durov-is-a-reminder-that-telegram-is-not-encrypted-2000490960</url></story><parent_chain><item><author>sunaookami</author><text>It also doesn&amp;#x27;t mean &amp;quot;plain text&amp;quot;. Telegram uses MTProto and the decryption keys are stored on multiple servers in multiple jurisdictions, something which Gizmodo doesn&amp;#x27;t even mention.&lt;p&gt;See also this excellent comment by another HN user: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=41348228&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=41348228&lt;/a&gt;</text></item></parent_chain><comment><author>DyslexicAtheist</author><text>Here is a better resource by an actual respected cryptographer: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2024&amp;#x2F;08&amp;#x2F;25&amp;#x2F;telegram-is-not-really-an-encrypted-messaging-app&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2024&amp;#x2F;08&amp;#x2F;25&amp;#x2F;telegram...&lt;/a&gt;&lt;p&gt;One of the links shared by the comment you&amp;#x27;re linking to points to a paper which concludes:&lt;p&gt;&amp;gt; &lt;i&gt;We have presented the formalisation of the MTProto 2.0 protocol suite in the applied π-calculus, and its analysis using the protocol verifier ProVerif. This approach adopts the symbolic Dolev-Yao threat model: an active intruder can intercept, modify, forward, drop, replay or reflect any message. Within this model, we have provided a fully automated proof of the soundness of MTProto 2.0’s protocols for first authentication, normal chat, end-to-end encrypted chat, and rekeying mechanisms with respect to several security properties, including authentication, integrity, secrecy and perfect forward secrecy, also in the presence of malicious servers and clients. Moreover, we have discovered that the rekeying protocol is vulnerable to a theoretical unknown key-share (UKS) attack [ 5 ]: a malicious client B, with the help of another client E, can induce a client A to believe that she (still) shares a secret key with E, and instead A shares the key with B. The practical exploitability of this attack in actual implementations is still to be investigated. Our formalization covers also the behaviour of the users, when relevant; e.g., if the users do not check the fingerprints of their shared keys, a MitM attack is possible.&lt;/i&gt;</text></comment>
<story><title>The Arrest of Pavel Durov Is a Reminder That Telegram Is Not Encrypted</title><url>https://gizmodo.com/the-arrest-of-pavel-durov-is-a-reminder-that-telegram-is-not-encrypted-2000490960</url></story><parent_chain><item><author>sunaookami</author><text>It also doesn&amp;#x27;t mean &amp;quot;plain text&amp;quot;. Telegram uses MTProto and the decryption keys are stored on multiple servers in multiple jurisdictions, something which Gizmodo doesn&amp;#x27;t even mention.&lt;p&gt;See also this excellent comment by another HN user: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=41348228&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=41348228&lt;/a&gt;</text></item></parent_chain><comment><author>lxgr</author><text>&amp;gt; the decryption keys are stored on multiple servers in multiple jurisdictions&lt;p&gt;Which is completely besides the point when the question is &amp;quot;should you trust Telegram&amp;quot;, given that they are still entirely under Telegram&amp;#x27;s logical control.&lt;p&gt;The only circumstance under which this is a meaningful difference is when somebody &lt;i&gt;other than Telegram&lt;/i&gt; (law enforcement with a warrant, law enforcement without a warrant, criminals etc.) walks into a data center and pulls those servers&amp;#x27; hard disks.</text></comment>