1022
Signal Founder Moxie Marlinspike: Telegram is not private. There is nothing private about it. They've done a really amazing job of convincing the world that this is an encrypted messaging app (cdn.imgchest.com)
submitted 7 months ago* by to c/privacy@lemmy.ml
330 comments fedilink hide all child comments
 

“Telegram is not a private messenger. There’s nothing private about it. It’s the opposite. It’s a cloud messenger where every message you’ve ever sent or received is in plain text in a database that Telegram the organization controls and has access to it”

“It’s like a Russian oligarch starting an unencrypted version of WhatsApp, a pixel for pixel clone of WhatsApp. That should be kind of a difficult brand to operate. Somehow, they’ve done a really amazing job of convincing the whole world that this is an encrypted messaging app and that the founder is some kind of Russian dissident, even though he goes there once a month, the whole team lives in Russia, and their families are there.”

" What happened in France is they just chose not to respond to the subpoena. So that’s in violation of the law. And, he gets arrested in France, right? And everyone’s like, oh, France. But I think the key point is they have the data, like they can respond to the subpoenas where as Signal, for instance, doesn’t have access to the data and couldn’t respond to that same request.  To me it’s very obvious that Russia would’ve had a much less polite version of that conversation with Pavel Durov and the telegram team before this moment"

you are viewing a single comment's thread
view the rest of the comments
[–] 15 points 7 months ago (24 children)

There’s no such social graph to speak of. Signal does not know who is speaking to whom.

The only people who know this are people operating the server. Period.

Three-letter agencies have served them legal subpoenas many many times and they never turn over anything more than the above information.

See the link I provided above.

Filter for…what, exactly? The hundreds of millions of people who value private and secure communications?

Yup, that's precisely what it's a filter for.

We do, because they publish them publicly.

Trust me bro is not a viable model for anybody who actually gives a shit about their privacy.

The reality of the situation is that Signal asks users for information it has no business collecting during the sign up process, and this information can be used in adversarial ways against the users. People using Signal are making a faith based judgment to trust the operators of this server.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 24 child comments
    •
  • [–] 3 points 7 months ago (18 children)

    nope… signal has sealed sender to prevent them from building a social graph

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 18 child comments
    •
  • [–] 0 points 7 months ago (17 children)

    Nope, sealed sender does not address the problem because the phone number is collected at sign up time. The whole sealed sender concept is just another trust me bro mechanic because, once again, nobody aside from people who are actually operating the server know what it’s doing. Signal is proof that vast majority of people don’t understand the basics of privacy and security, and they don’t actually care.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 17 child comments
    •
  • [–] 5 points 7 months ago (16 children)

    the phone number being collected at sign up just proves that you use signal

    they can’t build any kind of social graph from it… they can only use the information contained in the message for delivery and rate limiting

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 5 points 7 months ago (15 children)

    Again, the only people who actually know what the phone number is used for are the people who operate the server. I don't know why this is such a difficult concept for people to grasp. They don't need the information contained in the messages. Once the phone number is collected, it CAN be stored and associated with your account. There is no way for you to know whether that happens or not unless you have access to that server. There is no way for you to verify that the server does what people operating it say it does. That's what makes it a trust based system.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 6 points 7 months ago* (14 children)

    yes, i’m aware that you don’t know what the phone number is used for, but what we can guarantee is that it can’t be tied back to your message history, because again that’s what sealed sender is for. in order to send messages, you use a signed, derived value that has never been seen by the signal servers (since it’s derived) but is still signed (so signal knows it’s legitimate: they can validate your identity and rate limit without knowing it)

    so whilst the phone number is associated with an account, that only allows them to know that you (person/identity) use signal… but that identity can verifiably not be tied back to any messages you send

    nothing about that identity other than derived cryptographic data is ever sent along with your messages

    *edit: i’ll slightly retract that: of course your IP address is also sent along with messages, and that may be able to be tied back to your identity… let’s say out of band, of course… so it’s on you to use a VPN or some other method to obfuscate your source IP address. i’d say that’s generally applicable to any other service too

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 5 points 7 months ago (11 children)

    Again, nowhere did I talk about message history. What I'm talking about the server having unique ids for each user, which is how it connects users to each other, and having a phone number collected initially which can be tied to that id. You don't need anything from the messages themselves to create a graph of people who talk to each other. The routing is done by the server.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 4 points 7 months ago (10 children)

    the server having unique ids for each user, which is how it connects users to each other, and having a phone number collected initially which can be tied to that id

    but in that chain what you really care about is your phone number that identifies you in the real world to your messages, right?

    The routing is done by the server

    yes, and the only thing you need to route is the receiver; not the sender

    the sender is only used to validate the senders identity, and for rate limiting

    sealed sender solves both of these problems whilst not including any sender information in messages… phone number or user id doesn’t matter: those things are not sent along with any of your messages, and that’s verifiable

    your phone number and user id is only known by signal when you retrieve a temporary token (this solves rate limiting: the retrieval of the token is the rate limit, and each token has a limited number of messages it can send)… the client then derives a different key from it, which can still be verified as having been signed by the server, but does not contain any information that can be tied back to your phone number or user ID

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 5 points 7 months ago (9 children)

    but in that chain what you really care about is your phone number that identifies you in the real world to your messages, right?

    It doesn't matter, what matters is that the server has a unique id for you and the person you're talking to, and that id can then be mapped to the phone number that was initially collected. That's all the server needs to identify the real identity of the people you communicate with.

    It's not a question of what the server needs minimally, it's a question of what the server could be doing if it was set up maliciously. The sealed sender does not solve this problem in any way shape of form.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 5 points 7 months ago* (8 children)

    what matters is that the server has a unique id for you and the person you're talking to, and that id can then be mapped to the phone number that was initially collected. That's all the server needs to identify the real identity of the people you communicate with

    the key point missing in the middle here though is that the IDs aren’t what matters: it’s having the ability to link those IDs

    and i agree, being able to link you->your phone number->your user ID->message->recipient ID->recipient phone number->recipient as an individual is a problem

    but again, sealed sender break that chain: there is cryptographically no way to link your user ID to the message you’ve sent

    it’s literally impossible for them to build a social graph from your messages

    It's not a question of what the server needs minimally

    again, i agree… kinda… i put that there to show that you don’t actually need the sender to achieve the goal of delivering the message. it was part of the explanation of why sealed sender works, rather than a point to be made by itself

    what the server could be doing if it was set up maliciously. The sealed sender does not solve this problem in any way shape of form

    would you be able to explain how it doesn’t?

    sealed sender divorces your user ID from any message you send… your messages can not be tied back to your user ID or phone number without having decrypted the message content

    so even with a malicious server, because you can verify your client behaviour (that it derives keys, and that you can verify the message payload contains nothing outside the ciphertext which is unexpected), then even a malicious server (without IP information) doesn’t have the information necessary to infer the sender from the sent message

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 5 points 7 months ago (7 children)

    Again, sealed sender has nothing to do with it. If I run a server, I have access to the raw requests coming in. I can do whatever I want with them even outside Signal protocol. You can't verify that my server is set up to work the way I say it is. You get that right?

    You're confusing what Signal team says their server does, and the open source server implementation they released with what's actually running. The latter, you have no idea about.

    The core issue is trusting the physical infrastructure rather than just the cryptography. The protocol design for sealed sender assumes the server behaves exactly as the published open source code dictates. A malicious operator can simply run modified server software that entirely ignores those privacy protections. Even if the cryptographic payload lacks a sender ID, the server still receives the raw network request and all the metadata attached to it. Your client has to talk to the server and identify itself before any messages are even sent.

    When your device connects to send that sealed message, it inevitably reveals your IP address and connection timing to the server. The server also knows your IP address from when you initially registered your phone number or when you requested those temporary rate limiting tokens. By logging the raw incoming requests at the network level, a malicious server can easily correlate the IP address sending the sealed message with the IP address tied to the phone number.

    Since the server must know the destination to route the message, it just links your incoming IP address to the recipient ID. Over time this builds a complete social graph of who is talking to whom. The cryptographic token merely proves you are allowed to send a message without explicitly stating who you are inside the payload. It does absolutely nothing to hide the metadata of the network connection itself from the machine receiving the data.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 5 points 7 months ago (6 children)

    If I run a server, I have access to the raw requests coming in. I can do whatever I want with them even outside Signal protocol. You can't verify that my server is set up to work the way I say it is. You get that right?

    i do, of course… and the information you have in that raw request is limited to the information that’s in the request (including metadata like IP address and other header information in the packets that make it up)

    You're confusing what Signal team says their server does, and the open source server implementation they released with what's actually running. The latter, you have no idea about.

    i’m really not… i’m saying it doesn’t matter what their server is doing, which is the only way to actually verify this: the client is the only thing you can trust in the chain, so you should always assume that the server is compromised: maliciously or not

    trusting signal doesn’t even have anything to do with it; they could be compromised and not know it

    these are things we both agree on

    the server still receives the raw network request and all the metadata attached to it. Your client has to talk to the server and identify itself before any messages are even sent.

    i agree with that too. what information contained within that request do you take issue with?

    as i said earlier, your IP address is problematic, but that can be said about any service: you have no way to validate any server software, open source or not… so you have to take measures to protect that information no matter the service you’re connecting too

    this is pretty trivially achieved with a trustworthy VPN these days (again, this is unverifiable, but you have to draw the line somewhere: can we agree that IP address privacy is within the realm of personal responsibility since that applies to any service?)

    When your device connects to send that sealed message, it inevitably reveals your IP address and connection timing to the server.

    agree

    The server also knows your IP address from when you initially registered your phone number or when you requested those temporary rate limiting tokens.

    also agree

    By logging the raw incoming requests at the network level, a malicious server can easily correlate the IP address sending the sealed message with the IP address tied to the phone number.

    okay, i can see where your problem is

    i can agree that’s definitely a vector they can use to build a social graph, and then tie that social graph back to real identities, and also that’s far from what you want in a private platform

    id say that it comes down to trade-offs… signal (says) they require the phone number in order to combat spam, which i can see as a real issue (i’d be happier if they didn’t store the phone number, or at least didn’t link it to your account, but that comes with a whole load of other issues)

    services need to have some way of combatting spam, which either boils down to “expensive accounts” so that blocking is a viable option, or spam filters which can be abused by corporate entities like they have with email

    if you really care about privacy with signal, you can get a VPN that allows you to frequently rotate your IP… most users won’t do that, so i can agree it’s a sub-optimal solution

    but i do think it’s a reasonable trade-off

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 5 points 7 months ago (5 children)

    Sure, you can absolutely decide that it's a reasonable trade off, but your original claim was that sealed sender addressed the problem. Sounds like you're now acknowledging that's not actually the case..

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 7 months ago* (last edited 7 months ago) (4 children)

    i think it’s a very clever partial solution, but when combined with signals other ethos (making privacy simple so that more people use privacy-centric options), that means people aren’t going to change IPs between temp token and message to solve the last part of the puzzle: thanks for explaining your line of reasoning

    i also think that there’s a way forward where messages are sent or tokens are retrieved via a 3rd party proxy to hide IPs (i thought i read something about signal contracting a 3rd party to provide some of those services but i can’t find the reference to that, and also it’s not verifiable so limited in usefulness), which is a complete solution to the problem, as long as said proxies aren’t controlled by signal (thinking about it now, you could also simply route signal traffic through a proxy so many people share an IP, and they do provide proxy functionality separate to the system proxy configuration)

    i still think that signal has made a pretty reasonable set of trade-offs in order to balance privacy and usability in order to have a large impact on global privacy

    *edit: actually, adding to the proxy point, turns out EFF run a public proxy

    and there’s a big list of public proxies available (not a big list to avoid censorship, but still a good resource)

    and they also have support for tapping a link to configure the proxy, so very quick and easy

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 7 months ago (3 children)

    It's not really a partial solution, it's just sophistry to obscure the problem. The fact that I've had this same discussion with many people now, and it always takes effort to explain why sealed sender doesn't actually address the problem leads me to believe the the actual problem it's solving is not of making the platform more secure. The complete and obvious solution to the problem is to not collect personally identifying information in the first place.

    You have a very charitable view of Signal making the base assumption that people running it are good actors. Yet, given that it has direct ties to the US government, that it's operated in the US on a central server, and the team won't even release the app outside proprietary platforms, that base assumption does not seem well founded to me. I do not trust the people operating this service, and I think it's a very dangerous assumption to think that they have your best interests in mind.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 7 months ago (2 children)

    It's not really a partial solution

    disagree, and that’s fine… STEM is full of partial solutions that become complete solutions as additional pieces are added (and as i said with the proxy, imo the proxy makes it a complete solution)

    The complete and obvious solution to the problem is to not collect personally identifying information in the first place.

    but that creates other problems… for example, with spam and usability

    it’s all trade-offs, and signal has done a lot of global privacy when compared to alternatives exactly because of the compromises they’ve made

    You have a very charitable view of Signal making the base assumption that people running it are good actors

    i don’t consider it charity… they’re making a lot of right moves, and are explaining their compromises. they’ve given me no reason not to trust them, and plenty of reasons to say they’re a good compromise that will have the greatest impact to global privacy

    are there better privacy solutions? sure… will they ever take off? personally, i doubt it… not letting perfect be the enemy of better or good enough is important: a solution that keeps people who don’t care about privacy relatively safe is important, including for the privacy of people who do care about their privacy because it allows everyone to blend in with the crowd

    Yet, given that it has direct ties to the US government, that it's operated in the US on a central server, and the team won't even release the app outside proprietary platforms

    imo the fact that it’s hosted in the US is pretty irrelevant… as you’ve pointed out: it shouldn’t be a matter of trust… validation of the client is the only thing you can rely on, so even if the NSA hosted the servers you should still theoretically be able to “trust” the platform (outside of the fact that you couldn’t ever trust that they’re using encryption that they don’t have a secret back door in or something)

    I do not trust the people operating this service, and I think it's a very dangerous assumption to think that they have your best interests in mind.

    i trust them as much as i trust anyone running any other privacy service

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -3 points 7 months ago (4 children)

    The only people who know this are people operating the server.

    We all know this, for reasons I've already stated.

    See the link I provided above.

    Your link is broken.

    Yup, that's precisely what it's a filter for.

    100M people is not a filter...

    Trust me bro is not a viable model

    No one said anything about that? That is not the model.

    The reality of the situation is that Signal asks users for information it has no business collecting

    The business is connecting users. It's one of the reasons it is the most viable private and secure chat platform. It's why I have a dozen connections on Signal and literally 0 on every other platform. Because you actually know who's using it. You can have the most private and secure messaging system in the world but if you can't use it to actually chat with anyone, then what good is it?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 6 points 7 months ago (3 children)

    No, we don't all know this. What we actually know that people like you say this and expect the rest of us to trust you blindly, which is itself concerning.

    Your link is broken.

    Your browser plugins are broken, the link is fine. That said, here's non archived version https://www.washingtonpost.com/technology/2021/06/15/faq-data-subpoena-investigation/

    100M people is not a filter…

    Given world population and modern data analysis capabilities it absolutely is.

    No one said anything about that? That is not the model.

    That's literally the model. Signal asks you for your phone number when you register, what happens with that information after that is only known to people operating the server. Let me know what part of that you're still struggling to understand.

    The business is connecting users. It’s one of the reasons it is the most viable private and secure chat platform. It’s why I have a dozen connections on Signal and literally 0 on every other platform. Because you actually know who’s using it.

    That word salad has fuck all to do with the point I made, which once again, is that you have to trust people who operate the server in how they handle this information.

    You can have the most private and secure messaging system in the world but if you can’t use it to actually chat with anyone, then what good is it?

    Ah yes, because there's absolutely no conceivable way to verify whom you're connecting with aside from sharing your phone number with an American company. You couldn't possibly use any out of band channel to verify who the person you're communicating with is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [+] 0 points 7 months ago* (2 children)
    [removed by mod]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •