(Cross-posted from: https://lemmy.dbzer0.com/post/26559848/)
Some significant news for Telegram users!
See this article for some interesting backstory context on Pavel Durov and Telegram: https://www.spiegel.de/international/world/the-telegram-billionaire-and-his-dark-empire-a-f27cb79f-86ae-48de-bdbd-8df604d07cc8
Since the post article is in French, here's an auto-translation:
Pavel Durov, the founder and CEO of the encrypted messaging service Telegram, was arrested around 8 p.m. on Saturday evening as he got off his private jet on the tarmac of Le Bourget airport. The 39-year-old Franco-Russian was accompanied by his bodyguard and a woman.
The arrest was carried out by the gendarmes of the GTA (Air Transport Gendarmerie). Registered in the RPF (wanted persons file), Pavel Durov came straight from Azerbaijan. He had over his head a French search warrant issued by the OFMIN of the National Directorate of the French Judicial Police, issued on the basis of a preliminary investigation.
Why was he under threat of a search warrant?
The Justice considers that the lack of moderation, cooperation with the police and the tools offered by Telegram (disposable number, cryptocurrencies, etc.) makes it complicit in drug trafficking, paedophile offences and fraud.
This search warrant ran if, and only if, Pavel Durov was on national territory. "He made a mistake tonight. We don't know why... Was this flight just a step? In any case, he's locked up!" a source close to the investigation told TF1/LCI. Since he knew he was persona non grata in France, Pavel Durov used to travel to the Emirates, the countries of the former USSR, South America... He travelled very little in Europe and avoided countries where Telegram is under surveillance.
And now?
Investigators from the ONAF (National Anti-Fraud Office attached to the Customs Directorate) notified him and placed him in police custody. He is expected to be presented to an investigating judge this Saturday evening before a possible indictment on Sunday for a multitude of offences: terrorism, drugs, complicity, fraud, money laundering, concealment, paedophile content...
"Pavel Durov will end up in pre-trial detention, that's for sure," comments an investigator to TF1/LCI. "On his platform, he allowed an incalculable number of misdemeanours and crimes to be committed for which he does nothing to moderate or cooperate," said a source close to the case.
His pre-trial detention at the end of his indictment is indeed in no doubt. Pavel Durov, a billionaire, has substantial means to flee and his guarantees of representation will hardly convince the judges.
A net with international resonance
For the investigators, this international sweep has various objectives. First, it makes it possible to kick the anthill, impress and deter the perpetrators of crimes and offences who exchange, until now, freely on Telegram. Secondly, they aim to put pressure on European countries to step up joint work to make secure messaging on terrorist cases bend.
Indeed, Telegram is a hive of criminal content. At the moment, the platform is in the news with the illegal broadcasting of Ligue 1 matches. But on this encrypted messaging service, many accounts are used by organized crime. Beyond terrorism, the most dangerous pedophiles communicate on Telegram to exchange content. "It has become for years THE number 1 platform for organized crime," comments an investigator.
Telegram is good for citizen journalism (like what's going on on the ground in Gaza and Ukraine), funny videos and memes, tech support, and casual conversation. Never privacy though.
The fact that governments want to shut down Telegram and arrest its founder shows that Telegram is pretty good for privacy.
Why not both? Telegram is bad for privacy, and governments still want to arrest the founders of systems they cannot control?
I wouldn't go that far
And definitely much better than discord, contrary to what some say
I'm pretty sure no one actually says that
What should be alarming is what thus means for other services. Can you get arrested for running a Matrix server in France? It seems like this is very slippery
I personally don't like Telegram as it is centralized, not private and is to close to the Russian government. However, it should be allowed to exist.
If you own a house, can see crime is being committed there and take no action to stop it you are a criminal and should be arrested. If you own a farm, can see crime is being committed there and take no action to stop it you are a criminal and should be arrested. If you own a school, can see crime is being committed there and take no action to stop it you are a criminal and should be arrested. If you own an office building, can see crime is being committed there and take no action to stop it you are a criminal and should be arrested. If you own an internet service provider (ISP), can see see crime is being committed there and take no action to stop it you are a criminal and should be arrested. If you own any land, can see crime is being committed there and take no action to stop it you are a criminal and should be arrested. If you own a public forum, can see crime is being committed there and take no action to stop it you are a criminal and should be arrested. If you own a public messenger (because Telegram is very much not private or encrypted) can see crime is being committed there and take no action to stop it you are a criminal and should be arrested.
I don't see this as a slippery slope.
What with public land? Do politicians need to be arrested?
yeah that doesn't make sense, I meant private forum, public forums belong to the "public" thus nobody can be held accountable.
Why not? Unlike whatsapp and signal, telegram private chats are not synchronized. So if you lost your phone and started a new one, the chats will not magically recover as in whatsapp. Because recover is unsecure. So the telegram is quite private.
or do you mean that encryption is not enabled by default in every chat? This is not an indicator of the messenger's privacy.
Although Tox takes them all by the head, of course.
Russia banned Signal, but not Telegram, to make sure their citizens couldn't plan any subversive activities against the state.
That's all we needed to know for sure.
On the other hand, Durov was arrested in Europe, but the developers of the signal somehow does not.
Well, for some unknown reason, drug dealers still choose telegram. And they don't just have an unfounded choice, but the profit depends on the messenger. Or say you that Durov was arrested for no reason?
P.S. in Russia now testing system for ban all messengers don't hosted in Russia. They next after youtube. Telegram too. Information from first hands. =)
Signal doesn't provide such open and easily found chat rooms.
It's really much more a messenger (with group chats, but those you have to manually set up)
So it's not an "open" place like telegram and with that not as attractive for advertising illicit services or products.
besides that, Signal is the technically much more secure variant. No discussion about it.
As telegram. If you think that some drug dealers create public chats with sell drugs, so... you are wrong. All work with darknet. In telegram all of them use only private one-by-one crypto chats.
If you want protect yourself for random network administrator on your network line, of course. If you want protect from anyone (government for example), of course not. Not necessarily in a bad way. Privatecrypto chats one-by-one are equally protected for the Russian opposition and for drug dealers. This is freedom of information. And that's why Durov was arrested. and not because he can hack chats something but don't do that. I think in really because that he can't hack chats and don't approve hack / insert backdoors for anyone.
Bullshit.
Telegram and Signal both use TLS. They are identically secure from transport-level attacks.
Of course yes. If you want a more private group chat, or an actually useful 1-on-1 encrypted chat that works across multiple devices, Signal is the only option (out of the two, there are way better alternatives like XMPP and Matrix). For 1 device-on-1 device E2E chats, Signal and Telegram are about the same level of security, except Telegram's protocol sees less scrutiny from the crypto community.
LOL. I see drug ads on the street all the time. The one time I checked, it pointed to a publicly available Telegram bot.
Not "somehow". The authorities know Telegram can indeed backdoor their service, since they know it already is. They also know Signal cannot.
Thus, since Telegram can but refuses, he gets arrested.
an interesting assumption. how can private encrypted chats be hacked? On custom self compiled clients if you think that client have hole. I learned telegram protocol and don't find any case. XD
Your .ru domain makes your comments in this discussion meritless.
...
That's why I started a domain in the ru zone. I can create domain anywhere else of course. If for you the nationality of the talker somehow affects the security of third-party software, then so be it. In the end, you can always not trust my words but familiarize yourself with the protocol.
Yeah I am a cryptographer, reverse engineer and (whitehat) hacker. I'm also well versed in the russian influence operations having run rampant in the west for a bit more than a decade.
The Telegram-supporters are out in force right now specifically to make sure people keep using Telegram, believing it to be secure. Russia has already made used of their backdoors against Ukraine in the war.
Russia banning Signal now was a huge blunder, since that proves there's nothing in Telegram they don't have access to, having allowed it to keep operating.
The main draw of telegram is not that it is secure it's that it's basically unmoderated. As a Russian I've had nothing but bad experiences with government censorship (dissent being equated to extremism and treason, LGBT advocacy equated to pedophilia) and it leads me to be deeply distrustful of the concept in a way similar to first amendment fanatics in the US (the first amendment is one of the uniquely good things about america you can't get in other "civilized" "western" countries). I suspect durov might have similar sentiments (though ofc I don't condone all the bad shit posted in the network and would prefer if it was moderated).
Still, whatever its faults, Telegram is the last remaining open social network in Russia where you can write whatever you like to a large audience and the government won't be able to remove it. They censored and blocked pretty much all the other ones.
No no no. Tell me how Durov, or someone else get access to my one-to-one crypto chat, if I compile mtproto self from github? You white hacker? Great. Try it and if you can you will be money rewarded. 500 dollars. OK?
P.S. If you will have problem with get money from Russia as we have problems to get money from Europe, I can send you money with crypto.
You didn't understand why I quoted that part the first time around. Let's try it again.
And why? because no one do that in real? So, you see on it different if you life or your freedom depends on the messenger. No all countries looks like EU. In my Android phone self compiled linphone and self compiled telegram client. That's my reality.
P.S. On the other hand, apple still fulfills all the requirements of the Russian authorities in the Russian store. By the way, the store works great. Why do you think that the same thing is not being done in other countries?
@nitrolife @troed
What made you think Telegram was secure in the first place?
Personally, I am studying the protocol. Do you have any exact data on how to hack a one-to-one crypted chat? I am ready to buy this information from you for money, if it is real.
As a separate statement: they can't (probably).
In context of the discussion: they don't need to, because secret chats are so inconvenient and fussy that they are seldom used. There is a lot of crime happening in public groups/channels, in "private" groups chats that can not be encrypted, or in 1-on-1's that are not secret. Telegram has the ability to stop all of that with just some moderation, or turn messages over to the authorities, but they don't. Which is precisely why Durov is in custody right now. If he actually made a messenger with good, convenient end-to-end encryption, he would be in the same situation with Signal authors, who have perfect deniability since they can't read anything their users have sent up until this point.
Maybe the difference is that the signal developers aren't rich people flying around the EU on private jets? Maybe there's no value in targeting the signal devs because they can't legally be expected to moderate chats they literally can not access? Maybe it's not worth backdooring because it's open source?
Telegram is not first durov project. Durov create VK. That is number one Russian facebook.
Can them connect any number of users in chat? That mean that them have access in any chat. And them should follow all USA laws of course.
Telegram open source too. And have many open client apps. For example clients without AD API support. How much custom client apps have signal?
Telegram's servers are not open source. Telegram's client is. If you make a back door in a messaging software, you'd want to do it server-side which means the users can't tell if it's backdoored as Telegram's server's source code is not available.
Alternatively; Signal's server code is open source, so if they put a back door in it they'd either have to lie to their users, or publish the back door in their code.
That's why cryptography don't trust ANY server side. For example signal server software can be don't same as github signal server software. And that's why alice and bob in crypto chats can check keys after handshake through server. But in signal you crypto for chat rooms with multiple clients. Can you check how much client in you chat? I don't find how. In telegram you always know that 1to1chat only 1to1.
And what problem with that?
P.S. For example system of technical means to ensure the functions of operational investigative measures installed an all mobile operators anywhere. But someone tell you something about that? No. Because that a law, not backdor.
Signal doesn't backfill your messages though, it just sends the new messages to both devices. I don't see how this makes it less secure than Telegram.
Telegram less secure than signal in normal chats. Key saved on server side and, technically, anyone can read all messages. That's argument was used when men says that telegram don't secure some time ago.
But what kind of secure you expect? Random admin in your internet provider can't read telegram and signal messages anyway. Messengers developers can't read signal messages in base case, but can read telegram public chats. That's true.
But what happened if we go to next level and check telegram 1 to 1 crypto chats vs signal chats. Signal chats can read messenger developers with basic hack (add one more person in chat and collect messages on disk). Or can read FBI by law. That mean in signal, as in telegram public, all work on trust, not in cryptography. Telegram 1to1 chats only 1to1. No one can't access to that (without change keys). And for best secure rekeing happens every 100 messages or 1 week. And one more, you can register telegram account without number and hide your IP with mtproto-proxy. That's why Durov arrested in frist place. And after that men tell that signal more secure then telegram... An what place?
How exactly do you think that would work? To add a new recipient the client needs to explicitly encrypt messages with a key available to that recipient. What command in the Signal protocol would trigger that action without first establishing trust in the recipient? (FYI when adding a new device, there is a key-exchange and verification process, which requires access to some other device with keys already on it).
оо рекабушники в эфире. Реддит ещё там блокировать не собираются?
А кто его знает. Тут как ветер подует так и заблокируют. По телеграмму / ватсапу и т.д. хотя бы предупреждали телеком операторов ещё месяц назад.
That's not true. Signal stores all messages on device.
Encryption on Telegram only works in 1 on 1 chats and is turned off by default meaning no one use it.
It also only works in the mobile clients
Ok. Signal win one point.
so, I use the telegram crypto chat to get a credit card pin from my bank. do you want to do this with signal? =)
and in turn, this means that the FSB log collector is not connected in the third place. =)
P.S. Do you understand the absurdity of the situation? telegram is not safe enough, but for some reason it is preferred by drug dealers. The lives of these people literally depend on the messenger. and the European Union was so unable to cope with this that it arrested the developer for complicity.
Definitely I would do so in Signal and never Telegram. What a question
OK. Thanks for answer.
Most people are technically illiterate. On top of that, most criminals are idiots (otherwise they'd have calculated risk/reward ratio rather than only looking at the reward side of things). The reason it is used by drug dealers is (1) Telegram is convenient, (2) Telegram is not moderated so they accumulate there due to "moderation selection", (3) Law enforcement didn't care enough to do anything about that. Now that (3) has changed and (2) is on shaky grounds, I expect a lot of them will move elsewhere.
There are way better options. Use Signal, Simplex Chat or even Matrix
Signal not good enough after check protocol.
Matrix is overkill. But I was hosted it some time ago.
So, I will check Simplex Chat. Thanks.
Chats are only synchronized in Signal on actively linked devices. If you link a new device, your chat history will be completely blank at first.
and this does not prevent you from connecting the FBI log collector in the background. He will always be active.
I live in a country where, when crossing the border, they can request a phone for check chats, so I can roughly imagine how it works. Government has a much higher level of access. if the account is restored via SMS, this means that any FSB employee can connect your account to himself. if the conversation is not one-on-one, it means that the FSB log collector is somewhere in third place. This is the reality. I don't understand why you think that your government collect data somehow another. may be from really bad people's, but with same methods.
P.S. on telegram you have only one-by-one crypto chats. Protocol can't connect anyone else.
Signal has been pretty throughly audited by data security experts. It’s as secure or more so than Telegram. It uses end to end encryption, same as Telegram. If you’re crossing the border, unlink your device, delete the app, and relink it later. Your account can’t be restore via SMS. I’m not sure what you mean by that. I’m sure my government can collect any data they want if they’re determined enough, but Signal is about as secure as it gets if you’re talking civilian digital communication.
Exactly. But telegram destroy basic tracking paradigm. You can register on really fake number for example, byed thought TON coin. That's why Durov arrested in the first place.
And that really good for drug dealers. Or for russian opposition who don't go out from Russia.
P.S. And experts check only Crypto part, by the way. What really happening on signal servers who known. In that part telegram con't connect anyone to 1to1 chat (but maybe can hack keys. But I cant approve that after check client source code), but signal can convert that chat to 3 persons with logger without problems.