IssueRaiser

Do you have a data point to suggest real bias against the geographic engineering behind Telegram?

Do you have a data point to suggest real bias against the geographic engineering behind Telegram? All the substantial warnings I have read against it revolve around its lack of a respected crypto team (in fact, not having any experienced crypto team and conflating a bunch of maths PhDs with a real crypto team), not using acknowledged crypto design best practices (and flagrantly ignoring them for counrer-intuitive designs), and most importantly, using a contest instead of a real audit. Contest != audit. An audit has a specialized team of cryptographers who try to break the application in any scenario. A contest has restrictive scope that sets up a strawman and doesn't attract real, serious crypto auditing. As an example, this article's MITM doesn't qualify despite being a real attack. A contest means that you have no real knowledge of whether the crypto is broken if nobody succeeds. An audit means you can be significantly towards certain. You might already know this, but consider that if someone hosts a contest instead of an audit, and has all the other issues stated above, they will be met with hostility.

Posted by dsacco on Jan 11, 2015, 4:09 PM

Tags

Related issues

Raise real-world problems, find people facing the same issue, and discuss solutions.9,000 issues0 comments

reliability (Other)

Do you have a data point to suggest real bias against the geographic engineering behind Telegram?

dsaccoJan 11, 2015, 4:09 PM

Do you have a data point to suggest real bias against the geographic engineering behind Telegram? All the substantial warnings I have read against it revolve around its lack of a respected crypto team (in fact, not having any experienced crypto team and conflating a bunch of maths PhDs with a real crypto team), not using acknowledged crypto design best practices (and flagrantly ignoring them for counrer-intuitive designs), and most importantly, using a contest instead of a real audit. Contest != audit. An audit has a specialized team of cryptographers who try to break the application in any scenario. A contest has restrictive scope that sets up a strawman and doesn't attract real, serious crypto auditing. As an example, this article's MITM doesn't qualify despite being a real attack. A contest means that you have no real knowledge of whether the crypto is broken if nobody succeeds. An audit means you can be significantly towards certain. You might already know this, but consider that if someone hosts a contest instead of an audit, and has all the other issues stated above, they will be met with hostility.

Comments (0)

No comments yet. Start the discussion.

Comment on this issue