Comment on Telegram is indistinguishable from an FSB honeypot

rysiek@szmer.info ⁨2⁩ ⁨months⁩ ago

• dfyx@lemmy.helios42.de ⁨2⁩ ⁨months⁩ ago

  What would you recommend as an alternative for the general non-technical population?

  source

  • rysiek@szmer.info ⁨2⁩ ⁨months⁩ ago

    For the internet messenger functionality that would be Signal.

    For other things (channels, mostly), anything that does not pretend to be end-to-end encrypted when it is not. A website with an RSS feed would be one trivial choice for channels that are open to anyone. Public communication like that has no business going through “platforms”.

    source
• sp3ctr4l@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago

  No questions from me, just wanna say:

  Excellent goddamned work.

  source
• SnotFlickerman@lemmy.blahaj.zone ⁨2⁩ ⁨months⁩ ago

  No questions. Hats off. Thank you for your service, it always seemed like a honeypot to me.

  source

  • rysiek@szmer.info ⁨2⁩ ⁨months⁩ ago

    Thank you!

    source
• FarceOfWill@infosec.pub ⁨2⁩ ⁨months⁩ ago

  There were reports (claims I suppose) that the fsb were using telegram to organise the stochastic gig job sabotage across Europe.

  Joining a neo fash telegram group, pretending to be a rich neo fash who wants to help the cause but not risk themselves and paying people for putting up posters, damaging equipment etc.

  Does what has been found here shed any more light on that? I’d guess it would allow them to find these groups to target them very easily? That was the bit I couldn’t quite understand from the original report, if so this all makes more sense.

  source

  • rysiek@szmer.info ⁨2⁩ ⁨months⁩ ago

    There were reports (claims I suppose) that the fsb were using telegram to organise the stochastic gig job sabotage across Europe

    No no, reports: www.msn.com/en-in/news/world/…/ar-AA1xshqO

    Does what has been found here shed any more light on that?

    Not really/not directly, I would say. What you are describing is FSB using Telegram for recruitment. That does not require network-level observability and surveillance. That’s a different “feature”, so to speak.

    source

    • FarceOfWill@infosec.pub ⁨2⁩ ⁨months⁩ ago

      It’s not that I don’t believe them, but anything coming from spooks has to be looked at a little sideways.

      Thanks for the reply. I just couldn’t figure out how they had enough intelligence to find all these telegram groups, maybe that’s easier for a nation state than I thought.

      source

      • rysiek@szmer.info ⁨2⁩ ⁨months⁩ ago

        It’s trivial for a nation state, they have lists of these groups. These groups are promoted in other groups and other channels and other forums and eventually reach somebody who will make a note of them.

        source
• ideonek@piefed.social ⁨2⁩ ⁨months⁩ ago

  Any advice for people that used it in the past? After reading the article, my understanding is that what was sent in "private chat" was in fact encrypted (for the most part) and can be considered secured (to the degree - something is off and, maybe we didn't find out yet, how the encryption is compromised). But it would wise to treat all other conversations as something that is compromised. Is this a fair summary?

  source

  • rysiek@szmer.info ⁨2⁩ ⁨months⁩ ago

    After reading the article, my understanding is that what was sent in “private chat” was in fact encrypted (for the most part) and can be considered secured (to the degree - something is off and, maybe we didn’t find out yet, how the encryption is compromised).

    “Secret Chats”, but otherwise spot-on, yes.

    I am making a point of clarifying here because Telegram thrives on ambiguity. “Private chat” might mean anything in that system. “Secret Chat” is a specific feature that almost nobody uses but gives Telegram cover to claim they do end-to-end encryption.

    But it would wise to treat all other conversations as something that is compromised. Is this a fair summary?

    Yes, that’s what I would say.

    Telegram has access to everything that is not a “Secret Chat”. They are responding to data requests. It’s unclear what they include in these responses. They are also linked to FSB, through the same Vedeneev guy that owned GNM (the infrastructure provider).

    source

    • ideonek@piefed.social ⁨2⁩ ⁨months⁩ ago

      This is the part that resonated with me the most as the casual user. The interface is, so confusing that the differences between various forms of chats seems deliberately unclear. And all that's "useful" is opt-in. And Groups - most used in corporate or project setting, can't be encrypted at all? That's... peculiar.

      Again, thanks for the eye-opener.

      source