rysiek
@rysiek@szmer.info
https://rys.io/
- Comment on Telegram is indistinguishable from an FSB honeypot 1 hour ago:
they already who which user is which IP from the servers they control (…) when they already control Telegram’s servers
Who is “they” here?
If you meant “the compromised provider” here, then no, we cannot assume they know which IP address is used by which user. Full disk encryption exists, you can rent a (physical, dedicated, as is the case here) server from a provider and set it up in such a way that you can be reasonably sure that the provider does not have access to the data on the server.
So in that case the provider would only see the traffic without the ability to connect easily IP addresses with actual devices or users. That is not enough to reliably track anyone long-term, as IP addresses change in ways that often make it difficult to figure out if some traffic comes from the same user/device or not – especially when you travel. But add an identifier visible directly on the wire, like the
auth_key_id, and you can pretty easily say “yes, this new IP address is now used by the same device”.If you mean “Telegram”, and assume Telegram cooperates fully with the FSB, to the point of providing unfettered access to data on Telegram’s servers, then sure. But I cannot prove that, and neither could the IStories team. Can you? You can of course make any assumption you want to (and I am not saying your assumption here is necessarily wrong – only that I cannot prove it), but when I publish I can only work on things that I or somebody else can prove.
And in this story, I can prove that Telegram’s protocol has a very weird, unexpected “feature” that combined with IP address allows anyone with sufficient access to track Telegram users. I can show that this feature is not necessary in such a protocol – other protocols used by other similar tools do not have that issue. And IStories team seem to be able to prove that all Telegram traffic flows through a single infrastructure provider that has ties to the Russian FSB.
That’s all we got currently, but that’s already plenty. Because both of these are decisions made by Telegram, and they strongly reinforce one another.
It just seems like an incompetent implementation.
If that was the only weird technological decision by Telegram with strong consequences for privacy of its users, I could agree.
But as I discuss at length in that blogpost, Telegram has a long, long history of such “incompetence”; they also tend to react badly to anyone pointing this kind of thing out. The
auth_key_idissue has been pointed out years ago and not only is it not fixed, there is no indication that Telegram even considers fixing it.Can you imagine the veritable shitstorm if Signal pulled something like that?
As I wrote in my blogpost, in the end it does not matter if this is incompetence or malice – the end result is exactly the same.
- Comment on Telegram is indistinguishable from an FSB honeypot 6 days ago:
I can only hope neoliberalism dies as soon as possible, it brought us to this sorry moment in time.
So what’s your explanation if Russia follows through on this messenger development?
That would be a first for Russia to actually follow through on and complete anything of consequence, really. Would love to see it.
I don’t “dislike this point”, I have exactly zero emotions about it. I said it “might” be a red herring. It might not. I don’t have a formed opinion on it as I simply don’t know much about it. It might also be a reaction to Durov now cooperating also with “Western” law enforcement, for example. Who knows.
It does not change anything in the story.
Is the scandal just that it isn’t exclusive to the USA?
You seem to be under the impression that anyone who has a problem with the Russian authoritarianism and imperialism must necessarily be a supporter of USA’s authoritarianism and imperialism. I can assure you a lot of people in the world are able to walk and chew gum. And that imperialism’s reach is not measured solely in imperial units.
- Comment on Telegram is indistinguishable from an FSB honeypot 6 days ago:
Signal would be a good replacement for private messages and groups. I’m in groups of hundreds of people there, I’m sure larger groups exist.
As to channels… seriously just set up a simple website with an RSS feed? That’s the simplest. A lot of providers have free DDoS protection now as well. If you’re worried about privacy and whatnot, choose a provider like 1984.is or FlokiNET.
The broader point is: we really need to get people out of centralized platforms and onto less gate-kept spaces. Because with centralized platforms it is always possible they enshittify or turn out to be bad in some important way, and when that happens, the network effects hold us and our audience ransom. Moving back to web is one way of doing that. Joining the Fediverse (hullo!) is another.
And yes, I am waiting for truly decentralized end-to-end encrypted internet messaging tools to become usable enough to replace Signal eventually. One thing I am looking at – and again, it is not ready yet! – is Cwtch. Another thing I am really hopeful for is the Veilid protocol. But these are still ways off from being ready for prime time and widespread non-techie use. One day though!
- Comment on Telegram is indistinguishable from an FSB honeypot 6 days ago:
Do you think that Telegram can continue to be used for this purpose while taking additional security precautions?
No. Their very existence on Telegram is drawing more people to Telegram, and helping keep on Telegram people who might already be thinking of leaving it. Publishing on Telegram helps the FSB spy on more people. In this case, people who are anti-Putin.
In other words, by continuing to use Telegram and thus by drawing more people onto that platform and keeping them there through network effects these organizations are drawing people opposed to Putin;'s regime directly into FSB’s dragnet.
I cannot see this as anything but massively irresponsible.
Or do you think the risk is too great, and no amount of precautions can justify using the service?
In my opinion the only somewhat justifiable way to use their Telegram presence today would be to try and get people who are on Telegram out of Telegram. But that’s a very tall order, and would have to be done thoughtfully, carefully, and with a plan.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
As long as they’re not using Russian-purchased sims to manage and post to the channels, how does this change their security model going forward?
If IStories’ reporting on GNM’s connection to FSB and GNM’s access to Telegram’s traffic is correct – and I have no reason to believe otherwise, this has gone through two rounds of fact-checking and these are people who had been sued for “defamation” in the most journalist-hostile, oligarch-friendly jurisdiction in the world (UK) and have repeatedly won – then this means the threat model now includes the FSB potentially being able to:
- figure out where a user is in the world just by observing their Telegram network traffic, live or close to live;
- with some additional analysis, based on timing and packet sizes correlation, probably figure out who that user is communicating via Telegram.
Both of these globally, regardless of what SIM card was used to register any of accounts involved, and without having to ask Telegram for any data.
I don’t know if FSB is actually using this capability, and to what extent, and against whom. But based on IStories’ reporting and on my own packet captures analysis it is entirely possible for them to do so if they choose to.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
I guess the xAI thing might just be a money grab for Telegram and Durov.
The Russian MPs thing might be a red herring, there’s been plenty of stuff recently aimed at distracting from this Telegram story – including a brand new interview by Tucker Carlson with Durov.
Telegram and Durov knew for weeks this is coming, as the investigative journalists had tor each out for comment. So they had time to prepare their little games.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
Thank you, it is refreshing to see someone honestly and earnestly engaging in a conversation about this. The “Tor is a honeypot” thing is very often an all but religiously held belief.
It would be great to have real analysis knowing which data centers or actors have the biggest control of exit nodes. If there’s really a way to de-anonimyze any traffic from there.
To truly and reliably de-anonymize Tor traffic, one would need to run over 51% of all Tor nodes. Since the US is not the only entity potentially interested in that (Russia and China might be as well), unless these entities coordinate and share data, they will thwart one another from reaching that kind of saturation.
Since we are on the topic, another concern regarding Tor network is the possibility of correlation attacks.
It might be possible to somewhat fuzzily reason about Tor users by observing traffic on both sides of the tunnel, using timing and packet sizes for analysis. But a). it is going to be very fuzzy; b). it requires global network observation capability. NSA might or might not have that to some extent, but they would not risk exposing that for anything but the most valuable targets.
I’d rather just stay away from it entirely and use a VPN for my privacy when searching media and stuff.
VPNs are a specific tool for a specific thing, they don’t “preserve privacy” in the general sense. You are basically trading ISP’s or local spooks’ ability to observe your traffic for VPN’s operator’s and the local spooks’ there ability to do so. In some cases it makes sense, in some – not so much.
Depends on your threat model.™
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
It’s trivial for a nation state, they have lists of these groups. These groups are promoted in other groups and other channels and other forums and eventually reach somebody who will make a note of them.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
There were reports (claims I suppose) that the fsb were using telegram to organise the stochastic gig job sabotage across Europe
No no, reports: www.msn.com/en-in/news/world/…/ar-AA1xshqO
Does what has been found here shed any more light on that?
Not really/not directly, I would say. What you are describing is FSB using Telegram for recruitment. That does not require network-level observability and surveillance. That’s a different “feature”, so to speak.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
I hate it when I don’t know an acronym, but this one is particularly hurtful to my brain since everyone is saying “yeah, that link to the FSB was obvious glad someone demonstrated it.” So… I will just assume FSB=KGB and be done.
Russian FSB is the successor of the Soviet KGB, so yeah, that works.
Take for example Tor network (high number of exit nodes are controlled)
I substantiated my claims about Telegram by a pretty deep technical analysis. Mind at least providing a link for your pretty strong claim about Tor?
Except those apps or protocols that are truly decentralized (e.g. OMEMO in XMPP), these are good.
Nope. Decentralization is important from power dynamics standpoint, but can actually be detrimental to information security due to (among others) metadata and complexity.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
After reading the article, my understanding is that what was sent in “private chat” was in fact encrypted (for the most part) and can be considered secured (to the degree - something is off and, maybe we didn’t find out yet, how the encryption is compromised).
“Secret Chats”, but otherwise spot-on, yes.
I am making a point of clarifying here because Telegram thrives on ambiguity. “Private chat” might mean anything in that system. “Secret Chat” is a specific feature that almost nobody uses but gives Telegram cover to claim they do end-to-end encryption.
But it would wise to treat all other conversations as something that is compromised. Is this a fair summary?
Yes, that’s what I would say.
Telegram has access to everything that is not a “Secret Chat”. They are responding to data requests. It’s unclear what they include in these responses. They are also linked to FSB, through the same Vedeneev guy that owned GNM (the infrastructure provider).
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
Thank you, that means a lot. For people working in information security it really feels sometimes that a). a lot of stuff is obvious, b). people just don’t listen and don’t care.
Your comment shows how incorrect this is. That really helps keep motivated.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
For the internet messenger functionality that would be Signal.
For other things (channels, mostly), anything that does not pretend to be end-to-end encrypted when it is not. A website with an RSS feed would be one trivial choice for channels that are open to anyone. Public communication like that has no business going through “platforms”.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
Thank you!
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
Also, AMA I guess.
- Comment on Telegram is indistinguishable from an FSB honeypot 1 week ago:
I know, right? That’s why investigative journalism is such a thankless, frustrating job. You need to prove beyond any doubt things that are often pretty obviously true.
Roman Anin and the rest of the IStories team did an absolutely amazing job. Found court documents going years back. Dug up signed statements and contracts. They did something nobody in the infosec community seemed to have done: actually looked at the IP addresses used by Telegram and followed that lead to its logical conclusion. And then published all of the receipts!
And still people will say this is “unsubstantiated” or find other ways to wave this off.
- Submitted 1 week ago to technology@beehaw.org | 40 comments
- Comment on Why do AI company logos look like buttholes? 2 months ago:
“Penis swastika” is spot on.
- Submitted 2 months ago to technology@beehaw.org | 34 comments
- Comment on Eight years on, Mastodon stubbornly survives 2 months ago:
Sure thing, enjoy!
- Comment on Eight years on, Mastodon stubbornly survives 2 months ago:
ohno, it’s out!
- Comment on Eight years on, Mastodon stubbornly survives 2 months ago:
Yeah. Thankfully, Fediverse is a bunch of independent projects. There are Pleroma, different Misskey forks, Lemmy, kbin, Pixelfed, Loops, GoToSocial, and dozens more.
Mastodon is still probably the biggest, user-count-wise, but if Mastodon does a real stupid, there’s going to be a fork that takes over the mindshare and the instances. This happened with OpenOffice → LibreOffice when the former got taken over by Oracle; this happened with XFree86 → X.org. This happened with ownCloud → Nextcloud.
And there are projects like FediPact, explicitly opposed to having anything to do with Meta on an instance level.
- Comment on Eight years on, Mastodon stubbornly survives 2 months ago:
Yup. Up until roughly the times of early Twitter, federated, decentralized communication systems were the obvious norm to any engineer designing one.
Twitter was even meant to be federated and decentralized. I had interviewed one of their first engineers (this piece is about BlueSky, and in Polish; the Twitter thing is important background), who was there and working on that in the very early days. They had a proof of concept. But then the VCs got involved and the decision was that it would be harder to make money on a decentralized service. Rest is history.
- Comment on Eight years on, Mastodon stubbornly survives 2 months ago:
Facebook is trying with Threads. Threads is directly targeting Fedi. Thankfully, it does not seem to be working the way Meta wanted it to work – that is, to start sucking people in from fedi due to sheer size and presumably better UI. Turns out people who had moved to fedi really hate Meta, who’da thunk it.
- Comment on Eight years on, Mastodon stubbornly survives 2 months ago:
Aww, thank you!
- Comment on Eight years on, Mastodon stubbornly survives 2 months ago:
Yeah, I had an account on identi.ca. I even wrote about this: rys.io/en/168.html
- Submitted 2 months ago to technology@beehaw.org | 25 comments
- Comment on The Trump Administration Accidentally Texted Me Its War Plans 2 months ago:
Transparency though. 🫠
- Submitted 2 months ago to technology@beehaw.org | 29 comments
- Comment on Happy John Mastodon day to all who celebrate! 5 months ago:
thanks, I should have provided that link.