Tag Info

Hot answers tagged

30

I'd like to ignore the comparison to WhatsApp because WhatsApp does not advertise itself as a "secure" messaging option. I'd like to instead focus on whether Telegram is secure. Telegram's security is built around their home spun MTProto protocol. We all know that the first rule of Cryptography is Don't Roll Your Own Crypto. Especially if you aren't trained ...


18

Some random thoughts... Pidgin provides a lot of security features and support a lot of sec protocols and it provides strong encryption. It is Free and Open Source. Features include Automatically creates a public/private key pair for you upon loading the plugin. Automatically transmits your public key to other users. Supports 512 - 4096 bit keys. Saves ...


18

At the annual IEEE Security & Privacy conference in 2011, White et al. presented some very involved research on reconstructing encrypted VoIP sessions. The image below shows the overall architecture of the authors' approach. Although it works only for variable bitrate codecs (most common VoIP codecs are constant bitrate, e.g. G.711), the results are ...


13

This is incomplete. But hopefully of some use. http://imfreedom.org/wiki/IMessage and https://github.com/meeee/pushproxy (especially the docs section) have done some reverse engineering of apple's proprietary protocol. Seems that every apple device has a SSL/TLS client-side cert for authentication that setup to be known to apple's push server. This is ...


12

Questions I would ask myself before using skype for sending sensitive information: Is the encryption truly end-user to end-user or is the data only encrypted between the user and Skype (thereby potentially giving Skype access)? How are IM logs managed? Can you be sure that you have 'deleted' the password from the log? Even if logs are not being stored to ...


9

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...


8

This question is hard to answer without knowledge of who and what you wish to be secure from. Does "practically secure" mean you are unlikely to be eavesdropped? If it does, then Skype (for example) is a good choice, due to it's encryption. Which country are you in? Some countries have 'lawful intercept' laws which require that authorised law enforcement ...


8

"A password" is not enough information to determine how it needs to be protected. What resources does the password grant access to, and what level of access? Skype uses reasonably strong encryption on voice communication--we think. It's closed-source, so what we know comes from documentation and protocol reversing. You can't look at their source code to ...


7

Public key cryptography can, in this case, be used to facilitate setting up a secure channel in which to transmit a symmetric key. Once the secure channel has been set up, it is not necessary to continue to encrypt and decrypt using the public/private keys. Instead, generate a symmetric key and use that to encrypt the traffic. You only have to distribute ...


7

As the Telegram FAQ mentions, there is a 'secret chat' option that does not store chats on their servers. As for the underlying question of, "does storing chats lower their security?" then that is something to consider. Chats being stored on the server does mean that copies can be made on the server for decryption later. This increases the exposure of the ...


5

There have been several suggestions that skype is indeed backdoored and evesdroppable. If your concerned about it because Microsoft is now the owner, there are plenty of other alternatives to Skype which I would suggest as the easiest and cleanest solution (besides, if MS is your competitor, why would you buy their services). Some of the alternatives like ...


5

In the Skype protocol there are also "proxy nodes" that relay traffic for you. Every Skype client can in fact become such a proxy node if the network reachability is good, especially in regard to firewall conditions. So you can't be sure if the peer IP address you are seeing is the one of your call partner or of a random proxy node. In the latter case you ...


5

Avaya have a quick checklist here which is a two page list which is broadly vendor neutral. Key first steps include: H.235.5 for H.323 signaling encryption SRTP* for H.323 / SIP media encryption (10 bytes overhead per packet) Standalone AES encryption can also be used for H.323 media encryption TLS for SIP signaling encryption SRTP for voicemail ...


5

I will compare Telegram and Whatsapp in 3 aspects: Storage of messages, encryption, and zero-day vurnerabitiles. In fact I will be comparing 3 technologies: Telegram's regular chats (which I will refer to as "normal chats", or simply "chats"), Telegram's secret chats, and Whatsapp. 1. Storage Let us assume that both Whatsapp and Telegram completely adhere ...


5

This depends on model you use for group chat: Peer-to-peer: You need to encrypt each message with the recipient's puiblic key and send it to each user separately, and create the "illusion" of a group chat. This will prevent new group joiners to see previous messages. Client-Server: You upload the messages "signed" to the server, and encrypt them to each ...


4

Is it possible for the ISP or any middle point? If you meant is it possible for the ISP/middle point to decipher/decode/snoop on your chat, then the answer is yes. For unencrypted voice transports, all you need is a wireshark plugin to reconstruct the chat out of the pcap files. Check out http://www.panoramisk.com/151/analyzing-voip-with-wireshark/en/ ...


4

http://www.cypherpunks.ca/otr/ is a plugin for several clients. I've used it with Adium on OS X and with Pidgin on Windows. It also works with Pidgin on Linux. The greatest part of this is that it is protocol independent -- you can use it to secure conversations on Google Chat, Jabber, AIM, etc.


4

Here is what I know: AIM/.Mac/ICQ (Oscar): supports optional SSL for client-server encryption. Jabber/GoogleTalk (XMPP): supports optional SSL for client-server encryption. Supports PGP. On these and other networks (MSN, Yahoo, GaduGadu), you should be able to use OTR messaging which provides simple, easy to use encryption. Both parties must have the OTR ...


4

That Skype might be backdoored has long been a concern. See link below. https://ultraparanoid.wordpress.com/2007/06/19/why-skype-is-evil/ I also noted in a past review I did that the official, independent crypto review and the description gained by a reverse engineering team differed significantly. The latter had design flaws and working exploits. Also, ...


3

You're misinterpreting the categorization. **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]** [Message: HTTP/1.1 200 OK\r\n] [Severity level: Chat] Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...


3

I'm probably not very cool and don't use any of those currently but how about jabber / XMPP? This thread from 2009 seems to cover some of the differences and features with a healthy focus on security.


3

Skype sends information among 3rd party client nodes with a closed protocol. It makes no warranties about the security of its connection. I would suggest using something like OTR on top of your instant messaging medium. Beyond that, the usual, "is there enough risk to warrant concern" rule applies. Maybe it just isn't worth addressing in your case.


3

If you like to chat in a secure way: Use any XMPP service (e.g. jabber) and overlay them with OTR. A List of supported programs can also be found on the wikipedia. Videochatting is not supported...


3

As far as I understand, SMP does not protect against MitM per se. The paper's authors clearly state, Suppose that Alice and Bob are chatting online using OTR and decide to run the SMP, but have not previously selected a secret and possess no channel more secure than their current conversation. They can still select an appropriate secret in this ...


3

Most pages are in Japanese, but they do have a nice blog with the occasional english page. Altho this one isn't about security specific, it does talk about how they send messages http://tech.naver.jp


3

The objective of Diffie-Helmann (I guess they authenticate DH somehow) is only key distribution. The objective of MTProto is encryption. Diffie-Helmann feeds MTProto with keys lets say. It is in a higher level. Although MTProto is 'broken', secure key establishment still takes place. So DH effectively does not fail in its purpose (key distribution). ...


2

Run a jabber server and tell them to use pidgin with OTR


2

The most efficient way is to have client's exchange their RSA public keys and then generate random "session keys" to use for conversations with each other. This avoids multiple encryption and doesn't require the server to be able to decrypt the data. So if Jack is going to talk to Jill and Seth, Jack generates a random encryption key to use to talk to Jill ...


2

I stumbled on this today. https://project.crypto.cat/ It looks like a pretty good alternative for those that are security minded.


2

It is definitely possible to eavesdropp a voice conversation which goes over VoIP. However there are some programs like Skype that encrypt the voice data which makes it difficult and only difficult to tap into but not impossible. It depends on how well-equipped is the eavesdropper and how keen he is. If it is a government then I can make sure that it can, ...



Only top voted, non community-wiki answers of a minimum length are eligible