Hot answers tagged

136

TL;DR: No, Telegram is not secure. I'd like to ignore the comparison to WhatsApp because WhatsApp does not advertise itself as a "secure" messaging option. I'd like to instead focus on whether Telegram is secure. Telegram's security is built around their home spun MTProto protocol. We all know that the first rule of Cryptography is Don't Roll Your Own ...


67

TLDR: There are several categories of security you must consider when looking for a phone. The main advice, though, is to get a newer phone with the latest security features, and from a manufacturer that has a good reputation of providing updates. Security against other people (peers, police/government) Summary: Look for newer devices with full disk ...


66

By just passing (potentially malicious) traffic through, it is very unlikely. After all, routers on the Internet are relaying tons of malicious traffic everyday without getting compromised themselves. However the danger begins when your computer itself gets compromised from a malicious file downloaded via torrents, and from there the malware on your ...


59

One of the key aspects to consider for this is the support/patching policy of your mobile device vendor. If you're planning to keep the phone for say 2-3 years you don't want it to go out of support after 18 months. Unfortunately this can be quite tricky information to come across with many vendors not providing published support lifecycles. Also ...


51

I will compare Telegram and Whatsapp in 3 aspects: Storage of messages, encryption, and zero-day vurnerabitiles. In fact I will be comparing 3 technologies: Telegram's regular chats (which I will refer to as "normal chats", or simply "chats"), Telegram's secret chats, and Whatsapp. 0. The fast answer "end-to-end encrypted, needs more peer review" ...


42

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger in the hope to offload some malware onto a smartphone plugged into that port. However, such a device would need to be highly specialized and specifically ...


36

The other answers regarding encryption are great. I'm going to approach this question from the tinfoil / dissident angle, as I believe it's valid for nearly every scenario... but I still want to explain my reasoning, and how I came to these conclusions. All of the problems I'll discuss are routinely exploited by criminals, and repressive governments. In ...


31

When your phone is acting as a hotspot it's basically just a router connecting two protocols together (802.11 and either LTE or GSM). It's not actually interpreting any of the data passing though, as that would use a lot more CPU and memory. It's literally just passing data back and forth at OSI Layers 2 and 3. That said, it's no different than other ...


31

Data dealers often buy data from multiple sources and aggregate it to generate an all-compassing user-profile from it. For example: xyz company sold your telephone number and what the conversation was about. social network which asks for your phone number for password recovery sold your telephone number and your ip address at some point in time. ...


21

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in ...


20

Yes, it's possible. A malware can simply utilize the SMS functionality in your phone to transmit formatted data from and to your phone. Heck, it might even use DTMF. Update: After your edits, your question turned from acceptable to really bad. In any case, the most plausible scenario here is via Bluetooth. However, I think you're just very paranoid and/or ...


20

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and ...


20

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (medium to high) Password (high) From personal experience, the face unlock is kind of hard. You have to train it, and then you have to stick your face in the right ...


17

Trying to avoid recommendations, to keep your phone safe an secure I will break it down into 3 levels: Applications When looking for applications to place on your phone you need to look at the permissions they ask for and ask yourself, Does this chess game really need access to my contacts, bluetooth and internet? NO it does not, an app to me is suspicious ...


14

You don't mention what sort of service it's for, but as a user the least irritating auth method on phones for me is SSO. I'm already signed into Google & Facebook anyway, so typically it's just a case of pressing "Yes" and we're all done.


12

There are other two options that come to mind: text messages caching of information Text messages was shown by Georgia Weidman back in 2011. The botnet comms ran through SMS. So you can imagine it can be quite easy to spread information by SMS. The other option would be to store the information you used and upload it the next time you have an internet ...


12

As the Telegram FAQ mentions, there is a 'secret chat' option that does not store chats on their servers. As for the underlying question of, "does storing chats lower their security?" then that is something to consider. Chats being stored on the server does mean that copies can be made on the server for decryption later. This increases the exposure of the ...


12

You're trying to take away communications capabilities from a tool designed to communicate. It's probably not the best choice of devices. You can start by setting the phone into "airplane mode", which is intended to shut off the radios. Because of the way RF works, that means it shuts off both transmitting and receiving. It should keep you safe, but of ...


11

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


11

The whole discussion of privacy issues today has turned to matters of profiling and patterns, think, prediction. Prediction is the big thing these days. "You might also be interested in xyz..." This is because others who did searches on abc and Wxyz ALSO were interested in xyz, and you also looked for some of these terms, you get classified as a target for ...


9

You've already done enough research to see that facial recognition on android is easily circumvented. I've read (although I cannot find the link now) that researchers were able to defeat it by using picture of a similar looking person, not even the actual person. When you think about it expecting facial recognition to work on a device with limited resources, ...


9

Not really. The torrent data just flows through the phone, it does not analyze or execute the data except what is necessary to forward it to the PC. Also, remember that torrent does not always mean malware.


8

If your roommate got access to your phone once to install spyware, what's to stop him finding another opportunity to read the cached results of the surveillance? Who needs a data connection?


7

Whilst I don't believe that there's a definitive confirmation that this is the situation, I'd suggest that the problem with android likely comes down to a conflict of interests between the carrier, handset manufacturer and OS manufacturer. It's in Googles interests that handsets are upgraded regularly, as it improves peoples perception of the OS and makes ...


7

This is a really broad question that does not have a single answer. Some categories of challenges and risks include: Reduced control. The corporation has to take whatever devices the employees select, and loses control over them. The corporation may also have reduced leverage to control the software on those devices. Dependence. The corporation becomes ...


7

I will have to vehemently disagree with the comment that "your mobile phone is more secure against malware". This is a dangerous and very wrong statement of the state of mobile phone "security" - and if it is based on anything, it is based on inappropriately interpreting currently skewed statistics. As a security enthusiast and a developer on mobile phone ...


6

Yes, the "phone" itself is an application. It can be hijacked or replaced entirely. In fact, Android handsets are DESIGNED to do this so that you can automatically use a VOIP provider when making phone calls if you so desire. Malware with complete device control could simply place itself as such a service and when you dialed a call, it would be connected ...


6

A piece of mobile phone malware could be designed to use any communications technology the mobile can access. If a phone doesn't have internet access it could send texts for example. There are considerations with each connection method: Internet access: this is pretty cheap or free for the malware to use, as long as the malware is not too greedy it is ...


6

You must define "transmitting". There are two categories; active and passive. Active transmissions require relatively large amounts of power to actually send out data whereas passive transmissions require little to no added power and could represent a NFC transmission such as an RFID chip being read by a scanner. There are also some theoretical ...


6

It is possible, even without a hacker's technical skills but with a bit of planning ahead. Multiple apps allow you to remotely control your own phone, which implies that you must install them yourself to your phone. Let's call your client Alice and her husband Bob. Let's assume Alice owns an Android. It's fair to assume that Bob knows the PIN/gesture to ...



Only top voted, non community-wiki answers of a minimum length are eligible