[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190913112045.GI43354@symphytum.spacehopper.org>
Date: Fri, 13 Sep 2019 12:20:45 +0100
From: Stuart Henderson <stu@...cehopper.org>
To: oss-security@...ts.openwall.com
Subject: Re: Telegram privacy fails again.
On 2019/09/12 18:29, notspam@...st wrote:
> > IMO, If Whatsapp/Telegram wanted to take this functionality more seriously,
> > they'd need to be writing the images to disk in an encrypted form from the
> > outset. It increases the overhead of display, and wouldn't necessarily stop
> > forensic recovery etc, but it would mean that other apps couldn't simply
> > watch the directory and upload anything which appears in it in a usable
> > form. That's a whole other can of worms though as it's another set of keys
> > to manage.
>
> There's no way to take this functionality seriously - the feature is a
> joke. A privacy feature centered around trusting another user's
> node to delete a file you already sent them is silly. Unfortunately,
> it seems like nobody gets this; even Matrix clients are supposed to
> have message redaction soon.
It is still a useful feature as long as you don't consider it "secure".
> The original email didn't contain a security vulnerability (remember
> the name of this list?) - it was blogspam. It didn't belong here for
> the same reason that you don't see Snapchat bugs on this list.
If a user of the software took the "delete" claim at face value then it
could be considered security related .. and unlike Snapchat, the Telegram
client *is* open source.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
