[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d1f53010-1e58-c4f5-7a91-e8fa3402f984@gmail.com>
Date: Mon, 16 Sep 2019 14:34:19 +0200
From: Jiri 'Ghormoon' Novak <ghormoon@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Telegram privacy fails again.
Honestly, the biggest issue with that feature is that by default, the
checkbox is not ticked and if you delete it accidentally for yourself
first, you won't ever remove it for the other person.
Regarding the average user thinking the feature is secure, how would you
think it should be done? rephrase it to "try to delete" or what?
Gh.
On 9/13/19 1:20 PM, Stuart Henderson wrote:
> On 2019/09/12 18:29, notspam@...st wrote:
>>> IMO, If Whatsapp/Telegram wanted to take this functionality more seriously,
>>> they'd need to be writing the images to disk in an encrypted form from the
>>> outset. It increases the overhead of display, and wouldn't necessarily stop
>>> forensic recovery etc, but it would mean that other apps couldn't simply
>>> watch the directory and upload anything which appears in it in a usable
>>> form. That's a whole other can of worms though as it's another set of keys
>>> to manage.
>> There's no way to take this functionality seriously - the feature is a
>> joke. A privacy feature centered around trusting another user's
>> node to delete a file you already sent them is silly. Unfortunately,
>> it seems like nobody gets this; even Matrix clients are supposed to
>> have message redaction soon.
> It is still a useful feature as long as you don't consider it "secure".
>
>> The original email didn't contain a security vulnerability (remember
>> the name of this list?) - it was blogspam. It didn't belong here for
>> the same reason that you don't see Snapchat bugs on this list.
> If a user of the software took the "delete" claim at face value then it
> could be considered security related .. and unlike Snapchat, the Telegram
> client *is* open source.
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
