oss-sec mailing list archives
Re: Telegram privacy fails again.
From: notspam () mm st
Date: Thu, 12 Sep 2019 18:29:22 -0400
IMO, If Whatsapp/Telegram wanted to take this functionality more seriously, they'd need to be writing the images to disk in an encrypted form from the outset. It increases the overhead of display, and wouldn't necessarily stop forensic recovery etc, but it would mean that other apps couldn't simply watch the directory and upload anything which appears in it in a usable form. That's a whole other can of worms though as it's another set of keys to manage.
There's no way to take this functionality seriously - the feature is a joke. A privacy feature centered around trusting another user's node to delete a file you already sent them is silly. Unfortunately, it seems like nobody gets this; even Matrix clients are supposed to have message redaction soon. The original email didn't contain a security vulnerability (remember the name of this list?) - it was blogspam. It didn't belong here for the same reason that you don't see Snapchat bugs on this list.
Current thread:
- Telegram privacy fails again. Dhiraj Mishra (Sep 09)
- Re: Telegram privacy fails again. Ilya Matveychikov (Sep 10)
- Re: Telegram privacy fails again. Solar Designer (Sep 12)
- Re: Telegram privacy fails again. Ben Tasker (Sep 12)
- Re: Telegram privacy fails again. notspam (Sep 13)
- Re: Telegram privacy fails again. Stuart Henderson (Sep 13)
- Re: Telegram privacy fails again. Jiri 'Ghormoon' Novak (Sep 16)
- Re: Telegram privacy fails again. notspam (Sep 16)
- Re: Telegram privacy fails again. Ben Tasker (Sep 12)