Russian roulette

Image from Pixabay

Sometimes you catch a news item on the radio that makes you think, “Huh? I must have misheard that.” Like the report that Pavel Durov is leaving his fortune to all of his onehundred children.

The man turns out to have two 'real' children; for the remaining 104, he was only involved as a sperm donor. Fortunately, those children need not fear missing out, even with that many half-siblings. Each of them can expect over 160 million dollars, based on their father/donor’s current bank balance. They’ll probably have to wait a while, though, as Durov is only forty and very much alive. His name appears on impressive lists: the 120th richest person in the world, the richest expat in the United Arab Emirates, the most powerful entrepreneur in Dubai—those kinds of things.

Durov’s portfolio includes no fewer than four passports: he is a citizen of Russia (born in the Soviet Union), Saint Kitts and Nevis (islands in the Caribbean Sea where he supported the sugar industry with a quarter million dollars), the United Arab Emirates, and France. According to Paul du Rove, as he calls himself in that country, the application for the latter passport was an April Fool’s joke that was accidentally approved via a special procedure. But it did make him an EU citizen as well.

All these facts (and many more) can also be found on Wikipedia, but why am I bringing them up here? Because Pavel Valeryevich Durov is also the spiritual father and founder of Telegram, the messaging service akin to WhatsApp and Signal. And Telegram is not exactly a service beloved by security and privacy experts. I’ll explain why. Keep in mind that the term cryptography, as used here, has nothing to do with cryptocurrencies like Bitcoin.

When you exchange messages with someone, you generally don’t want others—people, companies, or governments—to be able to read along. That’s why messages are encrypted. This encryption ensures that only you and your conversation partner can read the messages, because only you two have the corresponding keys (this is called end-to-end encryption). The mechanism that handles the encryption is called a cryptographic protocol, which in turn uses cryptographic algorithms. Typically, internationally recognized standards are used, which have been extensively reviewed by many different experts. That makes them reliable. At Telegram, they thought it better to create their own crypto protocol. In cryptography, that’s considered a cardinal sin, because it’s likely you’ll overlook your own mistakes. Their protocol is also not fully public, making it difficult to scrutinize. Moreover, encryption is not enabled by default. With other messaging apps, it is.

Telegram and its founders have a turbulent history. Durov left Russia after disputes over his previous company, VKontakte (the Russian Facebook). In short: he had refused to hand over personal information about protesters to the authorities. In 2014, he left Russia and founded Telegram. According to Durov, Telegram turned a profit for the first time ten years later, with revenues exceeding one billion dollars. How Telegram was funded in the meantime remains unclear.

Despite the disputes in Russia, we don’t know whether backdoors have been built into Telegram. From what I can tell, Durov has a decent track record of resisting grasping authorities. On the global stage of espionage, however, you can never be sure whether that’s just for show and whether deals have been made behind the scenes. The platform is popular among criminals for conducting business, perhaps because Durov and co. don’t stand in their way. In this context, France arrested him last year (and released him on bail). In any case, the lack of transparency and, frankly, the Russian roots make Telegram a platform I strongly advise against using. Use Signal instead—it has a strong reputation in both cryptography and privacy. That said, it’s an American product and thus subject to U.S. law, which gives law enforcement various powers to demand data. However, they can only hand over data they have; the content of your messages is end-to-end encrypted and therefore reasonably safe. WhatsApp works the same way but has a poorer reputation for privacy because it monetizes your profile and behavior.

Even if you have a hundred children and an above-average bank balance, that doesn’t make you a diligent father. I see too many red flags to trust Durov and his Telegram.

And in the big bad world…

• Even the U.S. House of Representatives has banned WhatsApp.
• The continent of the Nigerian prince is now suffering from cybercrime itself.
• AI manipulation is sometimes difficult to detect even for experts.
• Iran has blocked its internet access to protect the country from cyberattacks, according to Iran.
• Iran has already lost tens of millions in cryptocurrency to hackers.
• Hacked airlines are always quick to report that flight safety has not been compromised.
• Even printers can be vulnerable.
• Some servers are even vulnerable when turned off.
• The UK’s NCSC promotes the use of password managers and especially passkeys.

 

How do you chat?

 

Image from Pixabay

“WhatsApp and Telegram, should I do something with those?” a colleague asked. My answer was as clear as a brook in the Alps: "Do not use for business."

Why do I have such a strong opinion about that? Because I've researched it, based on the question: from a security and privacy perspective, which instant messaging apps are best for business use, and which ones should you ignore? Security is essentially about whether the app uses solid encryption so that no one can read along – not even the messaging provider itself. Privacy is about the trust you can have in the way the provider handles user and traffic data. The latter is about who has contact with whom and when.

It is also interesting to look at the revenue model. An old saying goes: if something is free, you are the product. In other words: you pay by providing your details, such as name, e-mail address and date of birth, which the provider can, for example, sell to advertising companies.

The content of your messages is safe with WhatsApp. They are reliably encrypted and the keys are only on the user's device; WhatsApp itself cannot read it and they can’t honour requests of investigation and intelligence services. But WhatsApp does fall short when it comes to privacy. The app comes to you from Meta, the advertising company of which Facebook is also a part. It is well known that Meta makes its money by using your data cleverly (that's why I call it an advertising company). If you don't like the idea – as an individual or as an organization – then you should not use WhatsApp.

Telegram is worse. That app is of Russian origin, although the company no longer lives there. They always move if the ICT regulations in the country of residence do not suit them. They are currently based in Dubai, although the company is legally based in the US and UK. The revenue model is vague: the founder says he has invested his own savings, and money has subsequently been raised from various investors. A more important point of criticism relates to security: it is turned off by default, and when you turn it on, you use a cryptographic protocol developed by Telegram itself, which most information security officers turn up their noses at, because it can’t be community tested. In addition, Telegram holds the key that encrypts messages, and the company can read messages or allow others to read them. Group chats can't be encrypted at all.

Are you shocked? Fortunately, there are also chat apps available that can withstand scrutiny fairly well. Within Dutch central government, we can use Webex, which we also use for online meetings. This app from the American company Cisco is hosted for us in Amsterdam, which is convenient for privacy. The privacy and security aspects have been extensively researched and approved.

If you look at publicly available chat apps, there are two that stand out positively: Threema and Signal. The Swiss company Threema prides itself on the possibility to remain anonymous and to comply with the GDPR, and message encryption is also very good. All this comes with a price tag: from a small one-time fee for consumers to a monthly fee per device for business licenses. This makes Signal interesting: it is free and yet not commercial, because the app is financed by donations. Leading cryptographers and privacy advocates prefer Signal, which gives me confidence that both security and privacy are top notch.

A while ago I noticed a team manager turn white when I asked him if his team uses Telegram (I'd heard something like that). He was genuinely shocked when he realized that this wasn't such a good choice. His team quickly switched to Signal after that. Many other teams have already made the switch. Who follows?

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• your iPhone will soon have extreme capabilities to protect you against highly targeted attacks.
• Ukrainian police arrested a gang posing as the EU. [DUTCH]
• ransomware and state actors are the most important digital threats for the Netherlands. [DUTCH]
• Police records of a billion Chinese are on the street because an official accidentally entered his password in a blog and a criminal noticed it.
• criminals conduct online job interviews using deepfake technology.
• the municipality of Buren has released the report on the malware attack on the municipality for publication. [DUTCH]
• Maastricht University is making an additional three hundred thousand euros thanks to the high-profile ransomware attack from 2019. [DUTCH]
• Mikko Hypponen talks about the cyber war in Ukraine.
• the Dutch House of Representatives wants the cabinet to continue to support end-to-end encryption. [DUTCH]
• the Dutch cabinet will increase the cyber resilience of SMEs. [DUTCH]
• Customs in the Netherlands deletes the citizen service number from the EORI number. [DUTCH]
• NIST chose four quantum-resistant cryptographic algorithms.