Telegram App Says Apple Is Blocking Updates Over Dispute with Russia
I&#x27;d given this challenge some thought in the recent past, specifically the challenge that the big app store owners are each generally susceptible to coercion by large nation-state actors in spite of being multinationally distributed.<p>There was a project I was involved in rather heavily (cyph &#x2F;&#x2F; resulted in a pair of neat conference talks) where we&#x27;d accounted for the risks of apps being banned by making the entire application operate exclusively in a web context. To at least somewhat mitigate the related risks stemming from having to trust the cryptographic logic delivered by a web server every time you use the service, trust-on-first-use was achieved by mangling the living daylights out of HPKP in tandem with service workers in order to persist barebones codesigning logic used for validating cryptographic packages delivered from the web service. Alas...<p>All of this is to say that there have been multiple parties involved in addressing this challenge, each one thinking from novel angles in an effort to mitigate the risks posed by the threat of sanctions against secure messaging. As it stands, it appears there&#x27;s now a rather glaring weakness: if a nation-state decides as much, they can just twist the arms of the walled gardens supporting your secure messaging client in order to:<p>1) deny access generally, reducing or eliminating the growth of the target space and improving target acquisition,<p>2) persist known vulnerabilities just long enough to exploit against a target.<p>Telegram has been criticized again and again for their security hygiene and for their architectural decisions. Signal&#x27;s seen some of that heat quite recently, and I raise both of these because they speak pretty strongly to the bullets above: there&#x27;s a chance we&#x27;re seeing a live demonstration by a preeminent world power against one of the few tools dissidents are using to <i>literally</i> stay alive.<p>If this demonstration succeeds without any sort of significant blowback (in the form of corporate or popular resistance or some other subversion or mitigation of the attack), there&#x27;s nothing to stop any other major <i>party</i> from trying it, regardless of whether they&#x27;re a nation-state.<p>---<p>Anyway, I&#x27;m keen on a deeper discussion here. Maybe the tinfoil hat&#x27;s been a bit corrosive to my brain; counter-arguments are welcomed.