Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#141

Post by benhurmarcel »

majormajor wrote: post #78
llimos wrote: post #72

Earlier quoted context omitted.

In a way, yes, Telegram is even less secure than WhatsApp for this. The way I've been presenting it to people is that Telegram can look at more data than WhatsApp can. But WhatsApp will use the data they have more than Telegram will. That's the tradeoff. And yes, obviously Signal is more secure than both of them but I've been steering non-techies to Telegram because of usability, backups, cross-device history etc. As…

> The way I've been presenting it to people is that Telegram can look at more data than WhatsApp can. But WhatsApp will use the data they have more than Telegram will. That's the tradeoff. I think you should look at the odds of that "can" turning into a "will" over time. After an acquisition, or a change in business fortunes, or a change in leadership...

It will happen. So far Telegram has developed without consideration for revenue, but it cannot last too long.

According to his own numbers [1], Durov's entire net worth [2] can only sustain Telegram for about a decade.

[1] https://t.me/s/durov/142 [2] https://www.forbes.com/profile/pavel-durov/

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#142

Post by _rohan »

ajsharp wrote: post #140

There's a lot about Signal in particular that they get right. AFAIK: (1) All Signal messaging is E2EE; (2) they don't store messages on their servers; (3) the client code is open source, and it seems like a good portion of the server code is open source. Where I think Signal could go further on being the most secure, useful, and privacy-conscious messaging app/company in the world: 1. Open source ALL of the server co…

It's cool that Signal is open source, that's a big source of confidence for me. Is there some way for me to verify that the app in the app store is actually built from the OSS code on github?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#144

Post by joshxyz »

md_ wrote: post #110
joshxyz wrote: post #108

Earlier quoted context omitted.

What I don't get is people are trusting unverifiable builds of Signal, Telegram, WhatsApp, etc as "secure" on each of their E2EE implementations when that part of the binaries we install on our phones isn't even verifiable by code and compilable by ourselves. But what I do like about Telegram is their good user experience and Bot API developer experience. It's soooooooooo fucking good I'm telling you. It just works,…

Signal does have reproducible builds: https://signal.org/blog/reproducible-android/

Sir that's a big Today I Learned. Thank you.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#145

Post by bentcorner »

Tenoke wrote: post #135
geraltofrivia wrote: post #76

Earlier quoted context omitted.

I’ve been using Mullvad since the past few years and I’ve no complaints. The fact that the recent Mozilla VPN is based on Mullvad makes me more confident in my decision.

Do you get decent speeds from Mullvad? Friends were reporting that they moved back to PIA due to worse speeds on Mullvad. That and the lack of a chrome extension (which is occasionally useful) has prevented me from switching away from PIA even if I'm unhappy about being in business with Karpeles and Kape.

I just fired it up and connected to an endpoint in my city, I have a 600mps download pipe and hit 150mbps with default settings and about 275mbps with wireguard selected in the mullvad app. Switching to TCP in the mullvad app didn't change my result enough to notice.

I didn't try other servers/cities to get more information.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#146

Post by cschmidt »

While not directly about data storage, I loved this tweet [1] from Edward Snowdon this week:

> do we really trust signal? cause i see zero reason to.

Here's a reason: I use it every day and I'm not dead yet.

[1] https://twitter.com/Snowden/status/1347217810368442368?s=20

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#147

Post by Smaug123 »

_rohan wrote: post #142
ajsharp wrote: post #140

There's a lot about Signal in particular that they get right. AFAIK: (1) All Signal messaging is E2EE; (2) they don't store messages on their servers; (3) the client code is open source, and it seems like a good portion of the server code is open source. Where I think Signal could go further on being the most secure, useful, and privacy-conscious messaging app/company in the world: 1. Open source ALL of the server co…

It's cool that Signal is open source, that's a big source of confidence for me. Is there some way for me to verify that the app in the app store is actually built from the OSS code on github?

Yes. https://signal.org/blog/reproducible-android/

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#148

Post by spullara »

evanreichard wrote: post #81
spullara wrote: post #66

Earlier quoted context omitted.

If they were storing that it would have been produced when they were forced to produce all data relevant to the case.

Agreed. Just pointing out what information they have access to if they wanted to start logging as much as they could.

Sadly I don't see any way to prove that over time except through periodic court orders :)

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#149

Post by gruez »

godelmachine wrote: post #105
Kuraj wrote: post #53

Earlier quoted context omitted.

Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction. [1] https://torrentfreak.com/private-internet-access-no-logging-...

That’s one point in favor of PIA. I chose NordVPN coz we can access from any server in the world and they have offered me good discount

>I chose NordVPN coz we can access from any server in the world and they have offered me good discount

That describes literally most of the VPN service offerings out there.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#150

Post by [deleted] »

_rohan wrote: post #142
ajsharp wrote: post #140

There's a lot about Signal in particular that they get right. AFAIK: (1) All Signal messaging is E2EE; (2) they don't store messages on their servers; (3) the client code is open source, and it seems like a good portion of the server code is open source. Where I think Signal could go further on being the most secure, useful, and privacy-conscious messaging app/company in the world: 1. Open source ALL of the server co…

It's cool that Signal is open source, that's a big source of confidence for me. Is there some way for me to verify that the app in the app store is actually built from the OSS code on github?

[deleted]
Post reply on HN