Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#211

Post by 2Gkashmiri »

hutzlibu wrote: post #136
2Gkashmiri wrote: post #77

Earlier quoted context omitted.

here https://www.deccanherald.com/national/north-and-central/jk-a... not allowed to use VPNs because national security issues. https://www.aa.com.tr/en/asia-pacific/india-launches-fresh-c... "social media muisuse" i remember last year this word was so much used, "misuse" which translates to criticizing the ruiling dictator government. it still is, https://thenextweb.com/in/2020/01/08/kashmirs-police-want-pe... here.…

Well, if a government goes authorian, than it does not matter much, what service you use, if you have to assume your phone has spyware on it. If the main danger is, police scanning the phone for compromised material (without a police spyware on it), then there are some ways to deal with it technically, by using services that don't leave a trace. Telegram for example has a "secret chat" function, which won't save the…

Yeah. Just last year I had to teach neighbours and such to use a launcher like Evie which lets you hide apps. Many were stopped during random street checks and that saved their Turkey. Heh.

8 months or so ago I was stooped because it looked like I was "recording a video" on my phone when actually I was. Took a slow turn, double press power button and pickachu face that I wasnt. Still a couple guys around helped or I was history.

No. I havent read Rushdie. It has that whole demon verse thing around him, he isnt liked

The problem with telegram as with WhatsApp and signal is phone numbers. India has had this network analyzer on isp level for like 6-7 years, called "netra". So all unencrypted traffic goes through it. Same for all encrypted traffic. This is the reason why I stopped using tor, because my traffic would show up uniquely than rest and that gets them suspicious quickly.

There is a lot of text written on the conflict which actually is more than 500 years old. Kashmir has been under foreign oppressive occupation for over 500 years constantly and even today is under 3 nations. Its not like the occupation wont affect the people.

I am trying to get people I know on matrix because there is no PII, waiting for dendrite to come out of beta so that I can set up my own server and such.

The joys of living in an open air prison.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#212

Post by acct776 »

Enginerrrd wrote: post #48
cassianoleal wrote: post #24

Earlier quoted context omitted.

Assuming you have: - read the source code and are satisfied that it's secure - compiled that version of the code - installed it on your mobile or desktop You're still only as secure as the client on the other side of the conversation. If that one is compromised (has not gone throught the steps above) it could very well be sending all messages in clear text to a malicious party. Edit: formatting

Yeah and since you have the possibility of dealing with state actors with deep pockets, you have to wonder if Android or iOS doesn't have the ability to copy your private keys and send those off somewhere for storage. Because of signal's popularity, it feels pretty possible to me. If the NSA did have it backdoored somehow through the OS, it's a good bet they'd force LE agencies to use parallel construction to keep th…

AOSP (Vanilla, GrapheneOS, CalyxOS) doesn't have this capability.

The Google Play Services app/package? Heh...

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#213

Post by a012 »

geraltofrivia wrote: post #76
dave_sullivan wrote: post #63

Earlier quoted context omitted.

What did you switch to?

I’ve been using Mullvad since the past few years and I’ve no complaints. The fact that the recent Mozilla VPN is based on Mullvad makes me more confident in my decision.

Mullvad has contributed to Wireguard that secures me the confidence in their service. Also the experience of creating an account without my name and email address is the best. Theh only thing left is the billing message (I use credit card) has prefix: VPN*

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#214

Post by danielrhodes »

j-james wrote: post #199
danielrhodes wrote: post #100

Earlier quoted context omitted.

While this is a great way to build trust, there is obviously no way to confirm the App Store version is the same as one built from their public source. In fact, due to the way Apple optimizes apps for each device, this becomes even harder. Furthermore, just because you compile it from source and put it on your phone does not mean that you can reasonably stay aware of or understand all the internal workings that happe…

> Furthermore, just because you compile it from source and put it on your phone does not mean that you can reasonably stay aware of or understand all the internal workings that happen inside the app. Can you elaborate on this? That's exactly what I'd expect of an app I compiled from source.

Are you going to read every commit and fully explore the entire app to know your messages and encryption are being handled securely? And keep doing this every time you update? If so, you have more time than I do. :-)

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#215

Post by danielrhodes »

restingrobot wrote: post #165
aarchi wrote: post #125

Earlier quoted context omitted.

I know that developers can post LLVM bitcode to the App Store instead of a binary, which allows Apple to recompile it for architectural changes. I'd be surprised if Apple optimized per device. Creating separate builds with optimizations for different iPhone models would make more sense. Do you have more details on that?

I think he meant "iPhone models" when he said "devices". I'm not the op, but they definitely do optimize per model, not individual device.

Per model is what I meant.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#216

Post by SLHyR82 »

Telegram stores all data on own servers.

Just try the following trick:

- in a private Browser window open web.telegram.org

- enter your phone number, receive the code

- turn on flight mode on your phone

- now enter the identification code in your browser

- access your whole chat history while your smartphone can definitely not act as a source

Even WhatsApp is better in this regard.

Article in German: https://www.heise.de/hintergrund/Telegram-Chat-der-sichere-D...

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#217

Post by akvadrako »

SulfurHexaFluri wrote: post #181
akvadrako wrote: post #60

Earlier quoted context omitted.

We don't really know it, but there is some assurance the server is running the code they say it is because of Intel SGX. https://signal.org/blog/private-contact-discovery/

I just had a skim over the post and it seems to be saying that it allows them to process user data without the OS having access to it. This does nothing at all for letting me verify what is running on their server or that they are even using this SGX feature at all. It protects signal from hackers or a malicious datacenter provider at best.

I don't think you skimmed it very carefully.

> SGX enclaves also support a feature called remote attestation. Remote attestation provides a cryptographic guarantee of the code that is running in a remote enclave over a network.

> Originally designed for DRM applications, most SGX examples imagine an SGX enclave running on a client. This would allow a server to stream media content to a client enclave with the assurance that the client software requesting the media is the “authentic” software that will play the media only once, instead of custom software that reverse engineered the network API call and will publish the media as a torrent instead.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#218

Post by hutzlibu »

2Gkashmiri wrote: post #211
hutzlibu wrote: post #136

Earlier quoted context omitted.

Well, if a government goes authorian, than it does not matter much, what service you use, if you have to assume your phone has spyware on it. If the main danger is, police scanning the phone for compromised material (without a police spyware on it), then there are some ways to deal with it technically, by using services that don't leave a trace. Telegram for example has a "secret chat" function, which won't save the…

Yeah. Just last year I had to teach neighbours and such to use a launcher like Evie which lets you hide apps. Many were stopped during random street checks and that saved their Turkey. Heh. 8 months or so ago I was stooped because it looked like I was "recording a video" on my phone when actually I was. Took a slow turn, double press power button and pickachu face that I wasnt. Still a couple guys around helped or I…

"No. I havent read Rushdie. It has that whole demon verse thing around him, he isnt liked"

Well, he did made many people aware of the conflict, which created attention, which results in indian police having to give interviews to the intercept for example, which helps in some ways. Things would probably be darker without.

How is your opinion on a political solution?

Do you think independence would work out (if your big neigbhours would let you)?

My understanding is, that the kashmir population in itself is divided?

Anyway, hope you stay safe.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#219

Post by Jaxkr »

andreareina wrote: post #206
benhurmarcel wrote: post #141

Earlier quoted context omitted.

It will happen. So far Telegram has developed without consideration for revenue, but it cannot last too long. According to his own numbers [1], Durov's entire net worth [2] can only sustain Telegram for about a decade. [1] https://t.me/s/durov/142 [2] https://www.forbes.com/profile/pavel-durov/

> 500 million active users > A project of our size needs at least a few hundred million dollars per year to keep going. Is it just me or does order of $1 per user sound like a lot?

$1 per user/year sounds about right. I use Telegram more than any other chat app. People send lots of media (and even large files) and Telegram archives them forever. One group Telegram I’m in is 6 years old and has 500+ VIDEOS (and 10,000s of images) permanently archived in it.

I’d estimate I cost over $10/yr to telegram.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#220

Post by tpoacher »

SLHyR82 wrote: post #216

Telegram stores all data on own servers. Just try the following trick: - in a private Browser window open web.telegram.org - enter your phone number, receive the code - turn on flight mode on your phone - now enter the identification code in your browser - access your whole chat history while your smartphone can definitely not act as a source Even WhatsApp is better in this regard. Article in German: https://www.heis…

What's this supposed to prove?
Post reply on HN