Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Calls: Secure, Crystal-Clear, AI-Powered

telegram.org

Post reply on HN
Print view View original

41–50 of 299 posts

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#41

Post by sleepychu »

microtonal wrote: post #29
MichaelApproved wrote: post #24

Earlier quoted context omitted.

> end-to-end only device to device (so I can't swap seamlessly from a desktop to a mobile session) How do you accomplish a seamless swap from desktop to a mobile session using end-to-end encryption?

iMessage has end to end encryption and supports multiple devices. Each device uses its own keypair and when a message is sent, it is sent encrypted for each of the recipient's devices. https://www.apple.com/business/docs/iOS_Security_Guide.pdf

How do I find out that my recipient has a new device/public key that they'd like me to encrypt with?

If it's because Apple tells me so then I think can see that the end to end encryption is broken and interception is possible.

Are old messages re-encrypted with the new key?

This would be even worse.

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#42

Post by distances »

anotheryou wrote: post #21
Proof wrote: post #14

Earlier quoted context omitted.

I highly recommend you check out WIRE. Cheers

The problem is the friction of making all my peers switch

And one should probably switch straight to Signal anyway if an effort for that was made.

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#43

Post by ramshorns »

cprecioso wrote: post #4

Can anyone familiar with the matter say how secure is the 4-emoji verification code?

I think a while ago someone on HN suggested emoji as a joke as a more information-dense and internationalized alternative to numeric or alphanumeric verification codes. I don't know about security, but if this uses all 1,088 emoji from Unicode 9.0, then four emoji have about 40 bits of information.

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#44

Post by samat »

CodeMichael wrote: post #13
wackspurt wrote: post #7

"Each time you make a Voice Call on Telegram, a neural network learns from your and your device‘s feedback (naturally, it doesn’t have access to the contents of the conversation, it has only technical information such as network speed, ping times, packet loss percentage, etc.). The machine optimizes dozens of parameters based on this input, improving the quality of future calls on the given device and network." What…

Sounds like marketing speech for variable bitrate encoding and/or adjusting compression aggressiveness.

Those codecs have tons of parameters to tweak (source: private conversation with Pavel Durov)

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#45

Post by Siimteller »

kevingrahl wrote: post #5
phillc73 wrote: post #2

I've managed to setup Telegram for most of my (non-technical) family - wife, siblings, mother (she doesn't even have a smart phone and just uses Telegram as a message client on her desktop. It's a very convenient way to share family related pictures). Voice calls are an excellent addition. If these could now also be extended to video calls, I could likely ditch Skype forever.

A client of mine once explicitly asked to communicate via Wire [1] which is pretty similar to Skype but E2E encrypted. It was launched by a Skype co-founder, is easy to use and has a pleasant interface. And it's open source. I can't really tell if the product really does what it's advertising, perhaps someone with more expertise could chime in on that. I got stuck on it and I'm considering ditching Skype altogether f…

It's open source indeed [1] and was recently audited for the quality of the crypto protocol implementation [2]. Not sure what questions you specifically have but I'm happy to answer as I'm part of the team.

[1] https://github.com/wireapp [2]https://medium.com/wire-news/wires-independent-security-revi...

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#46

Post by unicornporn »

dgellow wrote: post #33
unicornporn wrote: post #25

Earlier quoted context omitted.

But NOBODY I know actually uses the secure chat feature — mainly because it isn't default, but also because it doesn't sync between devices.

The lack of sync is a feature. That's what you get when you have a secure system.

How come https://riot.im (Matrix) manages to sync between devices AND have E2E, while also being federated?

That's not what you get when you have a secure system, that's what you get when you design a system that can collect (and possibly monetize) the data of millions of users.

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#47

Post by cflee »

ramshorns wrote: post #43
cprecioso wrote: post #4

Can anyone familiar with the matter say how secure is the 4-emoji verification code?

I think a while ago someone on HN suggested emoji as a joke as a more information-dense and internationalized alternative to numeric or alphanumeric verification codes. I don't know about security, but if this uses all 1,088 emoji from Unicode 9.0, then four emoji have about 40 bits of information.

They say they are using 333 emoji to represent ~34 bits.

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#48

Post by Siimteller »

davidjgraph wrote: post #12

I happened to be reading a comparison of Telegram and Whatsapp this morning [1]. I've never used Whatsapp, is it really this bad or is the reviewer clearly a massive Telegram fanboy/girl? [1] https://info.seibert-media.net/display/Atlassian/Comparison+...

For an independent and serious comparison check https://www.securemessagingapps.com that focuses mostly on the security/privacy aspects of various messengers.

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#49

Post by unicornporn »

golergka wrote: post #38
unicornporn wrote: post #25

Earlier quoted context omitted.

But NOBODY I know actually uses the secure chat feature — mainly because it isn't default, but also because it doesn't sync between devices.

It just means that nobody you know sells drugs or does other stuff that forces people to choose privacy over convenience.

How come https://riot.im (Matrix) manages to sync between devices AND have E2E, while also being federated? How come I can use both WhatsApp and Signal on both my computer and phone (and they stay in sync)?

Re: Voice Calls: Secure, Crystal-Clear, AI-Powered

#50

Post by pfg »

sleepychu wrote: post #41
microtonal wrote: post #29

Earlier quoted context omitted.

iMessage has end to end encryption and supports multiple devices. Each device uses its own keypair and when a message is sent, it is sent encrypted for each of the recipient's devices. https://www.apple.com/business/docs/iOS_Security_Guide.pdf

How do I find out that my recipient has a new device/public key that they'd like me to encrypt with? If it's because Apple tells me so then I think can see that the end to end encryption is broken and interception is possible. Are old messages re-encrypted with the new key? This would be even worse.

iMessage does not allow for any out-of-band key verification. It's correct that that Apple (and anyone compromising them) is in a position to change the recipient's key or add new ones without the sender noticing anything's going on. I think iMessage limits this to new messages. (I believe syncing is done through iCloud, which doesn't use E2E-crypto but is optional.)

It would still be possible to implement this in a secure way (including out-of-band key verification) by having the "original" key (the one you've compared out-of-band) sign keys for new devices and have the server deliver that signature (which the sender can then verify). I don't know if there are any implementations of this.

Post reply on HN