I like how they do very good engineering (just straight C++, Swift, with little to no external dependencies) with a very small team of apparently very talented people. Most of their products are typically owned by one or two people. It's also pretty smart of them to make all of the clients available as open source and keep the server implementations private. This way they don't have to license QT for example.
TDLib – Build Your Own Telegram Client
21–30 of 101 posts
Re: TDLib – Build Your Own Telegram Client
#22I like how they do very good engineering (just straight C++, Swift, with little to no external dependencies) with a very small team of apparently very talented people. Most of their products are typically owned by one or two people. It's also pretty smart of them to make all of the clients available as open source and keep the server implementations private. This way they don't have to license QT for example.
QT was very liberally licensed for a while. Are they back to copyleft or something now?
Re: TDLib – Build Your Own Telegram Client
#23Telegram has a poor security record, with homegrown encryption algorithms and no end to end encryption by default.
You're just repeating something that you read on HN. Entirely false.
False? Is it? I've yet to see a satisfactory answer to the criticisms that were posed about the security of Telegram.
Re: TDLib – Build Your Own Telegram Client
#24Earlier quoted context omitted.
FWIW, four years ago, the HN zeitgeist considered the cryptography blunders made by Telegram, when conbined with their hubris over how their protocol was clearly perfect, a death knell for the company from which they would never recover. https://news.ycombinator.com/item?id=6948742
Indeed, I've been attacked and modded to oblivion on here for mentioning that I use Telegram, and the scope wasn't even security related, just an alternative to email for sending non-sensitive photos. I've found Telegram to be more than good enough for day to day communications where I would previously have used email or SMS/MMS.
So is Signal and at least that is secure.
Re: TDLib – Build Your Own Telegram Client
#25Earlier quoted context omitted.
I use a messaging service called Wire that does E2E, cross device messaging history by default (up to 6 devices), using very friendly, familiar UX - you only need to sign in on your device. It might have been an intentional tradeoff when Telegram came out, but it's not any more. It's not a great defense for the fact that you chat history exists in plain text on Telegram servers.
Well for me, I prefer the way telegram has decided to handle end to end encryption. Let's face it - me and my friends have no use for it, and never will. Our threat model just doesn't really care about actors like the NSA hacking us. If they wanted there's tons of other ways to get our information any (like Google or Facebook accounts). But not being encrypted gives us features not possible otherwise, like url prefet…
Speak for yourself. I care about privacy, and I couldn't give a shit about something so minor as link prefetching. I suspect I'm far from alone.
Re: TDLib – Build Your Own Telegram Client
#26I like how they do very good engineering (just straight C++, Swift, with little to no external dependencies) with a very small team of apparently very talented people. Most of their products are typically owned by one or two people. It's also pretty smart of them to make all of the clients available as open source and keep the server implementations private. This way they don't have to license QT for example.
QT was very liberally licensed for a while. Are they back to copyleft or something now?
It started moving from LGPLv2.1 to LGPLv3 in Qt 5.4 with new features, and is now the norm since Qt 5.7 (latest in 5.10):
Re: TDLib – Build Your Own Telegram Client
#27Earlier quoted context omitted.
Indeed, I've been attacked and modded to oblivion on here for mentioning that I use Telegram, and the scope wasn't even security related, just an alternative to email for sending non-sensitive photos. I've found Telegram to be more than good enough for day to day communications where I would previously have used email or SMS/MMS.
So is Signal and at least that is secure.
And once again, if I need that kind of security I'll seek it out. Telegram is more secure than email and SMS, and more convenient for my use case.
Re: TDLib – Build Your Own Telegram Client
#28Earlier quoted context omitted.
Well for me, I prefer the way telegram has decided to handle end to end encryption. Let's face it - me and my friends have no use for it, and never will. Our threat model just doesn't really care about actors like the NSA hacking us. If they wanted there's tons of other ways to get our information any (like Google or Facebook accounts). But not being encrypted gives us features not possible otherwise, like url prefet…
Speak for yourself. I care about privacy, and I couldn't give a shit about something so minor as link prefetching. I suspect I'm far from alone.
Anon1096 clearly stated that he was speaking for himself (or herself) but I agree with him: I want privacy but I don't necessarily need complete secrecy. This isn't a zero sum game: Telegram and Signal can coexist and serve different needs.
Re: TDLib – Build Your Own Telegram Client
#29Earlier quoted context omitted.
And by the way, "no end to end encryption by default" -- is intentional tradeoff for cross-device message history sharing by default, which is not possible in case of e2e, without key transferring
I use a messaging service called Wire that does E2E, cross device messaging history by default (up to 6 devices), using very friendly, familiar UX - you only need to sign in on your device. It might have been an intentional tradeoff when Telegram came out, but it's not any more. It's not a great defense for the fact that you chat history exists in plain text on Telegram servers.
Ok. Lets see
https://medium.com/@wireapp/making-your-conversations-secure... does not state any information on key management solution: how encryption key is transferred to another device.
But it has links to https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm which has nothing about cross device key sharing and https://wire.com/resource/Wire%20Security%20Whitepaper/downl.... I've read it through and found nothing on cross-device key sharing as well. Can you point me to the right part?
Re: TDLib – Build Your Own Telegram Client
#30Earlier quoted context omitted.
I use a messaging service called Wire that does E2E, cross device messaging history by default (up to 6 devices), using very friendly, familiar UX - you only need to sign in on your device. It might have been an intentional tradeoff when Telegram came out, but it's not any more. It's not a great defense for the fact that you chat history exists in plain text on Telegram servers.
Ok. Lets see https://medium.com/@wireapp/making-your-conversations-secure... does not state any information on key management solution: how encryption key is transferred to another device. But it has links to https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm which has nothing about cross device key sharing and https://wire.com/resource/Wire%20Security%20Whitepaper/downl... . I've read it through and found nothin…
I'm flattered you assume I have this knowledge, but I don't. I would presume the key is derived from your sign-in information, but I honestly don't know.
What I do know is that you don't have access to messages that happened before you first signed in to the device you're using. My message history is complete on the phone I created my Wire account on, but I installed it on a laptop a few days later and as such is missing those first days. Messages get delivered to all your active devices without problem though.
The source code for all their different client varieties (iOS, Android, Web/Electron) and server software can be found here if you're interested [0].