51–60 of 101 posts
Telegram has a poor security record, with homegrown encryption algorithms and no end to end encryption by default.
People(IME at least) use Telegram(or WhatsApp) because it’s a nice to use app, both mobile and desktop.
Earlier quoted context omitted.
Indeed, I've been attacked and modded to oblivion on here for mentioning that I use Telegram, and the scope wasn't even security related, just an alternative to email for sending non-sensitive photos. I've found Telegram to be more than good enough for day to day communications where I would previously have used email or SMS/MMS.
So is Signal and at least that is secure.
Earlier quoted context omitted.
And by the way, "no end to end encryption by default" -- is intentional tradeoff for cross-device message history sharing by default, which is not possible in case of e2e, without key transferring
I use a messaging service called Wire that does E2E, cross device messaging history by default (up to 6 devices), using very friendly, familiar UX - you only need to sign in on your device. It might have been an intentional tradeoff when Telegram came out, but it's not any more. It's not a great defense for the fact that you chat history exists in plain text on Telegram servers.
Source? https://telegram.org/blog/sessions-and-2-step-verification says:
"It allows you to set up a password that will be required every time you log into your account from a new device – in addition to the code you get in the SMS.
Be careful though: if you forget this password, you won't be able to access your messages from other devices."
This sounds to me that the chat history is encrypted with the password which doesn't leave my devices and therefore I'm not able to recover the history if I lose it. Since all clients are open-source, it should be possible to verify this.
edit: Okay the option for a recovery email could mean that they still have the password (or a key derived of it) on their servers - so basically plain-text.
Telegram has a poor security record, with homegrown encryption algorithms and no end to end encryption by default.
While I am wary of "build-your-own-crypto", saying it has a poor security record is, to my knowledge so far, incorrect. I have yet to see satisfactory cryptanalysis that shows a weakness (theoretical or real) in the protocol. If anything, it seems to withstand scrutiny so far. Even the dedicated security.se.com question[0] seems like it wraps itself in tautologies. Until then, throwing the "homegrown encryption" argu…
When Telegram first launched, people were reading their crypto whitepaper and going "Whoa, this is weird. You should probably not be doing it like this", and the reply was "Well, our 6 world champion coders (did you win a coding world championship?) think it is nice. Deal with it".
They then launched a bullshit crypto challenge (which would have been secure even using crypto primitives we _know_ are insecure). People told them that wasn't how it was done. They replied something cocky about world champion coders.
A couple of months later, someone found an gaping hole where the server could MITM every newly started secret chat (which their hack for forward secrecy a couple of years later would have made possible for every 100 messages).
I think their attitude towards encrypted messaging hasn't left puberty yet, and I recommend against it for everyone looking for a secure messenger. For anyone looking for a more convenient whatsapp without caring much for privacy by default, I don't mind recommending Telegram.
Regarding your future threat model: I certainly can't say whether having a copy of a significant chunk of my private communication on a server in Russia is a future threat to me. On the other hand, I don't use any social media, and have proper data retention policies on most of my online communications.
Earlier quoted context omitted.
Signal is missing too many convenient features though, e.g. editing messages.
Why should one be able to edit a message after it is sent in a text-chat app?
I'm normally on the Signal side of this argument, Telegram is trash and should not be used, but basic features like message editing are legitimate requests. I use Signal heavily and a number of times a day at least I or someone I'm chatting with corrects a previous poorly phrased or incorrectly typed messages. Because Signal has no mechanism for that, it usually involves retyping most of the message or the relevant word and adding an asterisk. I believe if Signal had built-in message editing support it would be used far more than I currently see corrections.
To be clear, I would expect Signal to allow me to see previous versions of a message and clearly indicate that it's been changed, but message editing is a valid feature that Signal should absolutely implement.
Telegram has a poor security record, with homegrown encryption algorithms and no end to end encryption by default.
Very few people use Telegram because of its security. Literally nobody of my contacts even uses the secret chat feature. They didn’t care when WhatsApp introduced e2e either. People(IME at least) use Telegram(or WhatsApp) because it’s a nice to use app, both mobile and desktop.
Earlier quoted context omitted.
Signal is missing too many convenient features though, e.g. editing messages.
Why should one be able to edit a message after it is sent in a text-chat app?