Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TDLib – Build Your Own Telegram Client

telegram.org

Post reply on HN
Print view View original

81–90 of 101 posts

Re: TDLib – Build Your Own Telegram Client

#81

Post by Aloha »

calgoo wrote: post #40
Anon1096 wrote: post #18

Earlier quoted context omitted.

Well for me, I prefer the way telegram has decided to handle end to end encryption. Let's face it - me and my friends have no use for it, and never will. Our threat model just doesn't really care about actors like the NSA hacking us. If they wanted there's tons of other ways to get our information any (like Google or Facebook accounts). But not being encrypted gives us features not possible otherwise, like url prefet…

I really don't understand the "hate" for Telegram on HN. I understand that its not (allegedly) as secure as signal for example, but like you said, state actors etc have other ways of getting that info (see xkcd [1]). I personally use Telegram when talking to my wife because it lets me have a client on every platform i use and the messages follow me. I could do that with some of the other platforms as well, but im alr…

Telegram for me is the right trade off between security and convenience.

Re: TDLib – Build Your Own Telegram Client

#82

Post by codedokode »

andrepd wrote: post #24
morganvachon wrote: post #19

Earlier quoted context omitted.

Indeed, I've been attacked and modded to oblivion on here for mentioning that I use Telegram, and the scope wasn't even security related, just an alternative to email for sending non-sensitive photos. I've found Telegram to be more than good enough for day to day communications where I would previously have used email or SMS/MMS.

So is Signal and at least that is secure.

Signal requires to provide a phone number (read: disclose your identity to US Government) to use it.

Re: TDLib – Build Your Own Telegram Client

#83

Post by Aloha »

jamesb93 wrote: post #75
aneutron wrote: post #17

Earlier quoted context omitted.

Also, I was very surprised to see that it was really QT based in the sense that there was no glue to an attached Chromium or something, just pure QT in C++. The effort that went into that thing is amazing. It's fast on my 5 years old Pentium.

Which one should I be using? MacOS specific one feels polished whereas the Telegram for Desktop one doesn't have this strange issue where media sometimes never sends.

I prefer the macOS native client.

Re: TDLib – Build Your Own Telegram Client

#84

Post by bqe »

codedokode wrote: post #80
bqe wrote: post #73

Earlier quoted context omitted.

Why does Signal scare you? All of their code is open source[1] and has had multiple public audits[2]. [1]: https://github.com/signalapp [2]: https://eprint.iacr.org/2016/1013.pdf

It requires you to provide a phone number (read disclose your identity) to use it. And its homepage has the word "privacy" repeated several times. It looks like a poor joke.

You can easily use a VoIP number to set up Signal if that's really an issue for you.

The alternative (using Telegram's homegrown and dubious cryptography and lack of actually encrypted group messages) is significantly worse. Here's a nice summary of the issues: https://security.stackexchange.com/a/49802/43733

Re: TDLib – Build Your Own Telegram Client

#85

Post by mashedvikings »

codedokode wrote: post #80
bqe wrote: post #73

Earlier quoted context omitted.

Why does Signal scare you? All of their code is open source[1] and has had multiple public audits[2]. [1]: https://github.com/signalapp [2]: https://eprint.iacr.org/2016/1013.pdf

It requires you to provide a phone number (read disclose your identity) to use it. And its homepage has the word "privacy" repeated several times. It looks like a poor joke.

Yet the developer is world famous for his security work, not for something like inventing Facebook for Russians. Are you sure you can handle 100% anonymous connection to servers of apps that could at any time identify you based on your IP?

Re: TDLib – Build Your Own Telegram Client

#86

Post by mashedvikings »

lloeki wrote: post #10
lozenge wrote: post #8

Telegram has a poor security record, with homegrown encryption algorithms and no end to end encryption by default.

While I am wary of "build-your-own-crypto", saying it has a poor security record is, to my knowledge so far, incorrect. I have yet to see satisfactory cryptanalysis that shows a weakness (theoretical or real) in the protocol. If anything, it seems to withstand scrutiny so far. Even the dedicated security.se.com question[0] seems like it wraps itself in tautologies. Until then, throwing the "homegrown encryption" argu…

"I have yet to see satisfactory cryptanalysis that shows a weakness (theoretical or real) in the protocol":

https://eprint.iacr.org/2015/1177.pdf

Re: TDLib – Build Your Own Telegram Client

#87

Post by mashedvikings »

morganvachon wrote: post #27
andrepd wrote: post #24

Earlier quoted context omitted.

So is Signal and at least that is secure.

And once again, if I need that kind of security I'll seek it out. Telegram is more secure than email and SMS, and more convenient for my use case.

Telegram is exactly as secure as email. SSL where third party email servers can see your traffic.

Re: TDLib – Build Your Own Telegram Client

#88

Post by jhasse »

24gttghh wrote: post #68
f2n wrote: post #58

Earlier quoted context omitted.

Because one is human and one mistypes... I'm normally on the Signal side of this argument, Telegram is trash and should not be used, but basic features like message editing are legitimate requests. I use Signal heavily and a number of times a day at least I or someone I'm chatting with corrects a previous poorly phrased or incorrectly typed messages. Because Signal has no mechanism for that, it usually involves retyp…

I've been retyping the offending word and adding * since I started using chat programs 20 years ago, and in every program since...I would think allowing messages to be edited after the fact would allow more problems than solving simple grammar or spelling mistakes most people can think around anyways.

I thought so, too. But after using Telegram for 3 years as my main messenger: No, it really is very convenient.

Re: TDLib – Build Your Own Telegram Client

#89

Post by mashedvikings »

danudey wrote: post #67
detaro wrote: post #34

Earlier quoted context omitted.

Not entirely false, no. It does not have end-to-end encryption by default, and not at all for group chats, and the cryptography is a bigger unknown than with others.

> It does not have end-to-end encryption by default That doesn't mean it "has a poor security record" (implying that the security is broken), it means it is not as secure as other options. > not at all for group chats May not be a requirement for group chats > the cryptography is a bigger unknown than with others Unknown does not mean bad, it means unknown. Almost definitely worse than Signal, but almost definitely b…

Quoting Moxie: THere's nothing to be broken because there's no end-to-end encryption to begin with. Do you think nation state hackers publish their finding about the trove of private messages telegram's vast server complex holds indefinitely? hahahahaha

Re: TDLib – Build Your Own Telegram Client

#90

Post by mashedvikings »

negus wrote: post #11
lozenge wrote: post #8

Telegram has a poor security record, with homegrown encryption algorithms and no end to end encryption by default.

Can you mention something more specific, than suspicion to "homegrown encryption algorithms" that is just a yet another combination of DH-RSA-AES ?

https://eprint.iacr.org/2015/1177.pdf
Post reply on HN