Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram messaging app proves crucial to Belarus protests

latimes.com

Post reply on HN
Print view View original

431–440 of 557 posts

Re: Telegram messaging app proves crucial to Belarus protests

#431

Post by maqp »

read_if_gay_ wrote: post #420
maqp wrote: post #414

Earlier quoted context omitted.

It can, but given Telegram's history and professional cryptographers like Schneier[1] and Green[2] saying DO NOT USE IT, it's obvious it's _anything_ but watertight. [1] https://www.schneier.com/blog/archives/2016/06/comparing_mes... [2] https://twitter.com/matthew_d_green/status/72642891296898252...

Both four years old. Did they not improve since?

No. Still not E2EE by default, still no E2EE for groups, still no E2EE for desktop clients. Why do you want to imagine Telegram magically got better when it's so obvious it didn't?

Re: Telegram messaging app proves crucial to Belarus protests

#432

Post by swinglock »

read_if_gay_ wrote: post #420
maqp wrote: post #414

Earlier quoted context omitted.

It can, but given Telegram's history and professional cryptographers like Schneier[1] and Green[2] saying DO NOT USE IT, it's obvious it's _anything_ but watertight. [1] https://www.schneier.com/blog/archives/2016/06/comparing_mes... [2] https://twitter.com/matthew_d_green/status/72642891296898252...

Both four years old. Did they not improve since?

Of course not. You have to first admit you have a problem to be able to improve.

Re: Telegram messaging app proves crucial to Belarus protests

#433

Post by maqp »

pvg wrote: post #413
maqp wrote: post #405

Earlier quoted context omitted.

Explain how this works. A blue party voter writes to another blue party voter: Hey, let's vote blue this year. NSA that intercepts the message and __________.

The thing being suggested here is that the campaign of the incumbent is reading all the communications of the campaign of the challenger. I don't think anything of the sort actually happens or is really that easy to (completely secretly!) make happen, but that's the proposed scenario.

Ah you mean reading communications of the opposition. https://en.wikipedia.org/wiki/ECHELON#Public_disclosures_(19... discusses it:

'Congressional investigators determined that "targeting of US political figures would not occur by accident, but was designed into the system from the start."'

So yeah that might still be going on. Signal etc. make it harder but it's not like the NSA isn't hacking endpoints so hard to say if it's actually secure. We can only hope the next Snowden will let us know if NSA's spying on the opposing political party.

Re: Telegram messaging app proves crucial to Belarus protests

#434

Post by maqp »

cl3misch wrote: post #416
maqp wrote: post #393

Earlier quoted context omitted.

" I don't understand how they will get the chats except from individual phones. " ~~By default~~ Telegram's group chats used to organize protests aren't E2EE. If Belarusian government hacks Telegram server, they can read every dissident group's chat history trivially.

E2EE is not available at all for group chats.

Indeed, E2EE is not available at all for group chats.

Re: Telegram messaging app proves crucial to Belarus protests

#435

Post by eitland »

maqp wrote: post #388
ffpip wrote: post #286

Earlier quoted context omitted.

I love telegram. Great UI, feels natural to use it. And SO MANY features, it's hard to keep up. Unlimited storage helps too.

When you realize end-to-end encryption is a necessary property of all features, you realize Telegram lacks even basic things like desktop clients, syncable chats, and group chats. Not so feature rich anymore ;)

E2E-encryption is really nice but not anymore necessary for most users of Telegram than for

- WhatsApp before they implemented it

- GMail (or any other mail service)

- Matrix (by default, until recently?)

- IRC

- SMS

- Letters in the mail

For some reason this has a tendency to boil down very quickly to

- E2E-encryptet === good, no further information needed

- anything else === bad, no further information needed

Which obviously isn't the whole truth:

It is far less likely give you trouble

- if you receive a stream of unencrypted postcards from Grandma on vacation

- than it is if you send and receive perfectly encrypted messages to/from a criminal mastermind over a channel that leaks metadata or by default backs up your data to any mainstream cloud provider.

The availability of metadata, who can access that metadata etc etc plays a role.

Telegram has significant problems, as far as I know both technically and also at higher levels, but for some reason someone always have to pull the E2E: Good, anything else: Bad.

That isn't useful.

Re: Telegram messaging app proves crucial to Belarus protests

#436

Post by stilisstuk »

Marsymars wrote: post #375
godelski wrote: post #203

Earlier quoted context omitted.

I have been frustrated with Signal on this. I pitched that it is a good idea because of a scenario: > You're protesting with people. Cops pick them up, but not you. You can delete their messages and it is likely that you are able to do so before the police can clone your phone or copy the messages (screenshot, whatever). I got a few strange responses back: - Deleting messages doesn't mean they can't be saved (yeah...…

See, the lack of bidirectional deletion is one of the reasons I prefer Signal. Nobody other than me should have the ability to delete data on my device.

There are two parties in a conversation. Both 'own' the conversation. Both have a 'veto' right.

Re: Telegram messaging app proves crucial to Belarus protests

#437

Post by hutzlibu »

newscracker wrote: post #264

It's not surprising that every time Telegram pops up here, many comments miss the fact that Telegram has a great UX, a great feature set and also provides the kind of privacy protestors value, i.e., not having their phone numbers flashed to every random stranger in groups or to random channel owners whose channels you've subscribed to. With Telegram you cannot even do a phone number enumeration attack (this can be ch…

The problem with telegram is, what is their buisnessmodell?

There is none at the moment.

Signal lives off donations.

WhatsApp off the Facebook datagrabbing connection

Matrix/Element from support/server renting

But Telegramm has invested a lot, but received no money in return yet. So, I suppose the current plan is to get dominant and then .. ROI with who knows?

I also use it right now. Creating and managing groups is easy. You can edit messages! It is fast and reliable.

But I surely would not use it if I would be scared of the government.

Re: Telegram messaging app proves crucial to Belarus protests

#438

Post by pvg »

maqp wrote: post #433
pvg wrote: post #413

Earlier quoted context omitted.

The thing being suggested here is that the campaign of the incumbent is reading all the communications of the campaign of the challenger. I don't think anything of the sort actually happens or is really that easy to (completely secretly!) make happen, but that's the proposed scenario.

Ah you mean reading communications of the opposition. https://en.wikipedia.org/wiki/ECHELON#Public_disclosures_(19... discusses it: 'Congressional investigators determined that "targeting of US political figures would not occur by accident, but was designed into the system from the start."' So yeah that might still be going on. Signal etc. make it harder but it's not like the NSA isn't hacking endpoints so hard to sa…

I don't mean that, I'm just pretty sure the person you are replying to meant that. As to the other stuff, no, even if your security services are collecting this sort of thing, by design or not, it doesn't mean it's in your daily briefing, let alone available to your campaign. If it was, Nixon wouldn't have needed to hire a bunch of incompetent cosplayers to be 'Plumbers'.

Re: Telegram messaging app proves crucial to Belarus protests

#439

Post by mcsoft »

It's surprising how Telegram successfully lured public to believe it is a secure messaging app while not providing end-to-end encryption by default.

You need to explicitly start secret chat (under More button on the contact page) to opt-in for E2EE, something you get by default in every Whatsapp chat.

Re: Telegram messaging app proves crucial to Belarus protests

#440

Post by maqp »

eitland wrote: post #435
maqp wrote: post #388

Earlier quoted context omitted.

When you realize end-to-end encryption is a necessary property of all features, you realize Telegram lacks even basic things like desktop clients, syncable chats, and group chats. Not so feature rich anymore ;)

E2E-encryption is really nice but not anymore necessary for most users of Telegram than for - WhatsApp before they implemented it - GMail (or any other mail service) - Matrix (by default, until recently?) - IRC - SMS - Letters in the mail For some reason this has a tendency to boil down very quickly to - E2E-encryptet === good, no further information needed - anything else === bad, no further information needed Which…

"- if you receive a stream of unencrypted postcards from Grandma on vacation"

That's such a bullshit excuse. Everything goes with outer layer of encryption these days, what matters is will Telegram offer to lock themselves out of the messages to which the answer is no by default. If you want to chat on desktop or create a group, the answer is no whether you like it or not.

So again, some niché use case of "it's probably nothing sensitive so you might as well send it in the clear because that says you're not a dissident" is thus not even valid. There's almost always outer layer of encryption.

"The availability of metadata, who can access that metadata etc etc plays a role."

Indeed. All the more reason to avoid Telegram that by default stores all that metadata.

"someone always have to pull the E2E: Good, anything else: Bad."

No the point is we'll never even get to the debate on reducing metadata as long as we need to play whack-a-mole with shit apps like Telegram that don't E2EE by default, let alone provide any kind of metadata protection, even sealed sender like Signal does.

As the author of messaging system[1] that provides both E2EE by default for everything as well as metadata protection (more than any other app out there) and advanced protections like endpoint security, I don't really like you putting me into some square of caring only about E2EE. All I can say to you is, first things first.

[1] https://github.com/maqp/tfc

Post reply on HN