Live data from Hacker News

Telegram messaging app proves crucial to Belarus protests

latimes.com

531–540 of 557 posts

Re: Telegram messaging app proves crucial to Belarus protests

#531
post #524
post #479

Earlier quoted context omitted.

Theoretically, couldn't the client send the message to one server and the keys to a different set of servers? Clients would request the encrypted messages from one server and the keys from another? That would imply client-side encrypted cloud backups, with external key management which isn't the case in Telegram, if it were it could be shown from client-side code. Also, even if that would be the case, it would just n…

I always took the claim of routing keys and messages in different jurisdiction to be about not writing them to storage in those jurisdiction, not about not having them in RAM. the idea being that there can be an internal policy to shut down the server and wipe the ram but it is harder to do with drives. I also have a question since you probably can answer: can E2E offer a similar user experience to what normal telegr…

" I always took the claim of routing keys and messages in different jurisdiction to be about not writing them to storage in those jurisdiction, not about not having them in RAM."

There's no precedent I'm aware of that if e.g. NL Telegram server has the key in its RAM but not in its disk, that it doesn't have to hand out the keys. Also the keys and/or plaintexts can just be stolen by foreign intelligence establishments. It's not just judicial means we need to be concerned about. E.g., just because it's legal in China to hack Telegram servers abroad, doesn't mean it's right, and Telegram should take this into account.

"the idea being that there can be an internal policy to shut down the server and wipe the ram but it is harder to do with drives."

This is pure speculation and it wouldn't matter because key lifting attacks would be transparent, i.e. the exploit is polished enough not to raise alarms.

"I also have a question since you probably can answer: can E2E offer a similar user experience to what normal telegram chats offer?"

Yes. Except channels and extremely large supergroups. But these two don't enjoy expectation of privacy. You can't expect something you say to a group of 10,000+ people to remain private, people consider such groups public.

Encrpytion is just math so there's also no way around the UX problem of authentication that's part of E2EE, but since that's expected of users, it's not a problem either.

Everything else, group chats with roles, synced chats, file transfers, locations, stickers... you name it, can be done over E2EE, just look at how Signal is showing each of those can be done. It's not trivial of course, but like you asked, "can it be done", yes, it can.

Re: Telegram messaging app proves crucial to Belarus protests

#532
post #387

Earlier quoted context omitted.

" And nope, Signal doesn't make the cut for the above reasons because it exposes your phone number to everyone else " This is being worked on. The thing is you're mixing two threat models. One is a creepy dude who will give you nightly calls if they learn your phone number. The other is a state actor who will hack the server and track you based on your IP-address if no phone number is being used otherwise: hence the…

phone numbers are shared in groups with tens of thousands of people. They spam, herass, hack etc. Forcing you to change your number.

Ah yes, the classic hacking someone with their phone number!

Re: Telegram messaging app proves crucial to Belarus protests

#533
post #388

Earlier quoted context omitted.

When you realize end-to-end encryption is a necessary property of all features, you realize Telegram lacks even basic things like desktop clients, syncable chats, and group chats. Not so feature rich anymore ;)

Not official, but Unigram for Windows 10 is the way to go for me. It has everything it should have and is not Electron. The best app of this kind there is at the moment. I'm not affiliated with Unigram in any way, just a happy user.

It's the vendor that should be releasing the clients with support for it. The fact it's a third party is both a problem and proof of huge internal problem.

Re: Telegram messaging app proves crucial to Belarus protests

#534
post #528
post #486

Earlier quoted context omitted.

No, it is not necessary _or_ sufficient. That is what I'm saying. You can audit a closed-source app, and there also might be open-source apps which are impractical to audit despite them being open source.

If you have your closed-source app audited, everyone needs to trust the audit company. And I've seen some shit audits in my life that told absolutely nothing about the actual security. Open source means anyone can audit and verify nothing was done after audit. Moxie more or less audited WhatsApp's Signal protocol implementation, and people are right to be concerned about whether changes have been made since FB bought…

It can also be reverse engineered by third parties. Whatsapp in particular has been subject to extensive analysis by reverse engineering.

Re: Telegram messaging app proves crucial to Belarus protests

#535

Earlier quoted context omitted.

Tut.by was down during 9-10 events, while telegram appeared to work with some kind of VPN workaround (Belarusian, but living in the USA)

In Beltelecom network when using Opera browser VPN I read tut.by. In A1 network Opera VPN didn't help. Actually, availability at 9-10 does not really matter, people were already intended to protest by that time.

I mean people were going to protest already

Re: Telegram messaging app proves crucial to Belarus protests

#536
post #471

Earlier quoted context omitted.

That's actually encouraging to hear!

It was internal alpha but whatever: https://community.signalusers.org/t/beta-feedback-for-the-up... The community forums are a wonderful place to follow the development BTW.

Much appreciated!

Re: Telegram messaging app proves crucial to Belarus protests

#537
post #496

Earlier quoted context omitted.

Can you share some examples of large infringements on freedom of speech that happened in well developed European countries? Given the examples of police brutality related to protests that I've seen in the US just this year I doubt you'll be able to provide any examples that are more worrying than that.

The UK’s insane libel laws are a good example.

But overall UK probably still ranks as treating its basic citizens with better decency than the USA due to healthcare access among other things.

Re: Telegram messaging app proves crucial to Belarus protests

#538
post #532

Earlier quoted context omitted.

phone numbers are shared in groups with tens of thousands of people. They spam, herass, hack etc. Forcing you to change your number.

Ah yes, the classic hacking someone with their phone number!

yes? just knowing a phone number is enough to log into a non-2fa google account if you know the pass, plus it can be easily triangulated to a real-world address

Re: Telegram messaging app proves crucial to Belarus protests

#539
post #532

Earlier quoted context omitted.

phone numbers are shared in groups with tens of thousands of people. They spam, herass, hack etc. Forcing you to change your number.

Ah yes, the classic hacking someone with their phone number!

they sent phishing links thru sms and also do sim swaps. They hijack the phone number by connecting it to another sim card. They also have people work at the providers that give them access to these numbers. I'm in those groups so I'm not talking out of my ass.

Re: Telegram messaging app proves crucial to Belarus protests

#540
post #538
post #532

Earlier quoted context omitted.

Ah yes, the classic hacking someone with their phone number!

yes? just knowing a phone number is enough to log into a non-2fa google account if you know the pass, plus it can be easily triangulated to a real-world address

exactly. And not only that, people who work at telecom providers sell illegal services to whoever wants to pay. They give you access to anyones numbers for money.
Post reply on HN