61–70 of 241 posts
Hmm...So I have Telegram installed via F-Droid (so presumably without Google Play Services). I do NOT have the "People Nearby" feature. I am curious if that means my location is not published?
Barring no exploits, you have to press "Make Myself Visible" and then confirm with a popup in order to share your location.
Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know WhatsApp is insecure while people sometimes act like Telegram is a secure platform.
This is a common wrong understanding. WhatsApp is end-to-end encrypted by default (using same protocol as Signal) and there’s no way to disable encryption. On the other hand Telegram chats are by default unencrypted ... you have to specifically start a “Secret Chat” to benefit from end-to-end encryption.
Earlier quoted context omitted.
> If it's the latter, it's not vulnerable to the previous attack, but if you have a known point of reference (so you can deduce what the offset is) It sounds like this approach could be prevented by having a random fixed offset for each user, so that you have no point of reference unless you already know where that specific user is. [Removed bit about regenerating this offset infrequently.] EDIT: You could even do th…
With enough data points you'd easily figure out that offset. Just overlay each data point with map data and decide whether the location makes sense. (i.e. you're unlikely to most of the time be in the middle of a lake, farm field etc)
It's a shame that people still use Telegram when Signal is so much better, and has better credentials all around.
Earlier quoted context omitted.
It took me a while to find it on iOS, it’s under the contacts tab called “find people near by”. It doesn’t seem to work without location enabled so hopefully that would keep you safe.
Also doesn't work unless you share contacts - which .... why would you anyways?
Earlier quoted context omitted.
I definitely agree with this. Getting people to use Telegram instead of SMS or other random chat apps can be difficult but getting them to switch to Signal is basically a "not going to happen" until Signal ups their usability. Even people I've gotten to try out Signal all abandoned it. At least with Telegram, they stuck with it and still use it to this day. It'd honestly probably be easier to get Telegram to adopt Si…
Telegram's protocol itself isn't necessarily a weakness - recently, a paper was published claiming to have proved the MTProto 2.0 protocol correct. Perhaps because of how recent this was, it doesn't seem to have garnered any discussion or review anywhere. https://arxiv.org/abs/2012.03141
The ability to find user locations via triangulation is overlooked in a lot of products - it's easy to not think twice when showing a user the distance between themselves and someone else. In my own products I fix this by aggressively rounding/adding noise before the distance calculation is performed, and then rounding again afterwards, or quantizing into ranges (e.g. '0-10 miles'). Other solutions can be storing loc…
I’m also using the app on iOS, the operating system asks periodically if I want to continue sharing location in the background (in case I forget to turn it off) or I can just choose to enable it while using the app (which is what I usually do).
Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know WhatsApp is insecure while people sometimes act like Telegram is a secure platform.
I’ve heard other folks say WhatsApp is insecure. Do you (or anyone else) have specific examples or concerns?
It's a shame that people still use Telegram when Signal is so much better, and has better credentials all around.
Signal has a terrible terrible ux - most people don’t care as much as the HN-er when it comes to security - they want a chat app that just works and is feature rich