Seems they have yet to meet the Matrix Protocol.
Why Isn’t Telegram End-to-End Encrypted by Default (2017)
31–40 of 151 posts
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#32Earlier quoted context omitted.
And he is right. If you want e2e use signal, threema, or OTR/OMEMO. The majority of telegram users want convenient messaging, group chats, news channels and voice group calls. Think slack with a fast native app.
Does wanting any of this automatically mean wanting e2e is wrong or invalid?
No, but it's automatically the right tradeoff for everyone.
Security measures are always a tradeoff between convenience and security. Not everyone's tradeoffs work out evenly. Sometimes backups are a more important risk to mitigate than government surveillance.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#33Earlier quoted context omitted.
Indeed. But ever since Whatsapp started advertising e2e, people want it.
Well I'm glad to hear that e2e is a feature that's in demand. :)
That is not a good approach. Every piece of technology has it's place; requiring 2e2 encryption in a group of hundreds is a bad requirement.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#34Earlier quoted context omitted.
I'm all for end-to-end encryption, but if you have 250 people in the chat I'm not sure it'll be very effective. It only takes one of those people to leak the messages. When you get into groups with hundreds of members I think Slack and Discord are probably the dominant chat apps there.
Non room members shouldn't be able to read the text in the room. That's quite basic. As far as old messages goes, Matrix rooms do not allow new participants to see old history, unless explicitly enabled. >if you have 250 people in the chat I'm not sure it'll be very effective. It only takes one of those people to leak the messages. Ultimately, the system is only good when the members of a room deliberately leaking me…
Neither does XMPP, given it doesn't store it ;)
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#35Genuine question, and I'm certainly no expert in this - just a curious end-user, aren't the backups that WhatsApp creates and uploads to iCloud/GDrive kind of encrypted? As in, I can't simply download the backup file and access the messages and media? My understanding is that in order to restore/access said messages and media, you would need the SIM/phone number that created the backup file and would have to register…
My understanding is that WhatsApp backups are plaintext. It's true that Apple/Google can't recover your WhatsApp account with just the plaintext, but I believe they can read the messages.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#36This article touches on the core issue holding back E2E encryption today. There's currently no way for a sophisticated application to implement E2E encryption without accepting tradeoffs in terms of the product.
I'm working on starting a new company called Comm and we're trying to scale E2E. Some more context here: https://site.ashoat.com/comm/comm
(We're currently hiring!!)
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#37I don't get this: "These backups are not e2e-encrypted and get decrypted whenever(...)" Are they or are they not encrypted?
They are probably encrypted in the backend DB with a symmetric cipher on the server with a key that Telegram have access to.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#38The why doesn't matter. (the tl;dr is that they apparently never bothered to support some popular features within the context of e2ee, and believe people ultimately don't care about e2ee by default) What matters is that: - It doesn't do e2ee by default. - It is not a properly documented protocol[0]. - It is not an open protocol. - It has a history of extremely poor cryptography practices[1][2]. - It is not open sourc…
I've been exploring options with a friend, their requirements: 1) option for large groups (around 250) This drops Signal out which has a limit of 150 on groups: https://support.signal.org/hc/en-us/articles/360007319331-Gr... 2) e2e encrypted (because it sounds good, not because people actually understand what it is), including groups. This drops Telegram out: no e2e rooms. 3) handles sending photos, videos, and voice…
>handles sending photos, videos, and voice messages More or less kills XMPP, unless people are on the latest-and-greatest version of Conversations and maybe ChatSecure.
Are there any popular XMPP clients that don't support "HTTP File Upload" at this point? I went looking for a list of those that do and had to give up. They all support it now.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#39> 1) Users don’t want to lose their entire message history when they lose/change their phones so apps of this kind never become massively popular. I think this is a key point to consider for Signal and the other "good" messengers - there's ways to do secure backups, it just needs to be implemented so well that you won't miss the convenience of Google Drive backups. I tend to fall back on anecdotes a lot, but the firs…
Amazingly this is why I’m attracted to Signal and have set all chats to 1 week auto delete.
To me text chats should be ephemeral.
If I want something to stick around for years, send to email.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#40Earlier quoted context omitted.
>2) e2e encrypted As you haven't mentioned it: Supporting e2ee isn't enough. It must be the default, else the non-technically inclined will often end up not using e2ee. >As much as I dislike to admit it, this leaves Matrix, and nothing else. I'm in the same position. Never been a fan, but I have to support it, because that's really the only option, even if bloated. I also tried running a server (synapse) with similar…
> it was added way too late in the game. That is not a thing with XMPP. The very essence of it is adding things in, and OMEMO is quite good.
I'm well aware of how XMPP works as I've been using it from the start.
It is with this knowledge that I cannot recommend XMPP.
e2ee should be at the core. Not as an entirely optional extension added decades after.
As I already stated, because I want the non-technical inclined to have privacy, I can only support options where e2ee is the default.