Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Isn’t Telegram End-to-End Encrypted by Default (2017)

telegra.ph

Post reply on HN
Print view View original

81–90 of 151 posts

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#81

Post by kitkat_new »

pmlnr wrote: post #34
snvzz wrote: post #28

Earlier quoted context omitted.

Non room members shouldn't be able to read the text in the room. That's quite basic. As far as old messages goes, Matrix rooms do not allow new participants to see old history, unless explicitly enabled. >if you have 250 people in the chat I'm not sure it'll be very effective. It only takes one of those people to leak the messages. Ultimately, the system is only good when the members of a room deliberately leaking me…

Neither does XMPP, given it doesn't store it ;)

> Neither does XMPP, given it doesn't store it ;)

and how is it achieved when you want that? Standard feature that is expected by people using Telegram, Matrix, Slack, etc.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#82

Post by m4lvin »

pmlnr wrote: post #54
upofadown wrote: post #38

Earlier quoted context omitted.

>handles sending photos, videos, and voice messages More or less kills XMPP, unless people are on the latest-and-greatest version of Conversations and maybe ChatSecure. Are there any popular XMPP clients that don't support "HTTP File Upload" at this point? I went looking for a list of those that do and had to give up. They all support it now.

Well... that's complicated. On it's own, XEP-0363 (HTTP File Upload) and OMEMO both work well everywhere, even in my horribly overpatched Pidgin. But if you put the two together, Conversations, for example, will encrypt the message and encrypt the upload as well. My Pidgin then will handle the message well, but display an url starting with aesgcm:// leading to the still encrypted file. The question is then: is the co…

Encrypting the message AND the upload seems a no-brainer to me, if you want to call it E2EE. If the upload would not be encrypted then the (admin of the) server running XEP-0363 HTTP File Upload could see the contents.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#83

Post by pampa »

kitkat_new wrote: post #46
pampa wrote: post #4

Earlier quoted context omitted.

e2e does not prohibit it. But makes it hard or impossible even for an advanced user (i tried moving my whatsapp data from iphone to android once, not sure of the current status with signal). Telegram is all about convenience, security is just bolt on. Everybody says they care about security, but hardly any TG user does it, because it is inconvenient. Install it on any any new device, confirm your phone number with an…

This just is not true. The fact that you are writing this, clearly shows you don't know of Element/Matrix. When you use Matrix, and open a web client, the only thing you have to do is 1) logging in and 2) providing a password, key file, scan a QR code, OR compare Emojis - and you get everything synced. The same holds for any type of client. I barely see a loss of convenience, let a lone something being hard or imposs…

You are right, I never used Matrix. I guess i have to check it out. Missed it. Usable client apps for martix are what, 1.5 years old?

Signal seems to have been around for ages. OTP even longer

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#84

Post by snvzz »

emptysongglass wrote: post #61
snvzz wrote: post #8

The why doesn't matter. (the tl;dr is that they apparently never bothered to support some popular features within the context of e2ee, and believe people ultimately don't care about e2ee by default) What matters is that: - It doesn't do e2ee by default. - It is not a properly documented protocol[0]. - It is not an open protocol. - It has a history of extremely poor cryptography practices[1][2]. - It is not open sourc…

Can you do your research before posting statements like these? They hurt a messenger that has done a great deal of good for protestors and other political rebels. If I take the kindest interpretation of your statements, they are factually wrong in whole but true in part. That is, the Telegram server code is closed source, yes. But Telegram clients and the protocols they use to "speak" are all either open source or do…

I do not like it (I prefer Matrix, where accounts are not tied to phone lines), but I am ok with Signal, as it is open source, it is always e2ee and using it really offers privacy.

Telegram, on the other hand, is not open source, nor does it do e2ee by default. Having to explicitly select "new secret chat" ultimately means the non-technical inclined can and will use it wrong, getting no privacy whatsoever.

Therefore, I cannot support the idea that Telegram is any better than WhatsApp or Discord.

Regarding "open protocol", I suspect that what you think it means is not what an open protocol actually is.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#85

Post by pmlnr »

kitkat_new wrote: post #74
pmlnr wrote: post #30

Earlier quoted context omitted.

> it was added way too late in the game. That is not a thing with XMPP. The very essence of it is adding things in, and OMEMO is quite good.

try having verified e2ee conversations with XMPP - good luck.

Doing it actively. Try Conversations.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#86

Post by snvzz »

kitkat_new wrote: post #74
pmlnr wrote: post #30

Earlier quoted context omitted.

> it was added way too late in the game. That is not a thing with XMPP. The very essence of it is adding things in, and OMEMO is quite good.

try having verified e2ee conversations with XMPP - good luck.

I've been having them for over a decade.

The "only" problem is that it isn't easy, and thus most people do not use them at all.

Therefore, I cannot recommend XMPP.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#87

Post by kitkat_new »

t-writescode wrote: post #63
kitkat_new wrote: post #31

Seems they have yet to meet the Matrix Protocol.

Matrix is a protocol. Servers are horrible to set up and you have to find federations to join. Telegram, Signal and others are centralized, so you join one, you're a member of all.

Actually setting up a server is not difficult. Check out https://www.youtube.com/watch?v=dDddKmdLEdg for setting one up with video conferencing.

Finding a server is not difficult - in the worst case you take the default server.

And given the server is not locked down, you have access to all other servers (and their users) as well. So I don't really get where you are going with this.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#88

Post by pmlnr »

m4lvin wrote: post #82
pmlnr wrote: post #54

Earlier quoted context omitted.

Well... that's complicated. On it's own, XEP-0363 (HTTP File Upload) and OMEMO both work well everywhere, even in my horribly overpatched Pidgin. But if you put the two together, Conversations, for example, will encrypt the message and encrypt the upload as well. My Pidgin then will handle the message well, but display an url starting with aesgcm:// leading to the still encrypted file. The question is then: is the co…

Encrypting the message AND the upload seems a no-brainer to me, if you want to call it E2EE. If the upload would not be encrypted then the (admin of the) server running XEP-0363 HTTP File Upload could see the contents.

I agree. The part I don't see is then what plugin should handle which part, and how.

Most XMPP clients are plugin based as well. Should the OMEMO plugin then look for aesgcm:// urls, download it, and decrypt it, or should the http upload plugin look for the availability of encryption and try to decrypt?

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#89

Post by pmlnr »

kitkat_new wrote: post #81
pmlnr wrote: post #34

Earlier quoted context omitted.

Neither does XMPP, given it doesn't store it ;)

> Neither does XMPP, given it doesn't store it ;) and how is it achieved when you want that? Standard feature that is expected by people using Telegram, Matrix, Slack, etc.

Not by the people used to WhatsApp. That doesn't do it either.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#90

Post by snvzz »

Arathorn wrote: post #71
pmlnr wrote: post #20

Earlier quoted context omitted.

I've been exploring options with a friend, their requirements: 1) option for large groups (around 250) This drops Signal out which has a limit of 150 on groups: https://support.signal.org/hc/en-us/articles/360007319331-Gr... 2) e2e encrypted (because it sounds good, not because people actually understand what it is), including groups. This drops Telegram out: no e2e rooms. 3) handles sending photos, videos, and voice…

Matrix's resource utilisation is improving very rapidly at the moment. Dendrite is still in beta, and hasn't been tuned that much yet, but every release has had a substantial improvement. In other words, if you're not using today's release (0.3.5) you're on stale data. For context, dendrite.matrix.org (running 0.3.5) has ~5K users on it, and is in ~3K rooms spanning 162K users... and its RAM usage is stable at 488MB…

Hydrogen looks extremely promising due to its low resource usage, but urgently needs an easy way to verify its session from Element and easily migrate its keys.
Post reply on HN