Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Isn’t Telegram End-to-End Encrypted by Default (2017)

telegra.ph

Post reply on HN
Print view View original

101–110 of 151 posts

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#101

Post by kitkat_new »

t-writescode wrote: post #95
kitkat_new wrote: post #87

Earlier quoted context omitted.

Actually setting up a server is not difficult. Check out https://www.youtube.com/watch?v=dDddKmdLEdg for setting one up with video conferencing. Finding a server is not difficult - in the worst case you take the default server. And given the server is not locked down, you have access to all other servers (and their users) as well. So I don't really get where you are going with this.

> Actually setting up a server is not difficult. And yet you point me to a YouTube video, rather than a link on their website. The documentation itself strongly encourages setting up your own server to have your own user information and then federating into a system, and yet, the documentation doesn't seem to describe, in friendly terms, how to do that. It might be easy to set up, but I've had trouble discovering all…

> And yet you point me to a YouTube video, rather than a link on their website.

So you can see it

> and yet, the documentation doesn't seem to describe, in friendly terms, how to do that.

mind to expand that?

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#102

Post by olah_1 »

t-writescode wrote: post #95
kitkat_new wrote: post #87

Earlier quoted context omitted.

Actually setting up a server is not difficult. Check out https://www.youtube.com/watch?v=dDddKmdLEdg for setting one up with video conferencing. Finding a server is not difficult - in the worst case you take the default server. And given the server is not locked down, you have access to all other servers (and their users) as well. So I don't really get where you are going with this.

> Actually setting up a server is not difficult. And yet you point me to a YouTube video, rather than a link on their website. The documentation itself strongly encourages setting up your own server to have your own user information and then federating into a system, and yet, the documentation doesn't seem to describe, in friendly terms, how to do that. It might be easy to set up, but I've had trouble discovering all…

> and yet, the documentation doesn't seem to describe, in friendly terms, how to do that.

I've gotten mixed signals from matrix people on this.

On one hand, they discourage people that aren't skilled in sys admin work to set up a server. On the other hand, they emphasize the simplicity of setting up a server and want as many as possible.

I tend to think that the mixed signals are due to the fact that they sell matrix in a SAAS business model[1], so they want it to be difficult in some ways, but easy in others.

[1]: https://element.io/matrix-services

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#103

Post by emptysongglass »

hiq wrote: post #97
emptysongglass wrote: post #61

Earlier quoted context omitted.

Can you do your research before posting statements like these? They hurt a messenger that has done a great deal of good for protestors and other political rebels. If I take the kindest interpretation of your statements, they are factually wrong in whole but true in part. That is, the Telegram server code is closed source, yes. But Telegram clients and the protocols they use to "speak" are all either open source or do…

> My message history is extremely precious to me and Telegram does an admirable job protecting it How would you know without E2EE? A Telegram sysadmin could copy all your messages from non-secret chats and you would never know. The lack of E2EE is also why many (including security experts) recommend WhatsApp over Telegram.

I ought to have qualified "protected" (or used a more suitable word): protected in the sense that it has stayed intact no matter how many devices I have moved between.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#104

Post by noxer »

dhsysusbsjsi wrote: post #39
meibo wrote: post #3

> 1) Users don’t want to lose their entire message history when they lose/change their phones so apps of this kind never become massively popular. I think this is a key point to consider for Signal and the other "good" messengers - there's ways to do secure backups, it just needs to be implemented so well that you won't miss the convenience of Google Drive backups. I tend to fall back on anecdotes a lot, but the firs…

Amazingly this is why I’m attracted to Signal and have set all chats to 1 week auto delete. To me text chats should be ephemeral. If I want something to stick around for years, send to email.

The blog post is old. Telegram now has auto delete for chats for e2e chats and even manual delete including deleting your partners messages if you want to (on both sides - obviously not in groups). So yes the quick chat that you dont want to be archived anywhere can be deleted quickly and easily. Ofc this does not prevent the other side from storing it in advance but its rather unlikely and It would no longer be possible to proof that yous send these messages. It would just be a text file that could be crafted. So depending on what you sent you have plausible deniability even if a backup exists.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#105

Post by llimos »

srhngpr wrote: post #73
coolspot wrote: post #66

Earlier quoted context omitted.

WhatsApp backup is unencrypted on both iOS/iCloud and Android/GDrive.

I keep hearing this, but is there an actual reliable source that confirms it? If it were that easy, then I could technically restore anyone's GDrive backup from WhatsApp on my Android phone simply if I got access to the same Google account, but I believe this is not possible as you have to also verify the phone number via SMS.

They say it themselves

https://faq.whatsapp.com/android/chats/about-google-drive-ba...

"Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive."

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#106

Post by CodeGlitch »

pmlnr wrote: post #20
snvzz wrote: post #8

The why doesn't matter. (the tl;dr is that they apparently never bothered to support some popular features within the context of e2ee, and believe people ultimately don't care about e2ee by default) What matters is that: - It doesn't do e2ee by default. - It is not a properly documented protocol[0]. - It is not an open protocol. - It has a history of extremely poor cryptography practices[1][2]. - It is not open sourc…

I've been exploring options with a friend, their requirements: 1) option for large groups (around 250) This drops Signal out which has a limit of 150 on groups: https://support.signal.org/hc/en-us/articles/360007319331-Gr... 2) e2e encrypted (because it sounds good, not because people actually understand what it is), including groups. This drops Telegram out: no e2e rooms. 3) handles sending photos, videos, and voice…

How about email?

Seriously... setting up your own email server. All users use a web client (there are tonnes out there, with the option of using thicker clients).

Bots can be used to organise the groups, add new users, etc.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#107

Post by CodeGlitch »

CodeGlitch wrote: post #106
pmlnr wrote: post #20

Earlier quoted context omitted.

I've been exploring options with a friend, their requirements: 1) option for large groups (around 250) This drops Signal out which has a limit of 150 on groups: https://support.signal.org/hc/en-us/articles/360007319331-Gr... 2) e2e encrypted (because it sounds good, not because people actually understand what it is), including groups. This drops Telegram out: no e2e rooms. 3) handles sending photos, videos, and voice…

How about email? Seriously... setting up your own email server. All users use a web client (there are tonnes out there, with the option of using thicker clients). Bots can be used to organise the groups, add new users, etc.

By the way before anyone shouts at me, I know email isn't E2E encrypted. As I've said before on HN: if you are looking to communicate securly, you shouldn't be using anyone else's infrastructure. That includes Signal et al.

Most people chatting to their friends and family don't need that level of security.

If you don't want China listening to you: don't use someone else's system.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#108

Post by noxer »

People complain here on HN that public or semi-public telegram groups are not e2e encrypted. Yes, your HN comment isn't either. And there is no point in encrypting it if its mean to be read by others. Telegram isn't just a messenger. Its a social media like platform with millions of groups and channels you can find trough telegram or they are linked form other places.

Would there be a use case for a fully private e2e group chat? sure, I have a family chat which probably counts as fully private. But even if it could be e2e it would not be because my family wants to have backups and seamless switch between devices. They are also unable to reliable protect they devices form third party accesses trough malware/spyware etc. All my other groups are public or semi public (means link can only be found if you are part of the right internet community) The messages there are no other than the comments here.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#109

Post by xorcist »

pmlnr wrote: post #88
m4lvin wrote: post #82

Earlier quoted context omitted.

Encrypting the message AND the upload seems a no-brainer to me, if you want to call it E2EE. If the upload would not be encrypted then the (admin of the) server running XEP-0363 HTTP File Upload could see the contents.

I agree. The part I don't see is then what plugin should handle which part, and how. Most XMPP clients are plugin based as well. Should the OMEMO plugin then look for aesgcm:// urls, download it, and decrypt it, or should the http upload plugin look for the availability of encryption and try to decrypt?

Client authors should do what Conversations do. End users should probably stick with Conversations, for now.

There will always be hacky and badly implemented clients. It comes with the idea of an open specification. That doesn't mean we should use them as a point of comparison.

Post reply on HN