Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Default disappearing messages

signal.org

Post reply on HN
Print view View original

71–80 of 187 posts

Re: Default disappearing messages

#71

Post by afiori »

lmm wrote: post #56
theshrike79 wrote: post #53

Earlier quoted context omitted.

My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. I keep that in mind when discussing things. If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones.

> My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. Telegram's initial marketing heavily emphasised privacy. If I search for Telegram then the very first search result blurb starts "Telegram messages are heavily encrypted". Maybe they don't explicitly claim to be E2E, but they absolutely are selling themselves as an encrypted, privacy-friendly mess…

The heavily encrypted refers to server side storage.

https://telegram.org/privacy#3-3-1-cloud-chats

> All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.

Re: Default disappearing messages

#72

Post by lmm »

afiori wrote: post #70
lmm wrote: post #67

Earlier quoted context omitted.

Secure systems are all alike; every insecure system is insecure in its own way. A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was ab…

> when their encryption didn't actually work. what are referring to here? I vaguely know about delivery bugs and protocol patches

The initial release used a homegrown crypto protocol with serious weaknesses, and the developer at least initially doubled down and tried to defend it.

Re: Default disappearing messages

#73

Post by lmm »

afiori wrote: post #69
lmm wrote: post #37

Earlier quoted context omitted.

> [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me. Is that because you assume the NSA aren't reading all your messages or you don't mind if they are? Because the whole problem with dodgy crypto is that it still seems to "work fine for me" even when it isn't.

For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinio…

> For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs.

But Telegram's whole selling point is privacy and security. If security is not your priority (which is totally reasonable!) there are plenty of other messaging apps that are much more established than Telegram, and much more honest about not being particularly privacy-oriented.

> An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app

Doesn't seem to have been a problem for e.g. WhatsApp.

> Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice.

> If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure.

Both these points seem like complete non sequiturs. If you want to avoid the app developer selling your data or providing it to governments, you need E2EE, there is no other way. Passive monitoring hasn't been a thing for about a decade, any non-joke messenger is at least using TLS, and it's not like people were using SMS/phone calls until Telegram came along with the revolutionary new idea of an internet messaging app.

Re: Default disappearing messages

#74

Post by lmm »

afiori wrote: post #71
lmm wrote: post #56

Earlier quoted context omitted.

> My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. Telegram's initial marketing heavily emphasised privacy. If I search for Telegram then the very first search result blurb starts "Telegram messages are heavily encrypted". Maybe they don't explicitly claim to be E2E, but they absolutely are selling themselves as an encrypted, privacy-friendly mess…

The heavily encrypted refers to server side storage. https://telegram.org/privacy#3-3-1-cloud-chats > All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.

Wow, that's not at all clear from their marketing. That kind of misleading statement is definitely not what I'd want to see from a privacy/security-focused product - and yet Telegram's whole marketing is about privacy/security.

Re: Default disappearing messages

#75

Post by jan_Inkepa »

medstrom wrote: post #47
EvanAnderson wrote: post #44

Earlier quoted context omitted.

My view is exactly the opposite. Having suffered from the "I thought you said..." problem (where other parties recall a verbal conversation differently than me, out of forgetfulness on either of our parts or to serve their interests) for so much of my life I welcome these ubiquitous devices that augment my memory and provide black and white clarity to what was actually said. I have no nostalgia for lossy recall and t…

Funny, I can't say I've suffered problems from that, and my conversation memory is terrible. Are you sure it's not a matter of attitude, communication style or expectations turning it into a problem for you?

I find it often useful to be able to go back and search through conversations. Even trivial things can become part of a richer back and forth if you can remember + reference them. It helps keep the oblivion of forgetting at bay, which is for me terrifying and really depressing.

People who turn on transient messaging, it's their right, and I get it, but it's also hobbling me from doing what I'm quite good at and basically exposing what's for me an upsetting functional disability, which bums me out a bit.

(If I really cared I could take notes elsewhere, yes, but jeeze that's a lot of work for daily chitchat)

Re: Default disappearing messages

#76

Post by GistNoesis »

Sorry for the confused rant that follow (Hopefully HN will auto-delete it in 42 hours ):

The variable duration of the message adds one additional layer of complexity to the already messy game of social communication.

It's not like a session at the park or a phone call that once you close it, it's over.

I already had trouble understanding the concept of ephemeral message, like you say something to me but expect me to not remember it in one hour, so why say it in the first place.

It gets even more confusing when people don't remember what they have told you in the past and change their mind.

I am also confused by the fact they acknowledge that this is pointless in an adversarial scenario. It's like submitting to the rules of social norms instead of playing reality ; But people who are fluent in social communication will instinctively use it for soft lies while others suffer trying not to infringe stupid rules.

It's like a social norm that restrict usage of external memory (and by extension internal memory). Why not make alcoholic beverage consumption or taking memory-suppressant-drugs mandatory then ?

This change of rule distort the game and not for the greater good as only cheaters will take advantage. Promises now only hold for the duration of the timer.

What value of the timer, am I supposed to put so that people are comfortable. I don't necessarily want to pressure them in answering quickly, but also I don't want to always be sending weak signals by always configuring a different default, and I don't want to handle the various other people timers preferences.

Re: Default disappearing messages

#77

Post by Y-bar »

stavros wrote: post #55
vasiliys wrote: post #48

Persistent messages seem like the obvious better default. 99.9% of my conversations have no obscene secrets, but a solid 1% have information that might be search-worthy. Hangouts / gChat seemed to get this right - extremely fast search and an "off the record" function for when you can't switch to an ephemeral alternative (usually a phone call). I know HN has a higher proportion of the reasonably-paranoid EFF-loving p…

It's not about obscene secrets, I was just a different person at 18 than I am at 40. Having what I said back then persist forever serves no purpose. Same for things I said months ago, what's the use?

> Same for things I said months ago, what's the use?

Messages in my phone are now the only remaining words from someone I once knew. I now and then scroll through them like they were an old shoe-box of letters.

I don't know (and will never be able to ask) what emotional connection they had of their own messages. I only know that I am glad to still have those...

Re: Default disappearing messages

#78

Post by skinkestek »

lmm wrote: post #67
skinkestek wrote: post #57

Earlier quoted context omitted.

In my case it is to a large degree because I don't care. Disappearing messages are to prevent my kids reading the messages between me and their mother ;-) If NSA actually read my messages that would be kind of funny. If they have such a hack I'm sure they won't spend it on me or any other Joe Sixpack. Maybe ФСБ reads it but I have a hard time believing that too. My threat model consists of (not in any particular orde…

Secure systems are all alike; every insecure system is insecure in its own way. A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was ab…

> A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure.

It is secure for my purposes.

Throwing away threat models and the meaning of secure and encrypted just to be able to define something that competes for attention as "not secure" and "not encrypted" (from other threads) isn't very high level, it is basic framing.

edit:

> Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was about privacy and encryption when their encryption didn't actually work.

Remember, when Telegram came around WhatsApp was un-encrypted. Not point-to-point encrypted, just encoded. You didn't need to know or crack a key, you just needed toknow the protocol.

Also, the main selling point of Telegram as I remember it wasn't security, it was dumb IMO, it was "we will be free (no cost) forever while WhatsApp is going to charge you money".

Finally it isn't that I don't care if my messages are read, K just cannot care if my messages are read by NSA or FSB. If they go after me nothing will stop them.

Re: Default disappearing messages

#79

Post by KingOfCoders »

Quanttek wrote: post #34
KingOfCoders wrote: post #30

Not so happy. I'm often searching Signal messages for information etc.

Well, then you don't got into the settings and configure a default disappearance timer, as the blog post describes. If you don't want to use this feature, don't use it

Thanks!

Re: Default disappearing messages

#80

Post by andrepd »

GistNoesis wrote: post #76

Sorry for the confused rant that follow (Hopefully HN will auto-delete it in 42 hours ): The variable duration of the message adds one additional layer of complexity to the already messy game of social communication. It's not like a session at the park or a phone call that once you close it, it's over. I already had trouble understanding the concept of ephemeral message, like you say something to me but expect me to…

I think you're making a wrong comparison here. Disappearing messages is not akin to forcing the other party to take memory-suppressant drugs (wtf?), it's more akin to asking them not to record your conversation.
Post reply on HN