Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Default disappearing messages

signal.org

Post reply on HN
Print view View original

171–180 of 187 posts

Re: Default disappearing messages

#171

Post by afiori »

lmm wrote: post #74
afiori wrote: post #71

Earlier quoted context omitted.

The heavily encrypted refers to server side storage. https://telegram.org/privacy#3-3-1-cloud-chats > All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.

Wow, that's not at all clear from their marketing. That kind of misleading statement is definitely not what I'd want to see from a privacy/security-focused product - and yet Telegram's whole marketing is about privacy/security.

The attack telegram is worried about is the russian army invading their datacenters, threatening employees, or forced buyout (what happend to the founder previous company vk.com).

Re: Default disappearing messages

#172

Post by afiori »

lmm wrote: post #72
afiori wrote: post #70

Earlier quoted context omitted.

> when their encryption didn't actually work. what are referring to here? I vaguely know about delivery bugs and protocol patches

The initial release used a homegrown crypto protocol with serious weaknesses, and the developer at least initially doubled down and tried to defend it.

thanks, good to know

Re: Default disappearing messages

#173

Post by afiori »

lmm wrote: post #169
skinkestek wrote: post #168

Earlier quoted context omitted.

> But I think that's completely fair given that security and privacy is Telegram's supposed selling point, whereas WhatsApp never positioned itself as anything more than a way to send messages to each other. Why don't you look at discussions here and see why people use Telegram? Many, maybe most of us don't think of it as specially secure. If you ask why people use it they'll tell you it is fast, stable, almost bug f…

Like I said in the parallel thread, literally the first line of the first ad/result I get when searching for Telegram is "Telegram messages are heavily encrypted". It may not be your reason for using it but it's very much what they're pushing.

Which is true for most kind of cloud storage.

example of heavily encrypted: multiple rounds of properly configured AES with multiple keys split on multiple servers.

example of non heavily encrypted: zip archive with PaSsWoRd as password.

Re: Default disappearing messages

#174

Post by skinkestek »

afiori wrote: post #172
lmm wrote: post #72

Earlier quoted context omitted.

The initial release used a homegrown crypto protocol with serious weaknesses, and the developer at least initially doubled down and tried to defend it.

thanks, good to know

Just as long as one remembers that this was the first release of Telegram and that WhatsApp ran not weakly encrypted but actually unencrypted until about a year before these events ;-)

I don't defend Telegrams history when it comes to crypto,just pointing out that there are massive double standards here:

- WhatsApp is the good one (sending data unencrypted until 2012, and to add insult to injury they sent it on port 443)

- Telegram is the bad guy (sent data encrypted but used a dodgy algorithm early on)

Re: Default disappearing messages

#175

Post by lmm »

afiori wrote: post #173
lmm wrote: post #169

Earlier quoted context omitted.

Like I said in the parallel thread, literally the first line of the first ad/result I get when searching for Telegram is "Telegram messages are heavily encrypted". It may not be your reason for using it but it's very much what they're pushing.

Which is true for most kind of cloud storage. example of heavily encrypted: multiple rounds of properly configured AES with multiple keys split on multiple servers. example of non heavily encrypted: zip archive with PaSsWoRd as password.

> Which is true for most kind of cloud storage.

Sure, it's not actually saying a lot. My point is that's the very first thing in their marketing message, so they're very much advertising themselves as secure/private. By comparison if I pick an arbitrary cloud storage service - Dropbox - their first line is "Bring your files and cloud content together with the tools your team wants to use".

Re: Default disappearing messages

#176

Post by lmm »

skinkestek wrote: post #174
afiori wrote: post #172

Earlier quoted context omitted.

thanks, good to know

Just as long as one remembers that this was the first release of Telegram and that WhatsApp ran not weakly encrypted but actually unencrypted until about a year before these events ;-) I don't defend Telegrams history when it comes to crypto,just pointing out that there are massive double standards here: - WhatsApp is the good one (sending data unencrypted until 2012, and to add insult to injury they sent it on port…

Encryption is one of those things where no algorithm is better than a bad algorithm - if you know your data is being sent in the clear then you can at least act appropriately. And the attitude of the Telegram developers when they were called out is particularly concerning.

Re: Default disappearing messages

#177

Post by mike_hock »

Vinnl wrote: post #59
mike_hock wrote: post #43

Earlier quoted context omitted.

> The default, if I'm reading the article correctly, is to not disappear messages. But that is exactly what the default should be and what's needed to thwart large-scale blanket surveillance of the whole population. If the mere fact that ephemeral messages are enabled raises a flag, that kind of defeats (part of) the purpose.

Defaults are set on your phone I think, so unless your phone is compromised (in which case the default setting for disappearing messages really isn't the thing you should be worrying about), it doesn't really provide a signal in large-scale blanket surveillance.

If every phone (or most phones) collect all messages, because it's the default, only either phone of the conversing parties needs to be eventually compromised to leak the entire conversation, even years later.

Re: Default disappearing messages

#178

Post by skinkestek »

lmm wrote: post #176
skinkestek wrote: post #174

Earlier quoted context omitted.

Just as long as one remembers that this was the first release of Telegram and that WhatsApp ran not weakly encrypted but actually unencrypted until about a year before these events ;-) I don't defend Telegrams history when it comes to crypto,just pointing out that there are massive double standards here: - WhatsApp is the good one (sending data unencrypted until 2012, and to add insult to injury they sent it on port…

Encryption is one of those things where no algorithm is better than a bad algorithm - if you know your data is being sent in the clear then you can at least act appropriately. And the attitude of the Telegram developers when they were called out is particularly concerning.

> Encryption is one of those things where no algorithm is better than a bad algorithm

Absolutely not universally true:

Encryption that protect against everyone except NSA is still infinitely much better than sending plaintext.

Internet banking can't work with plaintext.

It can work perfectly fine even if everyone knows NSA could break it.

Re: Default disappearing messages

#179

Post by Vinnl »

mike_hock wrote: post #177
Vinnl wrote: post #59

Earlier quoted context omitted.

Defaults are set on your phone I think, so unless your phone is compromised (in which case the default setting for disappearing messages really isn't the thing you should be worrying about), it doesn't really provide a signal in large-scale blanket surveillance.

If every phone (or most phones) collect all messages, because it's the default, only either phone of the conversing parties needs to be eventually compromised to leak the entire conversation, even years later.

Sure, and if everybody uses WhatsApp and stores all messages on their phones, the entire conversation can eventually be leaked as well. If you don't want conversations to be stored, you can choose not to store them just like you can choose to use Signal. I don't see the problem here.

Re: Default disappearing messages

#180

Post by h_anna_h »

Vinnl wrote: post #167
h_anna_h wrote: post #150

Earlier quoted context omitted.

Isn't it something that the sender decides?

The person who initiates the conversation does, yes; that is already the case today. However, you can change the conversation settings not to do that. Of course, if the other party would prefer history to be deleted, it's generally nice to go along with that.

> However, you can change the conversation settings not to do that.

Can I do that without the other party knowing or being able to override it? I would check it myself but signal requires a phone number so I can't.

Post reply on HN