Live data from Hacker News

Telegram is anything but secure; even Facebook is safer, says Signal founder

phonearena.com

21–30 of 45 posts

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#21

Earlier quoted context omitted.

This is a bizarre take. What's considered "serious security" depends on the needs of the person and the kind of info they're transmitting. To tell people that there is no advantage to use Signal instead of much less secure alternatives because your Area 51 security requirements aren't met is actively harmful and bad advice.

LOL, "Area 51." Whether Signal or Telegram, you rely completely on trust in the central third party for security. The choice of whether to use Signal or Telegram should depend on which of these organizations you trust the most (their leadership, their internal employees, and their security from external infiltration), NOT based on what technology they use in the client & server. But you simply shouldn't use either be…

> you don't need to rely completely on trust in third parties because both produce reproducible open source clients (at least on android, not sure about apple) and if someone hands you at least a client that you can verify doesn't send out non-encrypted data you have some legitimate safety compared to a service that doesn't do that at all.

This is technically correct but not in a way that matters. Signal pushes everyone to depend on Google to distribute the software. Through this system, it isn't even just Signal, but also Google and anyone who breaks into Google that can inject a compromised client.

You don't know that the client on the other side isn't getting its Signal app through Google.

More importantly -- even if you DO know the client on the other side -- the WHOLE POINT of Signal is this massive network effect where you don't need to coordinate with the other side.

If we're talking about the much smaller network-within-a-network of users who installed Signal from a non-Google source -- it's no longer compelling. Why bother with it? Less error-prone to get both sides to set something else up.

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#22

Signal is just as insecure because they can push any code they want to anyone they want to spy on.

They have reproducible builds on Android if you are that paranoid.

That doesn't help because the other end can be compromised.

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#23
Not everything needs to be super secure. I can sit and talk with a group of friends at a cafe, and anyone can listen to us, and see that we're talking to each other. If we want to talk about something secret we can go somewhere private that's less convinient but more secure.

Same thing with messaging online. Everyday nonsense can use whatever app you want, and if there's something you really don't want anyone else knowing you can use a different solution. I think the trade-off is worth it for most people.

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#25

Quoted post unavailable.

On 2), just because the FBI can’t just ask for the data doesn’t mean other threat actors don’t have and can’t get readily-available access.

I’d also consider the possibility that the document is planted and not fully accurate.

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#27

Earlier quoted context omitted.

They have reproducible builds on Android if you are that paranoid.

That doesn't help because the other end can be compromised.

well nothing you can do can stop the other person from leaking your conversations.

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#28

Earlier quoted context omitted.

> Signal is just as insecure because they can push any code they want to anyone they want to spy on. What now? That's not "just as insecure", since Telegram can also "push any code they want to anyone they want to spy on," but they don't need to because your data is already plaintext on their servers. Signal not being perfectly secure does not make it "just as insecure."

I mean, if you were at all serious about security you'd just not use it. So it's just as insecure.

> I mean, if you were at all serious about security you'd just not use it. So it's just as insecure.

That doesn't make any sense at all. Being "serious about security" doesn't mean letting the perfect be the enemy of the good (which is what you're doing).

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#29
Full remote code execution in signal desktop via an node context enabled and an XSS in a react application, rendering user messages with __dangerouslySetInnerHTML. A similar XSS in the webview on mobile signal allowed at the very least, compromising all of the contacts and messages of the user.

I wouldn't take anything that Signal developers/founders say about their product or others' products security seriously.

Re: Telegram is anything but secure; even Facebook is safer, says Signal founder

#30

Earlier quoted context omitted.

I mean, if you were at all serious about security you'd just not use it. So it's just as insecure.

> I mean, if you were at all serious about security you'd just not use it. So it's just as insecure. That doesn't make any sense at all. Being "serious about security" doesn't mean letting the perfect be the enemy of the good (which is what you're doing).

It's not good though. It has these flaws I just described. You can avoid those flaws simply by using other software.
Post reply on HN