Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram Web Apps for Bots

core.telegram.org

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Telegram Web Apps for Bots

#101

Post by blep-arsh »

slondr wrote: post #65
AdrenalinMd wrote: post #60

Be cautious when using Telegram for important matters. I recently examined a situation where confidential messages from high-ranking Moldovan officials were leaked through Telegram. Unlike WhatsApp and Signal, which offer end-to-end encryption by default, protecting your messages even in case of a SIM swap, Telegram does not offer the same level of security. A SIM swap or a breach in their system can lead to message…

Telegram is not less secure, this is misinformation. Telegram is less secure by default ; it has a worse UX for secure messaging, as a deliberate choice to improve default UX for new users.

I tried using secure chats but the UI is nearly unusable. E.g. secure chats are established between two specific devices and can't migrate, so it would make sense to let a currently "active" client (the one the user is currently interacting with) respond to an incoming chat request. Problem is, secure chats were being unpredictably picked up by random devices logged in to my account, so most of the time I couldn't even see any messages.

Re: Telegram Web Apps for Bots

#102

Post by emptysongglass »

NayamAmarshe wrote: post #73
AdrenalinMd wrote: post #60

Be cautious when using Telegram for important matters. I recently examined a situation where confidential messages from high-ranking Moldovan officials were leaked through Telegram. Unlike WhatsApp and Signal, which offer end-to-end encryption by default, protecting your messages even in case of a SIM swap, Telegram does not offer the same level of security. A SIM swap or a breach in their system can lead to message…

I'm honestly tired of everyone spreading all this misinformation about telegram and all these assumptions that lead everyone nowhere. 1. SIM Swap is a physical device security issue, not something that telegram or any other app for that matter, is responsible for. Telegram already provides cloud password, comments like these wouldn't ever mention it. 2. Telegram using cloud encryption instead of E2EE by default does…

I really don't care if people use Signal but as a Telegram user I'm exhausted by this hatefest that appears every time Telegram announces a new release. Moxie is a terrible source because he very recently was the CEO of Signal, a competitor, and uses words like "plaintext" as a misleading perjorative for any encryption not E2EE.

If you want and need E2EE please God use some other messenger but why don't we stick to the topic of the feature announcement and save the hate, folks?

If you're a user of Signal, I support your choice to use Signal. Please support our choice to use Telegram.

Re: Telegram Web Apps for Bots

#103

Post by stiltzkin »

AdrenalinMd wrote: post #60

Be cautious when using Telegram for important matters. I recently examined a situation where confidential messages from high-ranking Moldovan officials were leaked through Telegram. Unlike WhatsApp and Signal, which offer end-to-end encryption by default, protecting your messages even in case of a SIM swap, Telegram does not offer the same level of security. A SIM swap or a breach in their system can lead to message…

No proof you examined this with "high-ranking Moldovan officials".

Also Moxie is extremely biased.

Re: Telegram Web Apps for Bots

#104

Post by stiltzkin »

V__ wrote: post #45

I really wish Signal would try something similar, with a strong focus on security and data-protection. I just don't want my data in Telegram's hands.

If people are ok with their data on Facebook, HN, Discord or Twitter the same can be on Telegram.

Re: Telegram Web Apps for Bots

#105

Post by stiltzkin »

Moldoteck wrote: post #8
aww_dang wrote: post #3

Would love to see this platform opened up. I've been recommended by users, but telegram always demands an app install for account creation. App install + mobile number as a login/username is a deal breaker for me. Horrible experience trying to explain why this isn't a sane security model to users.

And by default chats are not e2e encrypted. And even if you want e2e, it's not syncing between devices. Also groups are not e2e. Signal is cooler for encryption, heck, even fb messenger or Whatsapp. Featurewise yes, telegram is miles ahead

Telegram is more akin to Discord or forum platforms thanks to supergroups than it was to Signal. If you want privacy you use the right tool.

Re: Telegram Web Apps for Bots

#106

Post by stiltzkin »

HelixEndeavor wrote: post #23
konart wrote: post #7

Earlier quoted context omitted.

>mobile number as a login/username Well, you can buy a number (+888) on fragment and use one instead of your own.

Fragment? You mean Telegram's attempt to cash in on the cryptocoin scam, with their own walled-garden system and marketplace where it's currently hovering around $30 to buy a number, when it's genuinely cheaper to just get a Google Voice number or some prepaid burner phone number? Fragment, the service that is currently banned in the USA for being such an obvious scam?

Elaborate cryptocoin scam (I guess you are anti-crypto), buying with Fragment is anonymous and easier than Google Voice. I agree on being banned on U.S.A, blame that to bad crypto regulations.

Re: Telegram Web Apps for Bots

#107

Post by titaniczero »

ikt wrote: post #81
titaniczero wrote: post #70

Earlier quoted context omitted.

IMO if your app is less secure than your competition by default, the app is less secure, period. Telegram is said to have been given authorities access to user data [1], despite the fact that they advertise the opposite. I guess that’s what happens when your app is not encrypted E2E by default. Also, they have used their own encryption algorithm in the past (I don’t know now) instead of the well known and proven algo…

> Also, they have used their own encryption algorithm in the past (I don’t know now) why not just look this info up before replying ?

Because I was in a hurry and I don't have unlimited time, while providing info about the past that I already have was still valuable for the point

Re: Telegram Web Apps for Bots

#108

Post by AdrenalinMd »

stiltzkin wrote: post #103
AdrenalinMd wrote: post #60

Be cautious when using Telegram for important matters. I recently examined a situation where confidential messages from high-ranking Moldovan officials were leaked through Telegram. Unlike WhatsApp and Signal, which offer end-to-end encryption by default, protecting your messages even in case of a SIM swap, Telegram does not offer the same level of security. A SIM swap or a breach in their system can lead to message…

No proof you examined this with "high-ranking Moldovan officials". Also Moxie is extremely biased.

? You may still find the dump of messages online. Is this enough of a proof for you? Something that wouldn't happen if those officials were using WhatsApp or another app that has E2E encryption by default.

https://www.wired.com/story/moldova-leaks-google-privacy-set...

Re: Telegram Web Apps for Bots

#109

Post by NayamAmarshe »

AdrenalinMd wrote: post #91
NayamAmarshe wrote: post #75

Earlier quoted context omitted.

> WhatsApp is vastly superior to Telegram in terms of E2E encryption. I must reiterate that this is a baseless claim because no one can see WhatsApp's source code and going by the track record of Facebook as a company, I'd rather choose to reject this statement than accept it as a possibility.

The argument regarding "source code" is misleading and not entirely relevant. It's worth noting that Telegram's backend is also closed source, yet its supporters often overlook this fact. Decompiling and inspecting mobile apps is relatively simple, so if there were any issues with the WhatsApp client, they would likely have been uncovered already. As for Telegram, its messages are stored in plain text on their server…

> It's worth noting that Telegram's backend is also closed source, yet its supporters often overlook this fact.

Backend is never verifiable. It's a moot point. Signal's backend is open source yet they always release the sources late. Their servers were running entirely different code for a year and they even injected some cryptocurrency related features which weren't reflected in the source code.

Backend is always unverifiable, open source or not.

> Decompiling and inspecting mobile apps is relatively simple

Not so much when WhatsApp obfuscates binaries on purpose.

On top of that, the T&C clearly forbid you from doing it.

> As for Telegram, its messages are stored in plain text on their servers

Absolutely false. Telegram's cloud encryption algorithm has already been audited by independent researchers.

Calling symmetric encryption as "plain text", is disingenuous.

> This means that if Russian secret services were to gain access to Telegram's backend, they could easily read all the messages.

I guess Russia's telegram ban doesn't matter then? Nor Durov's fight with the Russian government. He actually moved to another country to stop the Russian government from having access to the servers.

It's totally fine to understand your security context and the security your messaging medium provides but it's not good to misrepresent facts and use terms that mislead people.

Re: Telegram Web Apps for Bots

#110

Post by [deleted] »

emptysongglass wrote: post #102
NayamAmarshe wrote: post #73

Earlier quoted context omitted.

I'm honestly tired of everyone spreading all this misinformation about telegram and all these assumptions that lead everyone nowhere. 1. SIM Swap is a physical device security issue, not something that telegram or any other app for that matter, is responsible for. Telegram already provides cloud password, comments like these wouldn't ever mention it. 2. Telegram using cloud encryption instead of E2EE by default does…

I really don't care if people use Signal but as a Telegram user I'm exhausted by this hatefest that appears every time Telegram announces a new release. Moxie is a terrible source because he very recently was the CEO of Signal, a competitor, and uses words like "plaintext" as a misleading perjorative for any encryption not E2EE. If you want and need E2EE please God use some other messenger but why don't we stick to t…

[deleted]
Post reply on HN