Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram has launched a pretty intense campaign to malign Signal as insecure

twitter.com

Post reply on HN
Print view View original

121–130 of 501 posts

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#121

Post by yodsanklai »

TacticalCoder wrote: post #52
dangoodmanUT wrote: post #4

Telegram has always felt like the catch-up of the messenger apps. I don't know a single person who uses it.

I don't get this. I'm in the EU and nearly everybody I know has Telegram. Telegram has a huge advantage versus WhatsApp: it's not Meta. Then the Telegram UI is really excellent. When you tell people all your friends and family are using it and that's it's not from Facebook, they usually install it on the spot. Then they're hooked.

I don't mind WhatsApp being Meta but Telegram is more lightweight and UI is far superior (for instance, ability to edit messages). Unfortunately, most people still use WhatsApp, you can't really avoid using it.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#122

Post by hcks »

treprinum wrote: post #100
imjonse wrote: post #90

Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.

Why is home-rolled crypto inherently insecure?

It’s not been audited by CIA approved programmers

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#123

Post by baq »

School-Cotton wrote: post #91
vbezhenar wrote: post #31

Earlier quoted context omitted.

Kazakhstan.

That makes sense, AFAIK Telegram is most popular in the post-Soviet countries.

That in itself is a red flag. Things don't 'just happen' in those places. Don't ask me how I know.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#124

Post by Zedseayou »

OSI-Auflauf wrote: post #98
TacticalCoder wrote: post #66

I don't know about Telegram being nasty towards Signal but Signal brought this upon themselves. Metadata are more important than the content of the messages and yet Signal has always been about knowing your phone number, with handwaving when the subject is mentioned. Sessions, a Signal fork, had its tagline right: "Share encrypted messages, not metadata" . Signal is a metadata exchanging app and it's about collecting…

Signal has got Usernames now. You can block number discovery. You can't resolve username to number. Your main account ID internally is not your number anymore. If 2 users add you using 2 different links or usernames. Its now harder to confirm its the same account.

I'm not sure what the behaviour is now but certainly the default a while back was that anytime someone in your contacts joined Signal you would get a message. Imo this was a crazy behaviour that immediately told you something about certain people in your contacts in a very visible way (that they were on Signal). I couldn't tell from the settings whether this was now off by default.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#125

Post by benoliver999 »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

This isn't entirely untrue, particularly the part about source code releases lagging, but I would say:

- You can download an apk from signal that self-updates

- Telegram isn't encrypted by default and uses a home-brew protocol

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#126

Post by noirscape »

ixwt wrote: post #75

Another thing that wasn't pointed out: Du Rove said "Signal messages have been exploited against them in US courts or media." This would be the same case for Telegram as well, if someone has your phone. I believe that Signal can have a lock on the client, and the database is encrypted. The other part that Du Rove conveniently left out: Signal went against the US courts and won [0]. When subpoenaed to give all user in…

Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern.

The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to my knowledge, Telegram will outright co-operate with law enforcement agencies to just hand over unencrypted communications. I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#127

Post by shiandow »

Quiark wrote: post #83
TacticalCoder wrote: post #66

I don't know about Telegram being nasty towards Signal but Signal brought this upon themselves. Metadata are more important than the content of the messages and yet Signal has always been about knowing your phone number, with handwaving when the subject is mentioned. Sessions, a Signal fork, had its tagline right: "Share encrypted messages, not metadata" . Signal is a metadata exchanging app and it's about collecting…

Not sure if metadata is more important but ok. Signal has launched support to use nicknames instead of phone numbers although it's true this took a long time. I think Telegram is very wide-spread for running large group chats and communities, a use case that Signal is not interested in. Personally, I want my chats end to end encrypted and I'm grateful to Signal for pioneering this and inspiring Whatsapp, facebook mes…

Not sure if you've got your sequence of events straight. End-to-end encryption was added to Whatsapp after it was bought by Facebook, before the co-founder of Whatsapp left to found Signal.

It's not as simple as Signal inspiring Facebook and Whatsapp, the sequence of events happened in reverse order.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#128

Post by lyu07282 »

troupo wrote: post #26
dangoodmanUT wrote: post #4

Telegram has always felt like the catch-up of the messenger apps. I don't know a single person who uses it.

As with any messenger, it depends on countries and regions and groups of people. Everyone in my friend group is using it. In terms of functionality, speed, fluidity of the interface everyone is trying to catch up to Telegram. And doing a half-assed job of it

I don't think Signal is even trying tbh

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#129

Post by abdellah123 »

sschueller wrote: post #22

I don't trust either side and having a cryptography expert located in Baltimore, MD trying to prove that the other side is wrong seems just as off as a Russian owner trying to prove the opposite. In the end it doesn't matter if you are using a smart phone from Apple or Google as your soft-keyboard is such an easy target there is no need to decrypt anything.

-__- I need to make my own OS

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#130

Post by nicoco »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

> 2. Signal has sent legal threats to repositories that package Signal. The repos either need to confuse users by offering the client under other package names or remove it.

Not that I really want to defend Signal (XMPP FTW!), but the legal threats were about using the Signal name, not making an unofficial client per se. I know a bit about it because I develop an alternative signal client (a signal-XMPP gateway to be more accurate). That said, they don't help 3rd party client devs at all.

Post reply on HN