Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram has launched a pretty intense campaign to malign Signal as insecure

twitter.com

Post reply on HN
Print view View original

241–250 of 501 posts

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#241

Post by nottorp »

raspyberr wrote: post #119
TacticalCoder wrote: post #66

I don't know about Telegram being nasty towards Signal but Signal brought this upon themselves. Metadata are more important than the content of the messages and yet Signal has always been about knowing your phone number, with handwaving when the subject is mentioned. Sessions, a Signal fork, had its tagline right: "Share encrypted messages, not metadata" . Signal is a metadata exchanging app and it's about collecting…

But Signal specifically used phone numbers to leverage the already existing social graph on your phone. The numbers were never transferred or stored by Signal. You can literally see what information they gave when they were subpoenad: https://signal.org/bigbrother/central-california-grand-jury/

> to leverage the already existing social graph on your phone

I have little trust in an entity that "leverages the social graph" though...

Your encryption may be great, but if you act like Farmville I'm going to trust you as much as I trust those facebook games that spam your friend list.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#242

Post by rgrmrts »

ixwt wrote: post #225
noirscape wrote: post #126

Earlier quoted context omitted.

Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to m…

EDIT: Disregard below. I'm an idiot when it comes to maps. The statement regarding if the developers are still Russian I believe is still relevant. Considering the state of Saudi Arabia, having it there is marginally better, but still problematic. And if the developers are still Russian, there's nothing saying they aren't being squeezed unless their families came with them to Dubai.

Dubai is in the UAE, not Saudi Arabia

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#243

Post by TrueDuality »

gkbrk wrote: post #205
hiq wrote: post #157

Earlier quoted context omitted.

Your points have little to do with security (which is the main angle of Matthew Green's thread), especially because of reproducibility. Even then > You need to download it from the Google Play Store. Factually incorrect, just go to https://signal.org/android/apk/ (and the apk will then update itself) or build it yourself. > pushed the update to everyone but no one could inspect the source code. That was for the serve…

> Factually incorrect, just go to https://signal.org/android/apk/ (and the apk will then update itself) or build it yourself. That page tells me that the safest way is to have a Google account, with Google Play Services installed on my phone, and to download it from the Google Play Store. It then gives me an APK link after saying "Danger zone" and "most users should not do this". If the app developer tells me it's da…

Google Play, for all its failings, IS the safest way to get an APK right now.

F-Droid for as much as I love the open platform, does not provide any security guarantees about what you're downloading. It is a volunteer run project and does not have the extensive security policies and practices that Google has. From https://f-droid.org/en/about/

> Although every effort is made to ensure that everything in the repository is safe to install, you use it AT YOUR OWN RISK.

Likewise downloading and side-loading it from their website, requires you to disable some security guarantees by doing things like enabling developer mode.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#244

Post by rakoo »

vetinari wrote: post #177
pmarreck wrote: post #33

isn’t telegram the one that uses a wonky/sus custom encryption algorithm? https://words.filippo.io/dispatches/telegram-ecdh/

Well, if you think that AES-256 that MTProto uses[1] is some wonky algorithm... [1] https://core.telegram.org/mtproto

Going from "AES is safe" to "Any protocol that uses AES is safe" is the kind of leap that will ban you from any cryptography work

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#245

Post by bratwurst3000 »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

Sources please !

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#246

Post by viraptor »

FabHK wrote: post #145
Intermernet wrote: post #59

There seems to be a concerted effort to discredit Matthew's claims. Even here on HN. I find this suspicious. The Signal protocol has been heavily audited by many different people from many different countries. It's usually found to be sound. The telegram protocol has been found to have issues that are, if not malicious, amateur level mistakes. Once again, this is not my opinion. This is the result of independent audi…

Eh, split any important message into pieces, put a piece each in Signal, WhatsApp, Telegram, Threema, Line, and then the Americans, Russians, Swiss, and Koreans will each have some parts, but if you're lucky, nobody has all...

At that point you're giving the metadata to everyone. That's not a great thing if you actually care about being protected from all of them.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#247

Post by nottorp »

Razengan wrote: post #149
alexpc201 wrote: post #111

Earlier quoted context omitted.

Tell me, can you have a Signal account WITHOUT giving them your phone number?

Can you sign up for Telegram without a phone number?

Not everyone is commenting on signal vs telegram here, it may just be an opinion that the phone number requirement is dubious from both entitites.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#249

Post by lynndotpy »

cryptoboy2283 wrote: post #173

So, who has actually launched "a pretty intense" campaign here? https://twitter.com/matthew_d_green/status/17883860908411619... https://twitter.com/evacide/status/1788040276331884593 https://twitter.com/naomibrockwell/status/178863495226900939... https://twitter.com/paulmillr/status/1788563576455610552 (I'm pretty sure the list goes on)

This seems organic to me. I was a security researcher, and for years I've been telling anyone who would listen that Telegram is not as secure as their marketing says it is, while Signal is.

The reasons why are already pretty well listed in the thread above. Telegram's E2EE is hand-rolled and not the default. Signal's E2EE is always on, and it's _the_ industry standard protocol. (Outside of iMessage, I believe the Signal protocol is used on every well-adopted messaging service which offers E2EE chats.)

People also aren't aware that phone numbers and usernames are tied on Telegram. When a former friend of mine joined Telegram, I searched up his username, and found his _very_ explicit Reddit account. This identity compromise issue isn't mentioned more often.

You can add me to the list. There is no good reason to pick Telegram over Signal, unless you don't care about security. It DOES have more sticker packs.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#250

Post by cryptoboy2283 »

r721 wrote: post #192
cryptoboy2283 wrote: post #173

So, who has actually launched "a pretty intense" campaign here? https://twitter.com/matthew_d_green/status/17883860908411619... https://twitter.com/evacide/status/1788040276331884593 https://twitter.com/naomibrockwell/status/178863495226900939... https://twitter.com/paulmillr/status/1788563576455610552 (I'm pretty sure the list goes on)

Here's the other side: https://news.ycombinator.com/item?id=40301508 https://news.ycombinator.com/item?id=40336005 https://news.ycombinator.com/item?id=40330694 https://news.ycombinator.com/item?id=40308241 https://news.ycombinator.com/item?id=40299313 https://news.ycombinator.com/item?id=40298608 https://news.ycombinator.com/item?id=40279661 https://twitter.com/jack/status/1787895769183268948 https://twitter.com/elo…

Are you pointing out that Mr. Durov is in conspiracy with... Jack Dorsey and Elon Musk?
Post reply on HN