Live data from Hacker News

Telegram has launched a pretty intense campaign to malign Signal as insecure

twitter.com

301–310 of 501 posts

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#301
Here's some global context from the past week or so. I'm just piecing this together, maybe someone more informed can comment:

- The Polish spy chief is warning that Russia intends to invade a NATO state in the near future [0]

- Poland is strengthening its border with Belarus [1]

- Germany is considering conscripting all 18 year olds in the face of what it perceives as Russian aggression [2]

- Russia warns of "enormous danger" if NATO troops are sent to Ukraine [3]

- Russia threatens to use "special ammunition" against NATO [4]

Headlines were starting to read like this immediately before the Russian invasion of Ukraine. We saw troop buildups and threats for a while before any action was taken.

Amidst all this, there's a sudden push to move people off of Signal and onto the Russian-developed Telegram, which is widely regarded as less secure and is even not encrypted by default.

Telegram now operates out of the UAE, which has long been a partner with Russia. Wikipedia has this to say about the strengthening of UAE-Russia relations since the invasion of Ukraine:

> trade between the two nations strengthened with many Russians relocating to the UAE to invest in real estate, business, or "escape financial restrictions in Europe". Trade between the two countries has doubled to $5 billion since 2020 and there are approximately 4,000 companies with Russian roots that are operating within the country.

So, my take here is that this push toward telegram smells pretty bad given the timing. Telegram has always had kind of a smell about it, given that it rolled its own crypto and given Durov's involvement with the VK social network which was, in Durov's POV (again according to Wikipedia), taken over by Putin's faction.

Personally, I like Signal. I have some of the same concerns folks here have brought up. But it's been well vetted by experts and is highly regarded by people I trust. That doesn't mean you have to like Signal. Its crypto improvements have been spread to other apps, and many people are probably just fine using something like iMessage.

And while I don't know anything about Durov or his motives, I have yet to see any successful cryptography app anywhere in the world that didn't eventually have to compromise with a government. And Russia seems especially good at applying pressure, with a history of institutional tips and tricks that go back at least to the Soviet secret police, and possibly even further back to the Tsars.

As much as I think we can't objectively trust the US government in all matters, I think we can generally trust the cryptography experts. They tend to be skeptical of all governments when it comes to cryptography, even in democracies.

So that's my two cents. I wouldn't switch from Signal to Telegram. If you're on Telegram and you have especially interesting activity (like you fight in a war), then you should probably assume that Russia can see everything you're doing. That may change if Telegram gets the sort of robust cryptographic scrutiny Signal has. If you're not warring, you're not doing exotic fancy crimes, and you live in a democracy, you're probably fine with either app but possibly a little better off with Signal or iMessage.

[0] https://www.newsweek.com/russia-ready-launch-offensive-nato-...

[1] https://abcnews.go.com/International/wireStory/poland-streng...

[2] https://www.telegraph.co.uk/world-news/2024/05/11/germany-co...

[3] https://www.telegraph.co.uk/world-news/2024/05/11/germany-co...

[4] https://timesofindia.indiatimes.com/world/rest-of-world/form...

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#302

So since Signal has a board member who worked at a place that some people don't like then the Signal app must be backdoored/compromised/honeypot? That's one hell of a leap. How far has our requirement for evidence fallen?

Yes. The crew pushing for this is 100% bad faith, it’s pretty contemptible.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#303
post #90

Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.

Why is home-rolled crypto inherently insecure?

In the case of Telegram, MTProto’s implementation leaves a lot to be desired[1][2].

Additionally, home rolled crypto does not usually get the kind of security review from the cryptography community which makes it very likely that bugs of all kinds exist.

[1] https://words.filippo.io/dispatches/telegram-ecdh/ [2] http://unhandledexpression.com/2013/12/17/telegram-stand-bac...

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#304
post #259

Earlier quoted context omitted.

Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to m…

> I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default I think it's a great approach instead: the secure, end to end encryption is there and it's ready to be used. You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed.

> You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed.

So, in those 1% of the cases when you actually need it, you're instantly flagging yourself as doing something fishy? Because if it ever comes down to it, good luck proving otherwise in a court.

That's like the whole point of why it should be on by default. Not because me making dinner plans is something super-secret that needs to be e2e-encrypted, but because those two scenarios need to be indistinguishable from each other for e2e to be effective.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#305
post #75

Another thing that wasn't pointed out: Du Rove said "Signal messages have been exploited against them in US courts or media." This would be the same case for Telegram as well, if someone has your phone. I believe that Signal can have a lock on the client, and the database is encrypted. The other part that Du Rove conveniently left out: Signal went against the US courts and won [0]. When subpoenaed to give all user in…

The database is encrypted, and the password is right next to the database in a json file.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#307
post #151

Earlier quoted context omitted.

Hm f-droid provides privacy friendly https://fdroid.gitlab.io/metrics/ for some time now. I'm not sure what sort of "control" they have over the Play Store compared to f-droid, but I'd rather have a trusted 3rd party do the building transparently and verifyable.

F-Droid uses a package maintainer-esque process where the maintainers of F-Droid can intervene and prevent an update to an app from reaching users if it's deemed to be malicious or to add anti-features. It's of particularly high need on mobile since popular apps, even those who were originally FOSS, are sold to scummy publishers who fill it with ads and subscription schemes (oft called anti-features, since removing t…

> With signal, I'm gonna guess it's mainly a; the Play Stores checks and balances are much less invasive than the sort of thing an F-Droid maintainer might check for. (As I understand it, Google Plays checks mostly are anti-exploit and keyword scans.)

It might have been b as well – Signal did keep their server code proprietary for many months to add their custom cryptocurrency to it, and added this cryptocurrency for microtransactions into the app as well. There may be many more features like this planned, some of which F-Droid might oppose.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#308

Earlier quoted context omitted.

Yeah, the pro-encryption and pro-privacy people sure seem to be trying to tell us something about Telegram

Perhaps you're right, and all of them have the "greater good" intentions, but it's ridiculous how their "regular reminders" popped up in the same 24h interval

> have the "greater good" intentions,

It's getting harder and harder to tell because bot activity has gotten so good, but Matthew Green has been around a while and is a genuine old school crypto dude. There is a group of people who just believes that crypto and privacy are good things and want to promote them.

The reason it gets harder is because you can spin up a handful of "expert" accounts shilling for this or that privacy VPN or bitcoin scam etc. So it's hard to just pull up a list of statements and know whether it has any weight. In this case, Matthew Green has a lot of weight because I've followed him for a while and I know what he's about.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#309
post #83

Earlier quoted context omitted.

Not sure if metadata is more important but ok. Signal has launched support to use nicknames instead of phone numbers although it's true this took a long time. I think Telegram is very wide-spread for running large group chats and communities, a use case that Signal is not interested in. Personally, I want my chats end to end encrypted and I'm grateful to Signal for pioneering this and inspiring Whatsapp, facebook mes…

Not sure if you've got your sequence of events straight. End-to-end encryption was added to Whatsapp after it was bought by Facebook, before the co-founder of Whatsapp left to found Signal. It's not as simple as Signal inspiring Facebook and Whatsapp, the sequence of events happened in reverse order.

I think this not wrong but mildly misleading.

Whatsapp started encrypting messages after significant security issues in ~2012

It was purchased by Facebook under initially some administration separation terms in ~2014?

In 2016 it added e2e encryption. If I recall this was controversial because it limits fb ad potential on users.

I guess what I'm trying to say is that the timeline seems to me to still be pointing towards >

Again you're not factually wrong, but I hope my restating of the timeline makes it more clear why i I think your reverse order point doesn't tell the same story.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#310

Earlier quoted context omitted.

> security dark pattern - make privacy a big selling point, but then don't activate the security by default pretty similar to whatsapp. they boast end to end encryption, but business account (all of them now) uses the facebook server's key, so that the business can give access to several other clients to answer customers. they still call it end to end encryption, and this was actually the last crap the original found…

“All of them” in what sense? I use WhatsApp dozens of times a day, and interact with business accounts every couple months at most.

Good for you, you probably do not live in a country under digital colonialism where the gov allowed facebook et al to force internet providers to tax the pop with absurdly low and expensive data limits and then "not count" things like facebook and whatsapp and one music app.

In most of the global south, 100% of business have a whatsapp. In those places it pretty much replaced telephone and the green whatsapp icon is now what the current young generation recognize as the we did the black telephone outline on a business front next to a number.

and if you own a business, or is self employed, it is even worse: you live by that app.

Post reply on HN