Telegram has launched a pretty intense campaign to malign Signal as insecure

Post by ementally » Mon, May 13, 2024, 1:07 PM UTC

lynndotpy wrote: post #282

ementally wrote: post #43

Earlier quoted context omitted.

Well... if you scrolled up a bit you would have found https://discuss.privacyguides.net/t/according-to-elon-musk-s... which says Signal isn't great either.

No, it does not. Let's enumerate the purported problems: - "Elon Musk said so", which does not matter. - Signal attachments can be viewed by an attacker with local access to the client . This is not Signal's job to protect against. - Signal offers an optional `--no-sandbox` flag which only has security options if enabled on Linux. - Weaknesses in sealed sender. This is the only one that might be an actual problem (tw…

Post by slac » Mon, May 13, 2024, 1:08 PM UTC

viraptor wrote: post #288

noirscape wrote: post #126

Earlier quoted context omitted.

Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to m…

> Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. I'd argue it's not giving us any certainty. They could've moved away to escape. They could've moved away to a nice FSB-sponsored location while making good publicity. Ideally the tech should be good enough for this issue to not matter.

Post by hifromwork » Mon, May 13, 2024, 1:08 PM UTC

craigmart wrote: post #212

TacticalCoder wrote: post #66

I don't know about Telegram being nasty towards Signal but Signal brought this upon themselves. Metadata are more important than the content of the messages and yet Signal has always been about knowing your phone number, with handwaving when the subject is mentioned. Sessions, a Signal fork, had its tagline right: "Share encrypted messages, not metadata" . Signal is a metadata exchanging app and it's about collecting…

You are speaking of metadata as if all metadata is equal. Signal does collect phone numbers (even though, since usernames have been introduced [1], this can be made opt in from now on), but not the contacts or social graph, neither many other relevant metadata [2]. What they can gather from this, is only when the specified phone number registered to signal services and its last connection to the server [3]. So, if yo…

Post by OSI-Auflauf » Mon, May 13, 2024, 1:09 PM UTC

amenhotep wrote: post #267

Zedseayou wrote: post #124

Earlier quoted context omitted.

I'm not sure what the behaviour is now but certainly the default a while back was that anytime someone in your contacts joined Signal you would get a message. Imo this was a crazy behaviour that immediately told you something about certain people in your contacts in a very visible way (that they were on Signal). I couldn't tell from the settings whether this was now off by default.

Telegram has done and may still (I don't know personally) do the exact same thing. Stated noncombatively and without assumption about what argument you may or may not be making, but seems relevant to mention in this context. Astonishingly bad behaviour no matter which app!

Post by aniviacat » Mon, May 13, 2024, 1:10 PM UTC

nurumaik wrote: post #166

OSI-Auflauf wrote: post #93

Earlier quoted context omitted.

On Signal vs Telegram: Telegrams Encryption is off most of the time. They have serverside access to messages. The optional E2E is annoying to use and isnt even available on every platform. For example Tdesktop afaik still has no E2E support. (And has a very brittle software architecture.) You can't register Telegram accounts with the open source client anymore. This should be a non-Discussion. MG implying that just b…

You can buy "anonymous number" on fragment without using any client and without providing any personal information and use it as much as you can When signal becomes at least remotely as popular as telegram it will implement same protection to fight against spammers because you can't have free unrestricted registrations and don't drown in spam Telegram currently makes it as accessible as possible: either use it freely…