It seems like a twitter thread of multiple messages. How can I read the rest of the messages, not just /1? There's no links to them.
I use threadreader app for this.
Telegram has launched a pretty intense campaign to malign Signal as insecure
331–340 of 501 posts
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#332Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.
Why is MTProto considered "home-rolled" but the Signal Protocol isn't? Both are boutique and written from scratch to fit their respective systems.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#333Earlier quoted context omitted.
> Factually incorrect, just go to https://signal.org/android/apk/ (and the apk will then update itself) or build it yourself. That page tells me that the safest way is to have a Google account, with Google Play Services installed on my phone, and to download it from the Google Play Store. It then gives me an APK link after saying "Danger zone" and "most users should not do this". If the app developer tells me it's da…
Do you disagree? The main issue I see with sideloads is that you don’t get automatic updates. I’d do that for an app I built myself, but not if the app is in the Play Store.
With Signal you actually do. The APK gotten from their website isn't the same from GPlay. It has an auto updater (will prompt you with a notif when a new version comes out, which you can click to install), and doesn't come with a FCM push notification system.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#334Earlier quoted context omitted.
This doesn't affect the user that downloads these from distro repos or F-Droid because every single update they get comes from the source code. There is never a lag even for 1 second because without the source code there are no builds. Pretty much all the packages on Linux repos come from package maintainers taking upstream source code, removing parts they don't like and then building that. This is a normal part of p…
Yes and thats why users spend sometimes months on old builds. Also which distro packages Telegram? Fedora doesn't. Debian does but at times it was so old the client crashed from receiving server comms because it wasn't fully compatible. It actually crashed as in segfault.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#335Earlier quoted context omitted.
Both Russians and Ukrainians use Telegram, including confidential messaging with their agents on the foreign territory. So that's a prove enough for me, that it's safe enough.
Which bits of this war scream “good judgement and opsec” to you? https://www.nytimes.com/2023/01/04/world/europe/ukraine-russ... > Ukrainian artillery targets Russian soldiers by pinpointing their phone signals. Despite the deadly results, Russian troops keep defying a ban on cellphone use near the front.
The part where they make up stories about the other side doing dumb shit in order to boost/maintain their team's morale.
It's especially critical to drip-feed feel good news when you losing.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#336Earlier quoted context omitted.
Not sure if you've got your sequence of events straight. End-to-end encryption was added to Whatsapp after it was bought by Facebook, before the co-founder of Whatsapp left to found Signal. It's not as simple as Signal inspiring Facebook and Whatsapp, the sequence of events happened in reverse order.
I think this not wrong but mildly misleading. Whatsapp started encrypting messages after significant security issues in ~2012 It was purchased by Facebook under initially some administration separation terms in ~2014? In 2016 it added e2e encryption. If I recall this was controversial because it limits fb ad potential on users. I guess what I'm trying to say is that the timeline seems to me to still be pointing towar…
Your explanation is definitely better than mine. I just wanted to rebuke the notion that it was Signal who inspired Whatsapp to use e2e.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#337Earlier quoted context omitted.
this is honestly quite surprising... why are they so adamant? we know telegram is not super safe, but at least is not facebook.
Facebook actually has had optional E2EE with the Signal protocol since at least 2016 (in my experience), as "secret chats". This puts it on a better security standing than Telegram.
Telegram has a similar feature I believe.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#338Earlier quoted context omitted.
Why is home-rolled crypto inherently insecure?
It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily. It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementatio…
It’s insecure if done by your average full stack developer, that barely passed high school math. That’s why the usual mantra. It’s waaay different when done by math experts specialized in this topic, as is the case with telegram.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#339Earlier quoted context omitted.
No, it does not. Let's enumerate the purported problems: - "Elon Musk said so", which does not matter. - Signal attachments can be viewed by an attacker with local access to the client . This is not Signal's job to protect against. - Signal offers an optional `--no-sandbox` flag which only has security options if enabled on Linux. - Weaknesses in sealed sender. This is the only one that might be an actual problem (tw…
>Given how the posted described the optional `--no-sandbox` flag as "no sandbox on Linux", it's clear that they don't understand anything they're sharing, and they just want to spread FUD. Could you elaborate as you seem to be more "knowledgeable". This flag is clear at what it does and shouldn't be shipped into production. https://no-sandbox.io/ You can have a look where they specifically chose to force it https://g…
You're right. It seems I am eating my words on that item, the `--no-sandbox` flag does seem to be on in most Linux installs. From context and search, it looks necessary for it to work on Debian.
Can confirm with `cat /usr/share/applications/signal-desktop.desktop`.
This still would require a pretty sophisticated attack to take advantage of, but I wouldn't rule it out as an attack surface. (We regularly see iPhone exploits that attack font and image rendering, after all.)
I'll amend my post given this.
Re: Telegram has launched a pretty intense campaign to malign Signal as insecure
#340> Telegram has launched a pretty intense campaign to malign Signal as insecure, with assistance from Elon Musk I got a bit confused here! Didn't Musk support and encourage people to "Use Signal" three years ago?! https://twitter.com/elonmusk/status/1347165127036977153