421–430 of 501 posts
iMessage, Telegram, and Signal all get usage from me, with the vast majority of that usage weighted heavily on the former two because that’s where most people in my circles are. When comparing user experience between the three, it’s easy to see why.
Earlier quoted context omitted.
Are you pointing out that Mr. Durov is in conspiracy with... Jack Dorsey and Elon Musk?
In my opinion this has started as part of Rufo's campaign against Katherine Maher (see https://news.ycombinator.com/item?id=40341993 ), then Dorsey and Musk boosted that article because it aligns with their political views. Durov decided to add Telegram vs Signal angle in his post.
Earlier quoted context omitted.
It's only the protocol for their E2EE chats. There are two big caveats: - Facebook and Skype E2EE messages are optional, and people rarely use that option, and - Those apps collect a huge amount of data outside the contents of the messages.
Still I think mentioning the greatest data collection projects in human history in the same sentence as Signal which is supposed to fight that is not very good.
Earlier quoted context omitted.
> But the history of the Signal protocol and implementation traces back 20 years Are you sure about that? TextSecure was created more 10 years ago than 20. 20 years ago, we did not have smartphones. As I remember, TextSecure started with SMS (but that was not the Signal protocol) and added "internet" messages right after WhatsApp got bought (which was about when Telegram was started). I love the Signal protocol, but…
Signal/TextSecure (/DRA/Axolotl) has a pretty strong throughline from the "off-the-record" protocol (OTR) from 2004/2005. Signal themselves describes TextSecure as a derivative of OTR ( https://signal.org/blog/simplifying-otr-deniability/ ). It's close enough that if, say, a novel attack against OTR were discovered today, the first thing I'd want to know is if there are any implications against Signal.
Earlier quoted context omitted.
Both services are relatively insecure because they require phone authentication. In the EU at least the number can always be traced back to you if you don't buy specific burner phones. The level of encryption isn't as important anymore at that point. It is less probable you get into problems by using a service that doesn't know your identity.
> Both services are relatively insecure because they require phone authentication. That hasn't been the case for Signal for some months: https://signal.org/blog/phone-number-privacy-usernames/ You still require a phone number for sign up for Signal, but your phone number isn't visible to anyone you chat with.
That's irrelevant - the phone number is known to Signal and can be request by law enforcement. And, since it's been made pretty much impossible to buy a SIM in the EU without showing identification [0], this will allow law enforcement to link the account to you.
[0] IIRC the Netherlands is the only country left where you can buy SIMs without ID.
Earlier quoted context omitted.
Same goes for Signal devs, or any devs really. You're only stating the obvious: humans can be forced and coerced given enough motivation and resources. Singling out Telegram, or Signal, or any other service's devs is not advancing any argument forward.
There is more reason to be concerned about Telegram than most other similar services. Partly because it’s insecure by default, which makes a large percentage of conversations vulnerable. And also because the team behind it is very susceptible to pressure from the Russian government, which is especially bad when it comes to these things. Even if some of them are based out of Dubai now, it doesn’t mean that they aren’t…
Not to mention there's not much reason to trust UAE any more than there is to trust Russia.
Earlier quoted context omitted.
Of course. But the history of the Signal protocol and implementation traces back 20 years. It's good enough that Facebook, WhatsApp, and Skype use it for E2EE messages. Telegram's traces back 10 years, the first version was very bad, and both versions have had a lot of scrutiny for weird design decisions. Crypto schemes which get broken usually follow a pattern of "something smells wrong", "we have weakened it a litt…
> It's good enough that Facebook, WhatsApp, and Skype use it for E2EE messages. Wait if it's the same why don't we just use Facebook, WhatsApp and Skype instead of Signal?
The fact that Facebook, WhatsApp, etc. use the Signal Protocol kind of shows that it is an accepted standard. But of course there are many reasons to use Signal (the App) instead of those apps, for instance:
- The Signal App is open source. You can check the protocol implementation before you use it. For Facebook, WhatsApp and Skype, you have to trust them (or some audits).
- E2EE is only one part: it ensures that nobody except the recipient can read the content of your messages. But there is a whole story around the metadata. The metadata say who writes to whom, and when. It essentially helps build a social graph. Facebook is very interested in this social graph. It would appear that the Signal Foundation is not. And even if it is not perfect, Signal does a lot to try to minimize the amount of metadata it has access to (and quite obviously Facebook has a huge incentive not to do that).
This said, IMHO it is still a lot better to use WhatsApp than to use Telegram, because at least you benefit from a good E2EE.
I think Signal could stand to gain popularity by either prioritizing overall niceness and polish in their clients (especially on desktop) or by allowing third parties to build clients which prioritize those things. iMessage, Telegram, and Signal all get usage from me, with the vast majority of that usage weighted heavily on the former two because that’s where most people in my circles are. When comparing user experie…
Signal does this today by verifying phone numbers themselves, so they’d have to continue doing so centrally; “never trust the client” applies to their own client just as much as anyone else’s, and “allow unverified users to initiate contact with strangers” is the spam vector infecting all modern telephony (thus STIR/SHAKEN).
So with that need resolved, the biggest risk of third party clients would be intentionally compromised code within an attractive wrapper — but the only way to defend against that is to not allow third party clients at all.
So.. I guess I no longer support third-party clients, having worked through the timelines of what will occur. Ah well.
Earlier quoted context omitted.
Technically Signal is using their own home-rolled crypto, too – right?
Sort of, but it's heavily peer reviewed and generally regarded as very good. I really dislike the "hand rolled is bad" meme. Someone rolled all crypto. The questions are "who is doing the rolling," "do they know what they are doing," and "was it peer reviewed or directly and faithfully built from a peer reviewed design?"
Crypto is notoriously easy to get wrong, even if you know a lot about it - and most people do not. Secondly, proving something secure is pretty hard as well. If the crypto isn't a bog-standard algorithm in a well-known and reviewed implementation, assuming it to be insecure is a pretty good rule of thumb.
Go on, keep defending the overlord you believe have your best interests at heart while the other 57 of us go worry-free, using Matrix or XMPP.
You will eventually revise your opinion once you find your chat logs 20 years later in some randomly occuring IRC logs because that one guy was using an IRC bridge. You cannot critique missing guaranteed end to end encryption when effectively matrix cannot guarantee it either.
E2EE can not prevent the receivers from sharing the message (they are one of the "end"s in "end to end-encryption" after all"). The same thing could happen because one person in the group chat ends up getting some ransomware on his phone; E2EE can not prevent that.