Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

41–50 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#41

Post by lxgr »

jeroenhd wrote: post #30
sharpshadow wrote: post #15

Only the secret chat is e2e encrypted. All the other chat options are not. I think calls are also not encrypted since they appear in the normal chat history not in the e2e chat. Obviously if your phone is compromised your e2ee chat is not safe.

Calls seem tm be e2e encrypted: https://core.telegram.org/api/end-to-end/video-calls No idea how secure the encryption is, but calling someone on Telegram is safer than sending texts.

Depends on who your adversary is and how much you trust their protocol (some weird homegrown thing with clever/questionable cryptographic choices, the last time I checked) and implementation. Your texts don't generally run through Telegram's infrastructure, for example.

Re: Is Telegram really an encrypted messaging app?

#42

Post by episteme »

331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

I do wonder if this would hold up though, if telegram stored each character of your chat in a different country, would a single country not be able to force them to hand over the data and either fine them or force them to stop operating if they wouldn't share the full chat? It seems like a loophole but I don't know what the precedent is.

Re: Is Telegram really an encrypted messaging app?

#43

Post by lxgr »

taikahessu wrote: post #32
lxgr wrote: post #18

Earlier quoted context omitted.

> If telegrams encryption is so bad why is Pavel Durov under arrest? He's under arrest precisely because it is bad enough that Telegram is in a position to share data with law enforcement, but it chooses not to.

Or maybe he is sharing with the other guys.

Possibly so, but I doubt that that's why he's currently being held.

It's probably not enough for French authorities to know that some other country's equivalent is getting a copy of all messages and metadata when they want it themselves.

Re: Is Telegram really an encrypted messaging app?

#44

Post by lxgr »

A4ET8a8uTh0 wrote: post #10

It is weirdly fascinating that this question has to be answered on a semi-regular basis. I am not sure if it is more of an insight into humans, ephemeral nature of software or concern that something major has changed.

It's an unfortunate reminder in that propaganda sometimes works very well.

Re: Is Telegram really an encrypted messaging app?

#45

Post by tamimio »

331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

That’s Telegram's CEO saying how he and his employees were “persuaded and pressured” by US FBI agents to integrate open-source libraries into Telegram (1).. There are a lot of questions to ask, like if the open-source libraries are indeed compromised, among other things. I take it as this arrest was the final straw to pressure him to give up and hand over some “needed” data, as all the accusations I read are laughable. Instagram is full of human trafficking and minor exploitation, drug dealers, and worse. The same goes with other social media, and I don’t see Elon or Zuck getting arrested. I am confident that this arrest is to obtain specific information, and after that, he will be released, or spend 20 years if he doesn’t comply.

(1) https://youtu.be/1Ut6RouSs0w?t=1082

Re: Is Telegram really an encrypted messaging app?

#47

Post by EGreg »

StrLght wrote: post #25
331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

Problem with this claim is that it's hardly verifiable. Telegram's backend is closed source, and the only thing you can be sure of is that their backend sees every message in plaintext.

[flagged]

Re: Is Telegram really an encrypted messaging app?

#48

Post by tptacek »

331c8c71 wrote: post #13

I am null at cryptography but thie following does not sound too bad as a default tbh. And I think it is misleading to focus solely on e2ee and not mention the distributed aspect. https://telegram.org/faq#q-do-you-process-data-requests > To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that…

You can coherently argue that encryption doesn't matter, but you can't reasonably argue that Telegram is a serious encrypted messaging app (it's not an encrypted messaging app at all for group chats), which is the point of the article. The general attitude among practitioners in the field is: if you have to reason about how the operator will handle legal threats, you shouldn't bother reasoning about the messenger at all.

Re: Is Telegram really an encrypted messaging app?

#50

Post by mr_mitm »

ahmedbaracat wrote: post #11

Are there any pointers for work to try to make metadata private (I.e encrypted)? I was recently very curious about this question and asked similar ones here: https://news.ycombinator.com/item?id=41267877 https://news.ycombinator.com/item?id=41270863 On a side note, I was just recommending Telegram as alternative to WhatsApp (but I did mention that we need to enable Private chats for E2E). It is definitely not an idea…

Why didn't you recommend signal?
Post reply on HN