Is Telegram really an encrypted messaging app? • Hacker News Board

Re: Is Telegram really an encrypted messaging app?

#101

Post by dtx1 » Sun, Aug 25, 2024, 8:37 PM UTC

yarg wrote: post #87

lxgr wrote: post #54

Earlier quoted context omitted.

Yes: End-to-end encryption is technically quite difficult, but politically and legally feasible (at least currently, at least in most countries). Simply not cooperating with law enforcement is technically moderately difficult, but politically and legally impossible. Between a difficult and an impossible option, the rational decision is to pick the difficult one.

Is there a nice solution for multiparty (n >= 3) end-to-end encryption?

Have the room owner create an AES 256 key, send it to all Party members via 1:1 e2ee, encrypt room messages with that AES key.

Re: Is Telegram really an encrypted messaging app?

#102

Post by EGreg » Sun, Aug 25, 2024, 8:37 PM UTC

jazzyjackson wrote: post #92

EGreg wrote: post #47

Earlier quoted context omitted.

[flagged]

I downvoted for whataboutism

I respect someone who downvotes and explains why.

I wish the downvote button would require at least a private message to the person of why they are being downvoted. (Upvote could have an optional message).

Otherwise it's the most toxic feature on HN as it promotes extreme groupthink activism.

Re: Is Telegram really an encrypted messaging app?

#103

Post by mihaaly » Sun, Aug 25, 2024, 8:37 PM UTC

tamimio wrote: post #9

It’s not encrypted by default, and even if it were encrypted, you should never trust any connected device with anything important. That being said, Telegram is hands down the best communication platform right now. It is feature-rich, with features implemented years ago that are only now being added to other platforms. It has normal chatting/video calls, groups, channels, and unlimited storage in theory, all for free.…

As far as I see there was no criticism targeted at anything else than the encryption part.

Re: Is Telegram really an encrypted messaging app?

#104

Post by jraph » Sun, Aug 25, 2024, 8:37 PM UTC

EGreg wrote: post #47

StrLght wrote: post #25

Earlier quoted context omitted.

Problem with this claim is that it's hardly verifiable. Telegram's backend is closed source, and the only thing you can be sure of is that their backend sees every message in plaintext.

[flagged]

What do web3 and crypto moneys have anything to do with the discussion?

Decentralized protocols have existed for a very long time. Email have existed since the 70s. Telephone is also arguably decentralized and have existed for even longer.

Re: Is Telegram really an encrypted messaging app?

#105

Post by lxgr » Sun, Aug 25, 2024, 8:37 PM UTC

yarg wrote: post #87

lxgr wrote: post #54

Earlier quoted context omitted.

Yes: End-to-end encryption is technically quite difficult, but politically and legally feasible (at least currently, at least in most countries). Simply not cooperating with law enforcement is technically moderately difficult, but politically and legally impossible. Between a difficult and an impossible option, the rational decision is to pick the difficult one.

Is there a nice solution for multiparty (n >= 3) end-to-end encryption?

Arguably WhatsApp's protocol scales reasonably well (nice description in this survey paper: [1]), at least well enough for maximum WhatsApp group sizes (times up to four devices per participant).

[1] https://eprint.iacr.org/2017/713.pdf

Re: Is Telegram really an encrypted messaging app?

#106

Post by kasey_junk » Sun, Aug 25, 2024, 8:39 PM UTC

EGreg wrote: post #76

tptacek wrote: post #48

Earlier quoted context omitted.

You can coherently argue that encryption doesn't matter, but you can't reasonably argue that Telegram is a serious encrypted messaging app (it's not an encrypted messaging app at all for group chats), which is the point of the article. The general attitude among practitioners in the field is: if you have to reason about how the operator will handle legal threats, you shouldn't bother reasoning about the messenger at…

[flagged]

> you can install a reproducible build of Telegram and be sure it's end-to-end encrypting things.

This is incorrect. The construction for group chats in Telegram is not e2e at all. The construction for dm’s is considered dubious by many cryptographers.

It does not matter if you can reproduce a non-e2e encrypted message scheme, you must still trust the servers which you have no visibility on.

Trustworthy e2e is table stakes for this for that reason. Reproducible builds aren’t because we can evaluate a bunch of different builds collected in the wild and detect differences in implementation. This is the same thing we’d do if reproducible builds were in effect.

There are lots of reasons splitting jurisdictions makes sense but you wrote a whole bunch of words that fall back to “hope Telegram doesn’t change their protections in the face of governmental violence”.

Re: Is Telegram really an encrypted messaging app?

#107

Post by [deleted] » Sun, Aug 25, 2024, 8:39 PM UTC

yarg wrote: post #87

lxgr wrote: post #54

Earlier quoted context omitted.

Yes: End-to-end encryption is technically quite difficult, but politically and legally feasible (at least currently, at least in most countries). Simply not cooperating with law enforcement is technically moderately difficult, but politically and legally impossible. Between a difficult and an impossible option, the rational decision is to pick the difficult one.

Is there a nice solution for multiparty (n >= 3) end-to-end encryption?

[deleted]

Re: Is Telegram really an encrypted messaging app?

#108

Post by qskousen » Sun, Aug 25, 2024, 8:40 PM UTC

tamimio wrote: post #98

qskousen wrote: post #81

Earlier quoted context omitted.

Stealing someone's phone number wouldn't give you any Signal data, as all the messages have perfect forward secrecy, though, right? And all contacts would see an alert that your security number had changed. Not completely foolproof, and I would like Signal to use something other than phone numbers for accounts, but it's pretty good.

Knowing someone's phone number is enough to potentially compromise it. Sophisticated methods can involve zero-click attacks, where just sending you an SMS that you won’t even see can lead to a compromised device. You can check how Tucker got his Signal conversation exposed. Matrix is far better in terms of security than Signal, but Matrix is far behind compared to Telegram features.

That's a good point. I looked into using Matrix before I switched to Signal, but the user experience just in creating an account was pretty abysmal, at least at the time. As I was recommending it to non-tech people, I ended up going with Signal.

Re: Is Telegram really an encrypted messaging app?

#109

Post by tsimionescu » Sun, Aug 25, 2024, 8:40 PM UTC

EGreg wrote: post #76

tptacek wrote: post #48

Earlier quoted context omitted.

You can coherently argue that encryption doesn't matter, but you can't reasonably argue that Telegram is a serious encrypted messaging app (it's not an encrypted messaging app at all for group chats), which is the point of the article. The general attitude among practitioners in the field is: if you have to reason about how the operator will handle legal threats, you shouldn't bother reasoning about the messenger at…

[flagged]

> On the question of balancing privacy and security, there are in fact solutions, but you have to get away from the idea of a centralized police force / centralized government, and think in terms of a free market of agencies, that can decrypt limited evidence only with a warrant and only if they provide a good reason. The warrant could be due to an AI at the edge flagging stuff, but the due process must be followed and be transparent to all

What does this mean? How can "we" move away from centralized states to "a free market of agencies"? How can there be a "market" of police forces, even in principle? Who are the customers in this imagined market? Who enforces the laws to keep it a free market?

At first glance, this sounds like libertarian fan fiction, to be honest, but I am curious.

Re: Is Telegram really an encrypted messaging app?

#110

Post by as1mov » Sun, Aug 25, 2024, 8:41 PM UTC

LudwigNagasena wrote: post #79

as1mov wrote: post #70

Earlier quoted context omitted.

Anecdotal evidence, so take this with a grain of salt - I work with a bunch of people from Ukraine and almost all of them exclusively use Telegram to keep up with the news and family back home. From talking to them for a while, it's mostly because it's free, has excellent support for sync across multiple devices (including audio, video and other media), has support for proxies to circumvent any kind of blocking, publ…

> doesn't require any personal identifier Do they still not require ID when you buy a SIM card in Ukraine?

Actually I was wrong. Just checked and Telegram does require a phone number to sign up. I haven't used it myself much, but was relaying the general reasons why regular people use it.