Earlier quoted context omitted.
Yes: End-to-end encryption is technically quite difficult, but politically and legally feasible (at least currently, at least in most countries). Simply not cooperating with law enforcement is technically moderately difficult, but politically and legally impossible. Between a difficult and an impossible option, the rational decision is to pick the difficult one.
Is there a nice solution for multiparty (n >= 3) end-to-end encryption?
Is Telegram really an encrypted messaging app?
201–210 of 609 posts
Re: Is Telegram really an encrypted messaging app?
#202Earlier quoted context omitted.
You can coherently argue that encryption doesn't matter, but you can't reasonably argue that Telegram is a serious encrypted messaging app (it's not an encrypted messaging app at all for group chats), which is the point of the article. The general attitude among practitioners in the field is: if you have to reason about how the operator will handle legal threats, you shouldn't bother reasoning about the messenger at…
> if you have to reason about how the operator will handle legal threats, you shouldn't bother reasoning about the messenger at all. That's true. You need to run your own platform people. XMPP is plenty simple, plenty powerful, and plenty safe -- and even your metadata is in your control. Just self host. There's no excuse in 2024. Wake up people! Why should the arrest of someone else affect YOU?
Self-hosting is terrible in that it gives Mike, the unbeknownst creepy tech guy in the group 100% control over the metadata of their close ones. Who talks to whom, when etc. It's much better to either get rid of that with Tor-only p2p architecture (you'll lose offline-messaging), or to outsource hosting to some organization that doesn't have interest in your metadata.
The privacy concern Green made was confidentiality of messages. There is none for Telegram, and Telegram should have moderated content for illegal stuff because of that. They made a decision to become a social media platform like Facebook, but they also chose not to co-operate with the law. Durov was asked to stop digging his hole deeper back in 2013, and now he's reaping what he sow.
Re: Is Telegram really an encrypted messaging app?
#203Earlier quoted context omitted.
> and earning some crypto You are not answering my main concern. Again, you snick in crypto into the discussion. Why? We have decentralized stuff. Email, xmpp, matrix, the fediverse, all this works without this web3/crypto stuff. Those things are not perfect, including their decentralized aspect (sometimes to the point of doubting that decentralization really works well, although I personally think decentralization i…
Because crypto is literally how entities on a decentralized network get paid in an autonomous network. It's not via cash transfers. It's not via bank transfers. Or having accounts in some central bank. Look at FileCoin and IPFS, for instance. Once you automate the micropayments and proofs of spacetime, it becomes a cryptocurrency. And then the providers of services can sell it to the next consumers. Just because you…
Or just like, advertisement. ActivityPub, Matrix, PeerTube, NextCloud and Urbit are all fully decentralized and let any instance host monetize themselves however they want.
Decentralized services, even for-profit ones, are not synonymous with cryptocurrency. Stop spreading misinformation to promote an unrelated topic.
Re: Is Telegram really an encrypted messaging app?
#204Earlier quoted context omitted.
> you can install a reproducible build of Telegram and be sure it's end-to-end encrypting things. This is incorrect. The construction for group chats in Telegram is not e2e at all. The construction for dm’s is considered dubious by many cryptographers. It does not matter if you can reproduce a non-e2e encrypted message scheme, you must still trust the servers which you have no visibility on. Trustworthy e2e is table…
The reproducible build of Telegram lets you evaluate the code doing end-to-end encryption. Once you satisfy yourself it's doing this kind of encryption without implementation-level backdoors, then you don't need to worry about servers reading it (except for #5 above). I didn't claim it encrypted "group chats". I said "things". If you want me to be specific, the "things" are individual 1-1 end-to-end encrypted chats.
Software auditors use deployed binaries as a matter of course.
They’d do so even if reproducible builds are on offer because the code and the binary aren’t promised to be the same even with reproducible builds and validating that they are can be more problematic than the normal case of auditing binaries.
Re: Is Telegram really an encrypted messaging app?
#205Earlier quoted context omitted.
Is there a nice solution for multiparty (n >= 3) end-to-end encryption?
Have the room owner create an AES 256 key, send it to all Party members via 1:1 e2ee, encrypt room messages with that AES key.
IIRC Signal just has each group member send each group message to each recipient with the standard pair-wise encryption keys. It's the message's headers that lets the recipient know it's intended for the group and not the 1:1 group.
Re: Is Telegram really an encrypted messaging app?
#206Earlier quoted context omitted.
Signal has probably the worst UX of any messaging app. It also used to require sharing phone numbers to add contacts, which imo is already a privacy violation. Telegram is fast, responsive, gets frequent updates, has great group chat, tons of animated emojis, works flawlessly on all desktop and mobile platforms, has great support for media, bots, and a great API, allows edits and deleting messages for all users, and…
Signal also allows edits and deletions.
Re: Is Telegram really an encrypted messaging app?
#207Earlier quoted context omitted.
Also, iMessage is very secure...but then all your stuff is backed up on iCloud servers unless you specifically disable it. That includes all your iCloud encryption keys and plaintext messages. Worse, iPhones immediately start backing up to iCloud when set up for a new user - the only way to keep your network passwords and all manner of other stuff from hitting iCloud servers is to set the phone up with no network con…
Luckily, microwave ovens make easy Faraday cages.
Oh, you meant... oh.
Re: Is Telegram really an encrypted messaging app?
#208Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...
> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.
The UAE requires decryption keys as part of their Telco regulations.
If Telegram can operate in the UAE without VPN (and it can), then at the very least the UAE MoI has access.
They (and their shadow firms like G42 and G42's shadow firms) were always a major buyer for offensive capabilities at GITEX.
On that note, NEVER bring your personal phone to DEFCON/Blackhat or GITEX.
Edit: cannot reply below so answering here
Cybersecurity conferences.
DEFCON/Blackhat happen during the same week, so you have a lot of script kiddies who lack common sense trying to pwn random workloads. They almost always get caught (and charged - happens every year), but it's a headache.
GITEX is MENA and Asia's largest cybersecurity conference. You have intelligence agencies from most of the Middle East, Africa, Europe, and Asia attending, plus a lot of corporate espionage because of polticially connected MSSPs as well as massive defense tenders.
Re: Is Telegram really an encrypted messaging app?
#209Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...
> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.