Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

231–240 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#231

Post by maqp »

mfiro wrote: post #175

In my opinion, Telegram is more of a social network than a messenger. There are many useful channels and in many countries, it plays an important role in sharing information. If we look at it from this point of view, e2ee does not seem very important. We should also not forget that, in the time when all social media (Reddit, X, Instagram etc.) close their APIs, Telegram is one of the only networks that still has a fr…

That's the dangerous part. It's a messaging app that took in the function of a social media platform. It did so without robust security features like end-to-end encryption yet it advertised itself as heavily encrypted. Like Green stated in his blog post, users expect that to mean only recipient can read what you say, i.e. end-to-end encryption.

Telegram would be fine if it advertised itself as a public square of the internet, like Twitter does. Instead, it lures people into false sense of security for DMs and small group chats, which is what Green's post and thus this thread is ultimately about.

Free API doesn't mean anything until they fix what's broken, i.e. provide meaningful security for cases where there's reasonable expectation of it.

Re: Is Telegram really an encrypted messaging app?

#232

Post by Account_Removed »

jijji wrote: post #228
mubu wrote: post #222

Earlier quoted context omitted.

Sorry, but as someone who's completely out of the loop with these things. What's DEFCON/Blackhat or GITEX about and why shouldn't you bring your personal phone? I'm genuinely interested.

defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked

[dead]

Re: Is Telegram really an encrypted messaging app?

#233

Post by rhelz »

waynecochran wrote: post #66
rhelz wrote: post #46

Fascinating. I might have missed it, but I don't think the author mentioned the possibility of steganography. Just code the encrypted text such that it resembles a normal conversation.

Would you use an image for this? Is there a clever way to do this with text?

You could use an image. But you could use text as well. E.g. you could agree on a code phrase to be said when some "dirty deed done dirt cheap" has been completed. Or you could encode a binary string by alternating British English spellings with American English Spellings: e.g. "color" means 0, "colour" means 1; "gray" means 0, "grey" means 1, etc etc. and then just use those alternate spellings in a normal conversation.

Re: Is Telegram really an encrypted messaging app?

#234

Post by maqp »

sundarurfriend wrote: post #148
kitkat_new wrote: post #2

The worst thing is that almost every non-techie who uses Telegram thinks Telegram in general is e2ee.

Not a single person I know who uses Telegram cares about or thinks of it as e2ee. Whether "techie" or "non-techie" (whatever the definition of that is). People use it because it has a nice interface, was one of the first to have good "sticker" message support (yes, a lot of people care about that kind of stuff), and of course because of the good old network effect. It's only on HN I ever see people set up Telegram as…

You could also ask about whether they think it's private. And if they say yes, ask them what it means. Does it mean only sender and intended recipients can read the message, or is it fine if the service has someone check the content. Would they agree on the notion "it's OK my nudes I send to my SO are up for grabs for anyone who hacks Telegram's servers", or do they think should Telegram plug this gaping hole.

Also, people tend to state they have nothing to hide, when they feel they have nothing to fight with. But I can't count the number of times I've seen a stranger next to me on a bus cover their chat the second I sit next to them. Me, a complete random person with no interest in their life is a threat to them.

Re: Is Telegram really an encrypted messaging app?

#235

Post by hippich »

Something that might be interesting in this topic - forked version [0] of telegram client made during protests in Belarus in 2020 (and appears to be actively maintained to this day). Can't vouch for it, but found it interesting.

[0] https://github.com/wrwrabbit/Partisan-Telegram-Android

Re: Is Telegram really an encrypted messaging app?

#236

Post by upofadown »

codethief wrote: post #179
upofadown wrote: post #161

Earlier quoted context omitted.

Sealed sender doesn't really solve the metadata problem at all: * https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1... Generally you need something like TOR to hide who is talking to who.

Interesting, I feared Sealed Sender might be susceptible to statistical analysis (hence my phrasing "reduce it a bit") but it's worse than I expected ("Signal could link sealed sender users in as few as 5 message"). Thanks for the link! As for TOR, that wouldn't really help much, would it, given that the described attack is at the application level of Signal. Or are you talking about not using Signal altogether?

Yeah, I used TOR as a general example. Briar uses TOR for example to hide the connections between users.

Re: Is Telegram really an encrypted messaging app?

#237

Post by bonoboTP »

sroerick wrote: post #209
wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE

If the text appears on your screen I'm pretty sure there are ways for Google to capture it. I don't need to know how android's API works, knowing it probably just makes one blind to the big picture. You have to trust your OS/phone maker not to do a MITM.

Re: Is Telegram really an encrypted messaging app?

#239

Post by maqp »

jxi wrote: post #154
icepat wrote: post #141

Earlier quoted context omitted.

What's in Telegram that you don't see in Signal? Honest question, I only use Signal rather than Telegram.

Signal has probably the worst UX of any messaging app. It also used to require sharing phone numbers to add contacts, which imo is already a privacy violation. Telegram is fast, responsive, gets frequent updates, has great group chat, tons of animated emojis, works flawlessly on all desktop and mobile platforms, has great support for media, bots, and a great API, allows edits and deleting messages for all users, and…

>It also used to require sharing phone numbers to add contacts

It no longer doesn't. It took them a while because you can't just slap features like that. It's not a string in a database like with Telegram.

Telegram has great UX because you can build things fast and easy when you don't have to give two shits about the security side of things. You can cover that part with grass-roots marketing department and volunteering shills.

Re: Is Telegram really an encrypted messaging app?

#240

Post by fsflover »

ThePowerOfFuet wrote: post #185
fsflover wrote: post #21

Earlier quoted context omitted.

> Telegram can be forced to give up data That's all you need to know. Matrix and Signal can't be forced in any way.

The admins of Matrix instances sure can be forced to give up data. The metadata is not encrypted, and many rooms are not either.

With Telegram, even the data can be accessed. Also: https://news.ycombinator.com/item?id=41351227
Post reply on HN