Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

351–360 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#351

Post by throwuxiytayq »

sroerick wrote: post #295
qwertox wrote: post #221

Earlier quoted context omitted.

Why? I think Google suggests that you send the payload encrypted through the notification. Google then only knows which app to send the message to, they don't know from whom the message originates (only "a Telegram server") nor what the content is. Also, you could just send a notification instructing the app to fetch a new message from your server. From the docs: Encryption for data messages The Android Transport Lay…

Assuming an adversarial relationship, what sort of metadata could Google capture simply knowing which app was sending the notifications and who was receiving them?

Aren’t notifications enqueued on the server side, implying sender info is inscrutable? I’m curious what mechanism you’d propose to gather any valuable metadata given a sufficient volume of encrypted notifications.

Re: Is Telegram really an encrypted messaging app?

#352

Post by sam_lowry_ »

devjab wrote: post #258
AnotherGoodName wrote: post #6

If telegrams encryption is so bad why is Pavel Durov under arrest? The arrest cites that he was not cooperating with authorities to crack down on various drug illegal activities on telegram. None of the other social networks have their ceos arrested. Is it simply that telegram is the only one without backdoors for five eyes? It seems to me the secret chat feature actually works too well?

I can give you some insight into why EU law enforcement and politicians dislike telegram. It’s not because they can’t snoop on you, it’s because Telegram fails to comply with moderation requests for channels where illegal content is shared. We had a nice scandal of sorts here in Denmark where a bunch of young men shared pictures of young women without consent. If you’re old enough to remember those old “rate this gir…

> you’ll know what the pictures were used for.

Fapping on? And what's the problem with that, exactly?

Re: Is Telegram really an encrypted messaging app?

#353

Post by sam_lowry_ »

empath75 wrote: post #315
AnotherGoodName wrote: post #6

If telegrams encryption is so bad why is Pavel Durov under arrest? The arrest cites that he was not cooperating with authorities to crack down on various drug illegal activities on telegram. None of the other social networks have their ceos arrested. Is it simply that telegram is the only one without backdoors for five eyes? It seems to me the secret chat feature actually works too well?

Do you think he doesn't cooperate with Russian authorities?

I am pretty sure he does not, given all I know about him, his brother and the way Telegram is being developed.

Re: Is Telegram really an encrypted messaging app?

#354

Post by wruza »

glitchc wrote: post #268
theshrike79 wrote: post #159

Earlier quoted context omitted.

You need it to register, but afaik it's not shown to anyone in any way. You can just grab any prepaid SIM and use it if that's your style

Yeah but the server can correlate it to all messages sent by you, and law enforcement can link server logs to your real identity thrpugh your telco.

Those who need to dissociate with a number have anonymous sim cards in abundance. Costs around $2-5 a piece when ordered in bulk.

That said, such high-tech operation is just a geeks fantasy about spies. When you cross the line where it becomes reality, you’re either a very big name with a sudden drug/rape history or a subject for waterboarding which is the most effective cryptoanalysis tool invented.

Re: Is Telegram really an encrypted messaging app?

#355

Post by pokot0 »

bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

Unfortunately if the answer is no, it does not mean law enforcement can’t

Re: Is Telegram really an encrypted messaging app?

#356

Post by rpdillon »

sroerick wrote: post #295
qwertox wrote: post #221

Earlier quoted context omitted.

Why? I think Google suggests that you send the payload encrypted through the notification. Google then only knows which app to send the message to, they don't know from whom the message originates (only "a Telegram server") nor what the content is. Also, you could just send a notification instructing the app to fetch a new message from your server. From the docs: Encryption for data messages The Android Transport Lay…

Assuming an adversarial relationship, what sort of metadata could Google capture simply knowing which app was sending the notifications and who was receiving them?

Schneier mentioned this late in 2023:

https://www.schneier.com/blog/archives/2023/12/spying-throug...

> Wyden’s letter cited a “tip” as the source of the information about the surveillance. His staff did not elaborate on the tip, but a source familiar with the matter confirmed that both foreign and U.S. government agencies have been asking Apple and Google for metadata related to push notifications to, for example, help tie anonymous users of messaging apps to specific Apple or Google accounts.

Re: Is Telegram really an encrypted messaging app?

#357

Post by wruza »

maqp wrote: post #234
sundarurfriend wrote: post #148

Earlier quoted context omitted.

Not a single person I know who uses Telegram cares about or thinks of it as e2ee. Whether "techie" or "non-techie" (whatever the definition of that is). People use it because it has a nice interface, was one of the first to have good "sticker" message support (yes, a lot of people care about that kind of stuff), and of course because of the good old network effect. It's only on HN I ever see people set up Telegram as…

You could also ask about whether they think it's private. And if they say yes, ask them what it means. Does it mean only sender and intended recipients can read the message, or is it fine if the service has someone check the content. Would they agree on the notion "it's OK my nudes I send to my SO are up for grabs for anyone who hacks Telegram's servers", or do they think should Telegram plug this gaping hole. Also,…

You may try sitting near a completely open-space developer and watch what they are doing, and see the 10x performance drop on average, while there was zero privacy on screen at all times. It helps to realize that people not always behave logically (we have lots of group instincts legacy) and it doesn’t always work as a proper argument.

Re: Is Telegram really an encrypted messaging app?

#358

Post by anizan »

KennyBlanken wrote: post #142
hn_throwaway_99 wrote: post #125

Earlier quoted context omitted.

But that's literally the entire point of this article. That is, in this day and age, when people talk about "secure messaging apps" they are usually implying end-to-end encryption, which Telegram most certainly is not for the vast majority of usages.

Also, iMessage is very secure...but then all your stuff is backed up on iCloud servers unless you specifically disable it. That includes all your iCloud encryption keys and plaintext messages. Worse, iPhones immediately start backing up to iCloud when set up for a new user - the only way to keep your network passwords and all manner of other stuff from hitting iCloud servers is to set the phone up with no network con…

laf every image you take on an iphone is sent to apple server regardless of it being in icloud or not.

Re: Is Telegram really an encrypted messaging app?

#359

Post by kattagarian »

Aachen wrote: post #284
medo-bear wrote: post #91

Telegram is not Signal, it is a waaay better Discord

Still not indexable, referencable, or freely readable It's a walled-garden system which is fine for private chats between groups of friends, but Discord is increasingly being used as a place to report bugs and share information. Telegram furthermore requires signing up with a phone number which Discord did not (now, often, you need to for participating when an admin of a community aka gild aka misnomer "server" turne…

> Discord is increasingly being used as a place to report bugs and share information.

So is telegram. I'm in numerous groups with developers of linux distros and other apps. Many developers uses telegram's channels to post updates about their works.

Re: Is Telegram really an encrypted messaging app?

#360

Post by throwuxiytayq »

jxi wrote: post #154
icepat wrote: post #141

Earlier quoted context omitted.

What's in Telegram that you don't see in Signal? Honest question, I only use Signal rather than Telegram.

Signal has probably the worst UX of any messaging app. It also used to require sharing phone numbers to add contacts, which imo is already a privacy violation. Telegram is fast, responsive, gets frequent updates, has great group chat, tons of animated emojis, works flawlessly on all desktop and mobile platforms, has great support for media, bots, and a great API, allows edits and deleting messages for all users, and…

Telegram consumes up to 50% of battery charge on iOS, with practically zero daily usage, all energy saving settings enabled, and a single followed channel, whether or not I force close the app or reinstall it. I gave up on trying to make it work, merely installing the fucking app ensures my phone is dead in the morning.
Post reply on HN