Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

511–520 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#511

Post by out_of_protocol »

3np wrote: post #150
alerighi wrote: post #118

Earlier quoted context omitted.

Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud. This of course has security implications, but also allows you to have a big number of chats without wasting your device memory like WhatsApp does, or having to delete old conversations, and allows you to access your chats from any device. By the way you can also set a password to log in from another…

> It's the only messaging app where messages are stored on the cloud. Instagram. FB Messenger. Skype. LINE. KakaoTalk. Discord. Slack. Teams. iMessage.

Google talk/Hangouts/Google Chat/Duo/Allo/Meet/another Meet/etc. Counts as one

Re: Is Telegram really an encrypted messaging app?

#512

Post by 0xEF »

theshrike79 wrote: post #159
as1mov wrote: post #110

Earlier quoted context omitted.

Actually I was wrong. Just checked and Telegram does require a phone number to sign up. I haven't used it myself much, but was relaying the general reasons why regular people use it.

You need it to register, but afaik it's not shown to anyone in any way. You can just grab any prepaid SIM and use it if that's your style

> You need it to register, but afaik it's not shown to anyone in any way.

Then why is a phone number needed to register? If PII is "not shown to anyone in any way" then it should be completely unecessary to provide it to the service. Do not let that particular wool be pulled over your eyes.

Re: Is Telegram really an encrypted messaging app?

#513

Post by forgotmypw17 »

zuhsetaqi wrote: post #422
forgotmypw17 wrote: post #375

Earlier quoted context omitted.

> What's in Telegram that you don't see in Signal? The first feature that comes to mind for me is being able to use multiple devices. Signal only allows using it with one phone. If you add a second device, the first one stops working. You can use a computer and a phone, but not multiple phones. Telegram supports this without any issues. I still struggle to understand this limitation.

It’s easy for telegram to support this since it’s not e2ee. When you create a so called private chat on telegram, this chat is also only available on the device you created it on.

>It’s easy for telegram to support this since it’s not e2ee.

E2EE is not important to me. Continuity of chats and lack of friction in accessing them is important to me.

>When you create a so called private chat on telegram, this chat is also only available on the device you created it on.

Signal is able to do this with my phone and my computer. The one-phone limit seems arbitrary.

Re: Is Telegram really an encrypted messaging app?

#514

Post by Canada »

po wrote: post #465
schmichael wrote: post #417

Earlier quoted context omitted.

> Does Telegram let them see it: I don't think so. This is exceptionally naive. Even if he was arrested for not sharing with the French, what about for other countries? Was he arrested for not ever sharing or not sharing enough? Even if he, personally, has never shared, that doesn’t say anything about his employees who have the same access to these systems. Your data is not private with Telegram. You are trusting Tel…

Following the St. Petersburg attack, the Federal Security Service (FSB), in an event that may ring somewhat familiar to many in the United States and Europe, asked Telegram for encryption keys to decode the dead attacker’s messages. Telegram said it couldn’t give the keys over because it didn’t have them. In response, Russia’s internet and media regulator said the company wasn’t complying with legal requirements. The…

This doesn't make any sense. Either the author of the article is confused, lying, or is drawing conclusions from source material that is untrue.

In the US case, there was a phone where data was encrypted at rest. Though Apple was capable of creating and signing a firmware update that would have made it easier for the FBI to brute force the password, Apple refused to do so.

In the Russian case, the FSB must have already had access to the suspect's phone because if it did not then Telegram would not be in any position to help at all.

So, the FSB must have already had access. And therefore, by having access to the phone they also had complete access to the suspect's chats in plaintext, regardless of whether or not the suspect used Telegram's private chat. There would have been no keys to ask Telegram for copies of.

Alternatively, the FSB might have had access to some other user's chats with the suspect, and wanted Telegram to turn over the suspect's full data. Telegram is 100% able to do that if they want to.

As the specific part of the article you have quoted is definitely bullshit, I suspect the rest of it is bullshit too and that despite what Roskomnadzor states in public, the real fight with Durov was over censorship.

Re: Is Telegram really an encrypted messaging app?

#515

Post by sharpshadow »

tamimio wrote: post #98
qskousen wrote: post #81

Earlier quoted context omitted.

Stealing someone's phone number wouldn't give you any Signal data, as all the messages have perfect forward secrecy, though, right? And all contacts would see an alert that your security number had changed. Not completely foolproof, and I would like Signal to use something other than phone numbers for accounts, but it's pretty good.

Knowing someone's phone number is enough to potentially compromise it. Sophisticated methods can involve zero-click attacks, where just sending you an SMS that you won’t even see can lead to a compromised device. You can check how Tucker got his Signal conversation exposed. Matrix is far better in terms of security than Signal, but Matrix is far behind compared to Telegram features.

One does not need to keep the SIM card with the phone number required for registration in the phone.

Also telegram has an additional password option if you want to login which avoids phone number hijack. Also if you hijack an account the secret chats don’t appear. They are bounded to the device.

Re: Is Telegram really an encrypted messaging app?

#516

Post by elcomet »

medo-bear wrote: post #488
elcomet wrote: post #485

Earlier quoted context omitted.

Even whatsapp does it now

Does it? Last time I used WhatsApp I could not use it on my desktop without scanning a QR code each time and keeping the phone nearby.

You need to scan the QR code only the first time using the desktop app.

Re: Is Telegram really an encrypted messaging app?

#517

Post by medo-bear »

elcomet wrote: post #516
medo-bear wrote: post #488

Earlier quoted context omitted.

Does it? Last time I used WhatsApp I could not use it on my desktop without scanning a QR code each time and keeping the phone nearby.

You need to scan the QR code only the first time using the desktop app.

Can you use the desktop app without the phone present? For example, if the phone is turned off.

Re: Is Telegram really an encrypted messaging app?

#518

Post by guappa »

maqp wrote: post #504
guappa wrote: post #448

Earlier quoted context omitted.

apt install signal Error: Unable to find the package signal

$ sudo apt install telegram Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package telegram Also $ sudo apt install signal-desktop-beta [sudo] password for : Reading package lists... Done Building dependency tree... Done Reading state information... Done signal-desktop-beta is already the newest version (7.22.0~beta.1). 0 upgraded, 0 newly installe…

It's called telegram-desktop -_-'

> apt install signal-desktop-beta

Very nice. Too bad it doesn't exist. Making up package names doesn't magically bring them into existence.

So, yeah.

Re: Is Telegram really an encrypted messaging app?

#519

Post by guappa »

noisy_boy wrote: post #486
guappa wrote: post #438

Earlier quoted context omitted.

I've only heard telegram presented as a messenger for criminals in western media.

For some, that would be a pretty big testament for security. What is the app used by people that are facing the power of law enforcement? If it can withstand that, it must be secure.

But drug dealers get arrested all the time…

Re: Is Telegram really an encrypted messaging app?

#520

Post by niutech »

bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

Telegram has an answer to this: https://telegram.org/faq#q-do-you-process-data-requests - only Secret Chats are e2e encrypted.

As an alternative, Signal or Jami conversations are always e2e encrypted.

Post reply on HN