Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

531–540 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#531

Post by Canada »

K7J6H5G4 wrote: post #474
Canada wrote: post #468

Let's stop repeating this word "moderate" when what we're talking about is censorship. Moderation is what happens here on HN: Admins have some policies to keep the conversation on track, users voluntarily submit to them. Censorship is when a third party uses coercion to force admins to submit to them and remove posts against their will. Durov has been arrested for refusing to implement censorship, not for anything co…

The only difference between "moderation" and "censorship" is whether you like the policy or not.

No, it's definitely not. Moderation means I can run my group how I want, you can run your group how you want, and others can decide if they want to participate in either of our groups or start their own groups.

Censorship is when someone else dictates how we can run our respective groups.

Re: Is Telegram really an encrypted messaging app?

#532

Post by epoberezkin »

maqp wrote: post #214
_niki_s_ wrote: post #146

Earlier quoted context omitted.

simplex.chat

The entire platform is a joke. It pretends to have no identifiers and heavily markets queues (a programming technique) as a solution to privacy problem. You ask the authors how they solved the problem of server needing to know to which client connection an incoming ciphertext needs to be forwarded, and they'll run to the hills. They're lying by omission about their security, and misleading about what constitutes as a…

That you don't like the design is well known. But this is not the reason to lie.

You understand the design quite well, from our past conversations, you simply don't like the fact that we don't recognise user IP address as a permanent user identifier on the protocol level. It is indeed a transport identifier, not a protocol-level identifier that all other messaging networks have for the users (in addition to transport identifiers).

Message routing protocol has anonymous pairwise identifiers for the connections between users (graph edges), but it has no user identifiers - messaging servers have no concept of a user, and no user accounts.

Also, recently we added a second step in message routing that protects both user IP addresses and transport sessions: https://simplex.chat/blog/20240604-simplex-chat-v5.8-private...

In general, if you want to meaningfully engage in the design criticism, I would be happy too, and it will help, but simply spitting out hate online because you don't like something or somebody, is not a constructive approach – you undermine your own reputation and you also mislead people.

> You ask the authors how they solved the problem of server needing to know to which client connection an incoming ciphertext needs to be forwarded, and they'll run to the hills

This is very precisely documented, and this design was recently audited by Trail of Bits (in July 2024), we are about to publish their report. So either you didn't understand, or your are lying.

> They're lying by omission about their security, and misleading about what constitutes as a permanent identifier.

You would have to substantiate this claim, as otherwise it is slander. We are not lying about anything, by omission or otherwise. You, on another hand, are lying here.

That you are spiteful for some reason is not a good enough reason.

Factually, at this point SimpleX Chat is one of the most private and secure messengers, see the comparisons of e2e encryption properties in SimpleX Chat and other messengers: https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum...

Re: Is Telegram really an encrypted messaging app?

#533

Post by Canada »

alufers wrote: post #491
Canada wrote: post #468

Let's stop repeating this word "moderate" when what we're talking about is censorship. Moderation is what happens here on HN: Admins have some policies to keep the conversation on track, users voluntarily submit to them. Censorship is when a third party uses coercion to force admins to submit to them and remove posts against their will. Durov has been arrested for refusing to implement censorship, not for anything co…

I don't know how much you have used Telegram, but it's ridden with absolutely vile stuff. You open the "Telegram nearby" feature anywhere and it's full of people selling drugs and scams. When I mistyped something in the search bar I ended up in some ISIS propaganda channel (which was straight up calling for violence/terrorism). All of this on unencrypted public groups/channels ofc (I'm pretty sure it's the same with…

I use it a lot, and I run some large groups on it. I don't see any of that stuff, I've never gone looking for it, and I'm not even sure how to look for it. Can you tell me some examples of what to search for to see what you're talking about?

Re: Is Telegram really an encrypted messaging app?

#534

Post by ParetoOptimal »

raxxorraxor wrote: post #508
schmichael wrote: post #417

Earlier quoted context omitted.

> Does Telegram let them see it: I don't think so. This is exceptionally naive. Even if he was arrested for not sharing with the French, what about for other countries? Was he arrested for not ever sharing or not sharing enough? Even if he, personally, has never shared, that doesn’t say anything about his employees who have the same access to these systems. Your data is not private with Telegram. You are trusting Tel…

You cannot be sure and yet Telegram often gets mentioned for being the only platform where states do not have easy access to user information or the ability to censor certain messages/content. So from a broad perspective, they probably behave better than comparable services. I think Telegram should not be trusted, but I also do not trust the alternatives, that readily share information with states. A special focus fo…

> Telegram often gets mentioned for being the only platform where states do not have easy access to user information or the ability to censor certain messages/content.

By who?

Simplex especially or even Signal are far better.

Re: Is Telegram really an encrypted messaging app?

#535

Post by ParetoOptimal »

Account_Removed wrote: post #232
jijji wrote: post #228

Earlier quoted context omitted.

defcon and blackhat are hacker/computer security conferences started by Jeff Moss (aka DT or Dark Tangent) in 1993 and held at the end of July or early August every year in Las Vegas.... The reason you don't bring your phone is it might get hacked

[dead]

Skiddies are renowned for their rational thoughts and actions.

Re: Is Telegram really an encrypted messaging app?

#536

Post by mikrotikker »

maqp wrote: post #231
mfiro wrote: post #175

In my opinion, Telegram is more of a social network than a messenger. There are many useful channels and in many countries, it plays an important role in sharing information. If we look at it from this point of view, e2ee does not seem very important. We should also not forget that, in the time when all social media (Reddit, X, Instagram etc.) close their APIs, Telegram is one of the only networks that still has a fr…

That's the dangerous part. It's a messaging app that took in the function of a social media platform. It did so without robust security features like end-to-end encryption yet it advertised itself as heavily encrypted. Like Green stated in his blog post, users expect that to mean only recipient can read what you say, i.e. end-to-end encryption. Telegram would be fine if it advertised itself as a public square of the…

The free API is amazing I have so many little helper bots that help me automated my life. It's easy better easier and more feature rich than twilio or slack. I made my own stock management bot that ate a screener spreadsheet I upload in the chat and tell me if I should sell my stocks.

There is even that freqtrade bot that runs on telegram, even RSS bots. It really is amazing. So easy to use for chat ops.

I don't know what else you would use the API for.

Re: Is Telegram really an encrypted messaging app?

#537

Post by justaj »

LtWorf wrote: post #291
immibis wrote: post #241

Earlier quoted context omitted.

My Matrix messages are, I presume, not encrypted, because every device I have prompts me to sign this device's keys with the keys of another device (which doesn't exist) and the option to reset the encryption keys and lose access to old messages doesn't work either (it just crashes Element).

You can enable it on a per chat basis.

All PM rooms are E2EE by default.

Re: Is Telegram really an encrypted messaging app?

#538

Post by justaj »

medo-bear wrote: post #495
tcfhgj wrote: post #470

Earlier quoted context omitted.

You can sync messages across many independent devices despite e2ee. Matrix has been doing that for years

Does Matrix encryption scale? Telegram rooms have a huge number of participants. Also last time I looked into this, Matrix encryption was also an opt in.

In Matrix all PM rooms are E2EE by default.

For public rooms however, it doesn't really make sense to enable E2EE.

Re: Is Telegram really an encrypted messaging app?

#539

Post by mikrotikker »

jxi wrote: post #154
icepat wrote: post #141

Earlier quoted context omitted.

What's in Telegram that you don't see in Signal? Honest question, I only use Signal rather than Telegram.

Signal has probably the worst UX of any messaging app. It also used to require sharing phone numbers to add contacts, which imo is already a privacy violation. Telegram is fast, responsive, gets frequent updates, has great group chat, tons of animated emojis, works flawlessly on all desktop and mobile platforms, has great support for media, bots, and a great API, allows edits and deleting messages for all users, and…

With just 30 staff

Re: Is Telegram really an encrypted messaging app?

#540

Post by codethief »

foresto wrote: post #335
upofadown wrote: post #161

Earlier quoted context omitted.

Sealed sender doesn't really solve the metadata problem at all: * https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1... Generally you need something like TOR to hide who is talking to who.

Related presentation from Network and Distributed System Security Symposium: https://www.youtube.com/watch?v=HoN6FLC5Hss

Thanks, that was a very nice & accessible talk!
Post reply on HN