541–550 of 609 posts
Earlier quoted context omitted.
That's not how credibility and trust works
Well you hating on a feature you don't have to use doesn't affect my opinion about the well thought out security design around the rest of the application. I have zero sympathy for the distributed Ponzi scheme that is cryptocurrency, but nothing in Signal has gotten worse with the feature.
Earlier quoted context omitted.
Does Matrix encryption scale? Telegram rooms have a huge number of participants. Also last time I looked into this, Matrix encryption was also an opt in.
In Matrix all PM rooms are E2EE by default. For public rooms however, it doesn't really make sense to enable E2EE.
To enable synched e2e conversations accross many devices you also need to synch private keys, which is a security nightmare.
Earlier quoted context omitted.
In Matrix all PM rooms are E2EE by default. For public rooms however, it doesn't really make sense to enable E2EE.
Many people seem to think that Telegram tries to be a Signal or Matrix replacement. I dont think Telegram tries to be any of that. If anything you can compare it to Discord, except much better. To enable synched e2e conversations accross many devices you also need to synch private keys, which is a security nightmare.
Why would it be a security nightmare? In contrast to not even supporting e2ee in the first place?
Earlier quoted context omitted.
You need to scan the QR code only the first time using the desktop app.
Can you use the desktop app without the phone present? For example, if the phone is turned off.
Earlier quoted context omitted.
> Telegram can be forced to give up data That's all you need to know. Matrix and Signal can't be forced in any way.
The admins of Matrix instances sure can be forced to give up data. The metadata is not encrypted, and many rooms are not either.
Let's stop repeating this word "moderate" when what we're talking about is censorship. Moderation is what happens here on HN: Admins have some policies to keep the conversation on track, users voluntarily submit to them. Censorship is when a third party uses coercion to force admins to submit to them and remove posts against their will. Durov has been arrested for refusing to implement censorship, not for anything co…
> Censorship is when a third party uses coercion to force admins to submit to them and remove posts against their will What a weird hill to die on, given the whole context of this situation. Do you see public recruitment of people into terrorist cells as a freedom of speech? Do you see publicly selling drugs as a freedom of speech? It isn't about censorship at all, it's about actual *illegal* activity. Now it's up to…
The problem I have is with requiring the chat service to police that or making its operators liable for the illegal conduct of its users.
It shouldn't be up to Durov to prove he did or didn't do anything, it's up to France to prove that he or his company actively participated such conduct. And no, people using the service to engage in the illegal acts isn't nearly enough, any more than Google's CEO should be liable for a drug dealer using Maps to navigate to the drug deal location, or Venmo should be liable for the buyer paying the seller with it.
The reason it's worth defending this "hill" is because allowing governments to use censorship as a convenient means of solving these problems always leads to more control and restrictions that infringe on the legitimate rights of everyone.
I understand the appeal of these tactics. Since we know that terrorist groups operating abroad will use chat services to incite locals to commit violence, it's tempting to search the chat service and stop that from happening by censoring the communication, preventing the radicalization. Since we know that drug sellers organize the sale of the contraband using the chat app, it's tempting to search the chat app and censor that speech, thus preventing the buyer from learning where to meet the seller. Or wait for enough speech to cross the line into conduct and then arrest them for it. Sounds great. If it would work, I'd support it.
The problem is that it won't work, and the only way to "fix it" will be to push more and more and more surveillance and control. It's already being pushed. Look at this chat control nonsense. Do you support that?
So what I'm saying, is let's just recognize that it's a basic human right for people to communicate freely and that operators of communication services shouldn't be held liable for the actions of their users.
Earlier quoted context omitted.
Not a single person I know who uses Telegram cares about or thinks of it as e2ee. Whether "techie" or "non-techie" (whatever the definition of that is). People use it because it has a nice interface, was one of the first to have good "sticker" message support (yes, a lot of people care about that kind of stuff), and of course because of the good old network effect. It's only on HN I ever see people set up Telegram as…
Do you read other news sites that mention Telegram or is this an N=1 situation? Today, on the same topic, another tech site which generally gets a lot of things right (but whoever is responsible for writing about Telegram, or maybe their internal KB, is consistently wrong and doesn't care about feedback) wrote that it is an encrypted chats service: https://tweakers.net/nieuws/225750/ceo-en-oprichter-telegram... ("ver…
The average person I know that uses Telegram ("non-techie" as GP comment put it) certainly doesn't. People join telegram because it has a group they want to join, or via word-of-mouth of a friend recommending it. Normal people don't read tech news, and if they do they don't give it much weight.
Maybe that sucks, maybe they'd be better off somehow if they did, but the reality is that most people live in a different universe from those of us who care about e2ee security or read tech news with interest.
Earlier quoted context omitted.
That's the dangerous part. It's a messaging app that took in the function of a social media platform. It did so without robust security features like end-to-end encryption yet it advertised itself as heavily encrypted. Like Green stated in his blog post, users expect that to mean only recipient can read what you say, i.e. end-to-end encryption. Telegram would be fine if it advertised itself as a public square of the…
> It did so without robust security features like end-to-end encryption yet it advertised itself as heavily encrypted. Telegram has E2E encryption, but only in Secret Chats: https://telegram.org/faq#secret-chats
Earlier quoted context omitted.
Offhand, this sounds like a terribly insecure workflow but... Client creates a Public Private key pair used for E2EE. Client uses the 'account password (raw)' as part of the creation of a symmetric encryption key, and uses that to encrypt and store the SECRET key on the service's cloud. NewClient signs in, downloads the encrypted SECRETKeyBlob and decodes using the reconstructed symmetric key based on the sign in pas…
> When you regain consciousness you'll be perfectly fine, but won't for the life of you be able to recall your device passwords or keys You can't use your password as input to the mud puddle test.
Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...
If you apply this test to things like LastPass or Bitwarden they fail too. And yet the don't keep my unencrypted passwords on their servers.