Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

551–560 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#551
post #479
post #468

Let's stop repeating this word "moderate" when what we're talking about is censorship. Moderation is what happens here on HN: Admins have some policies to keep the conversation on track, users voluntarily submit to them. Censorship is when a third party uses coercion to force admins to submit to them and remove posts against their will. Durov has been arrested for refusing to implement censorship, not for anything co…

is removal of CSAM moderation or censorship?

It depends on whether the parties to the communication want that or not.

So let's say a few child molesters create a chat service and use it to send the worst, most horrible child pornography amongst themselves. Removing it is censorship, not moderation.

Look, I'm not trying argue for legalization of child pornography here. That is illegal contraband, full stop. The intent of my comment is to say "let's just call it what it is"

I think the overwhelming consensus is that child pornography is so horrible that mere possession of it must be CENSORED.

I'm not arguing that censorship is always wrong. For instance, I don't want to see public billboards of graphic sex or violence. I think it's good that we censor that, so that we aren't forced to look at things like that when we don't want to.

What is bothering me is that proponents of censorship, and especially certain proponents of it who want to use it as a tool to suppress ideas they don't like, have recently started using the word "moderation" in order to sneak their plans into policy without raising objections. The reason is because when we hear the word "censorship" we immediately think, "Whoa, hold on there, censorship is very harsh, let's take a hard look and make sure this is serious enough that resorting to censorship is justified and appropriate", whereas when we hear the word "moderation" we think, "Of course, we all appreciate someone deleting the spam and trolls who annoy us", and we're less likely to think critically about exactly what kind of expression is being legally prohibited.

Re: Is Telegram really an encrypted messaging app?

#552
post #468

Let's stop repeating this word "moderate" when what we're talking about is censorship. Moderation is what happens here on HN: Admins have some policies to keep the conversation on track, users voluntarily submit to them. Censorship is when a third party uses coercion to force admins to submit to them and remove posts against their will. Durov has been arrested for refusing to implement censorship, not for anything co…

> Moderation is what happens here on HN: Admins have some policies to keep the conversation on track, users voluntarily submit to them. What do you mean by users voluntarily submitting to these policies? This distinction seems key in your argument, but I don't see what alternatives to submitting I have here, making it involuntary, right?

No, you miss the point.

If HN decided to ban all posts about Donald Trump that is moderation. Users voluntarily submit to this policy by participating in the site, and if they do not, they will be banned.

If the State of California required that all web sites run from their state are REQUIRED to ban all posts about Donald Trump, that is censorship.

Moderation is "your house, your rules" while censorship is someone else imposing their rules in your house.

Do you see what I'm saying? When France is talking about "moderation" of Telegram, what they actually mean is censorship.

Re: Is Telegram really an encrypted messaging app?

#553
post #552

Earlier quoted context omitted.

> Moderation is what happens here on HN: Admins have some policies to keep the conversation on track, users voluntarily submit to them. What do you mean by users voluntarily submitting to these policies? This distinction seems key in your argument, but I don't see what alternatives to submitting I have here, making it involuntary, right?

No, you miss the point. If HN decided to ban all posts about Donald Trump that is moderation. Users voluntarily submit to this policy by participating in the site, and if they do not, they will be banned. If the State of California required that all web sites run from their state are REQUIRED to ban all posts about Donald Trump, that is censorship. Moderation is "your house, your rules" while censorship is someone el…

A pedantic point, which typically argues around the real point. When somebody egregiously violates norms of public discourse with rabble-rousing, slander, deliberate lies and obfuscation, it's reasonable to limit their message's reach with some rules. When they continue despite warnings, then something more has to be done.

Call it what you like; this all had a history and a progression. Not arbitrary or unfair.

Re: Is Telegram really an encrypted messaging app?

#554

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

How to do that on initial account creation: - locally create a recovery key and use it to wrap any other essential keys - Split that or wrap that with two or more keys. - N - 1 goes to the cloud to be used as MFA tokens on recovery. - For the other, derive keys from normalized responses to recovery questions, use Shamir's secret sharing to pick a number of required correct responses and encrypt the Nth key. You can r…

IOW, you've made the recovery questions into alternate passwords, passwords that law enforcement is likely able to find or brute force.

Re: Is Telegram really an encrypted messaging app?

#555
post #154

Earlier quoted context omitted.

Signal has probably the worst UX of any messaging app. It also used to require sharing phone numbers to add contacts, which imo is already a privacy violation. Telegram is fast, responsive, gets frequent updates, has great group chat, tons of animated emojis, works flawlessly on all desktop and mobile platforms, has great support for media, bots, and a great API, allows edits and deleting messages for all users, and…

> allows edits and deleting messages for all users And it has those little features like masked text and what not, features wise, telegram is just the best. I didn’t use Signal for a long time, you can’t edit the messages there!?

Yeah you can?

Re: Is Telegram really an encrypted messaging app?

#556
post #337
post #233

Earlier quoted context omitted.

You could use an image. But you could use text as well. E.g. you could agree on a code phrase to be said when some "dirty deed done dirt cheap" has been completed. Or you could encode a binary string by alternating British English spellings with American English Spellings: e.g. "color" means 0, "colour" means 1; "gray" means 0, "grey" means 1, etc etc. and then just use those alternate spellings in a normal conversat…

The problem with codes is you have to remember them. And then you'll need a massive lookup-table. People don't want to have chats based on limited vocabulary. This is why we have modern encryption. It converts the most beautiful poem in the world to complete noise and back with no loss of meaning. It allows sending images, books, videos -- culture, without spycraft that requires hours of learning. It's also more secu…

But then it is obvious you are using encryption. A lot can be learned just from the timing of the message and noting it is encrypted. I always thought it best to send an encrypted message every hour of every day .. most messages would be just nonsense. The one eavesdropping could not only not read the message, but they would gain no knowledge about when the "real" messages are being sent.

Re: Is Telegram really an encrypted messaging app?

#557
post #325

Earlier quoted context omitted.

Not at all. Try searching 500/1000 sources (maximum number of conversations any free/premium user can be part of), each with potentially millions of messages, and providing the results in under a second.

AFAIK telegram dont have any super-advanced search features neither it instantly return you results for all these years. Also if you search less common terms it's usually take longer than less than second. And if you just run client on device without a lot of this history cached search wouldn't be anywhere as fast as you expect. So I pretty sure there no server-side magic there, but instead very good UX. Also I can t…

Can't say there aren't others who've used my search terms, but some things I search for are pretty unique. And I do a lot of searching. And search speed is consistently sub-second. There's no trickery seeing years-old results from VERY heavily used chats appear instantly. There's heavy optimization happening for search, and I'm very certain default e2ee would destroy that experience. Unless you can point to 1 e2ee service working at that scale with comparable UX. I won't even touch on the local aspect as the amount of storage needed to just store the data is waaaay beyond anything I'm even interested in owning, much less the compute to make it so accessible.

Re: Is Telegram really an encrypted messaging app?

#559

Earlier quoted context omitted.

If you apply this test to things like LastPass or Bitwarden they fail too. And yet the don't keep my unencrypted passwords on their servers.

If you lose your Bitwarden master password you've lost your data. It passes the mud puddle test.

ah, you are right ... I missed the password recovery flow part which is a key thing here

Re: Is Telegram really an encrypted messaging app?

#560
post #263

Earlier quoted context omitted.

With Matrix, you can use your own (or trusted) server. Doesn't it solve the problem with the metadata? At least when two trusted servers interact.

This is part of what I love about Mastodon: if you PM someone, very often you're talking between two random servers and odds are good that the admin is a friend of a friend. No dragnet statistical analysis stuff, just friends running some software that normal people can also use. Distributed systems at their best

I wouldn't rely on Mastodon PMs for privacy. It's just not designed for that. Use Matrix instead.
Post reply on HN