561–570 of 609 posts
Earlier quoted context omitted.
Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE
If the text appears on your screen I'm pretty sure there are ways for Google to capture it. I don't need to know how android's API works, knowing it probably just makes one blind to the big picture. You have to trust your OS/phone maker not to do a MITM.
Should they have to comply with law enforcement they have much more straightforward ways of doing so than capturing messages off screen.
Earlier quoted context omitted.
The entire platform is a joke. It pretends to have no identifiers and heavily markets queues (a programming technique) as a solution to privacy problem. You ask the authors how they solved the problem of server needing to know to which client connection an incoming ciphertext needs to be forwarded, and they'll run to the hills. They're lying by omission about their security, and misleading about what constitutes as a…
That you don't like the design is well known. But this is not the reason to lie. You understand the design quite well, from our past conversations, you simply don't like the fact that we don't recognise user IP address as a permanent user identifier on the protocol level. It is indeed a transport identifier, not a protocol-level identifier that all other messaging networks have for the users (in addition to transport…
> This is very precisely documented, and this design was recently audited by Trail of Bits (in July 2024), we are about to publish their report.
I’ve looked at SimpleX in the past and am also curious about this. Is there a high-level summary?
Earlier quoted context omitted.
Many people seem to think that Telegram tries to be a Signal or Matrix replacement. I dont think Telegram tries to be any of that. If anything you can compare it to Discord, except much better. To enable synched e2e conversations accross many devices you also need to synch private keys, which is a security nightmare.
Either sync private keys or the messages itself. Why would it be a security nightmare? In contrast to not even supporting e2ee in the first place?
Telegram supports e2ee but it is device centric for this reason
Earlier quoted context omitted.
Source?
recent support. kremlin yesterday arranged big protests in moscow demanding his release. kremlin yesterday arrested the nephew of the french ambassador claim he was dealing drugs (claiming he carried a package of heroin marked with the label "for distribution in russia" as if all drug dealers put their intentions in writing) clearly to try to trade him
Earlier quoted context omitted.
The problem with codes is you have to remember them. And then you'll need a massive lookup-table. People don't want to have chats based on limited vocabulary. This is why we have modern encryption. It converts the most beautiful poem in the world to complete noise and back with no loss of meaning. It allows sending images, books, videos -- culture, without spycraft that requires hours of learning. It's also more secu…
But then it is obvious you are using encryption. A lot can be learned just from the timing of the message and noting it is encrypted. I always thought it best to send an encrypted message every hour of every day .. most messages would be just nonsense. The one eavesdropping could not only not read the message, but they would gain no knowledge about when the "real" messages are being sent.
Earlier quoted context omitted.
$ sudo apt install telegram Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package telegram Also $ sudo apt install signal-desktop-beta [sudo] password for : Reading package lists... Done Building dependency tree... Done Reading state information... Done signal-desktop-beta is already the newest version (7.22.0~beta.1). 0 upgraded, 0 newly installe…
It's called telegram-desktop -_-' > apt install signal-desktop-beta Very nice. Too bad it doesn't exist. Making up package names doesn't magically bring them into existence. So, yeah.
# 1. Install our official public software signing key wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg cat signal-desktop-keyring.gpg | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null
# 2. Add our repository to your list of repositories echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' |\ sudo tee -a /etc/apt/sources.list.d/signal-xenial.list
# 3. Update your package database and install signal sudo apt update && sudo apt install signal-desktop-beta
https://support.signal.org/hc/en-us/articles/360007318471-Si...
Non-beta version:
# NOTE: These instructions only work for 64-bit Debian-based # Linux distributions such as Ubuntu, Mint etc.
# 1. Install our official public software signing key: wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg cat signal-desktop-keyring.gpg | sudo tee /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null
# 2. Add our repository to your list of repositories: echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' |\ sudo tee /etc/apt/sources.list.d/signal-xenial.list
# 3. Update your package database and install Signal: sudo apt update && sudo apt install signal-desktop
Earlier quoted context omitted.
The entire platform is a joke. It pretends to have no identifiers and heavily markets queues (a programming technique) as a solution to privacy problem. You ask the authors how they solved the problem of server needing to know to which client connection an incoming ciphertext needs to be forwarded, and they'll run to the hills. They're lying by omission about their security, and misleading about what constitutes as a…
That you don't like the design is well known. But this is not the reason to lie. You understand the design quite well, from our past conversations, you simply don't like the fact that we don't recognise user IP address as a permanent user identifier on the protocol level. It is indeed a transport identifier, not a protocol-level identifier that all other messaging networks have for the users (in addition to transport…
So how exactly are all those DMCA letters finding themselves to the correct household if IP address doesn't deanonymize you?
>Message routing protocol has anonymous pairwise identifiers for the connections between users
I'm so tired of you avoiding the obvious question. What does this identifier look like?
Given that you say its anonymous, its probably not a username. So. Is it a random string, an RSA/DH/ed25519/ed448/ECDSA key-pair? Is it permanent? If not, how often does it change? How is it changing, are the identifiers advancing in a hash-ratchet etc. Can it change while the IP address stays the same?
Give me an example of the identifier. If it is a collection of data, explain every single segment of it.
It's clear the server does not tell one user connection from another by its IP address. So, until you explain what information exactly the server uses to tell one user's connection apart from another, it makes no sense to discuss this further.
>You would have to substantiate this claim, as otherwise it is slander.
As per above, IPv4 addresses have been used to identify individual subscriptions, and you're not making it clear that if the users wants ambiguity about the identity of who's behind an IP-address, they should not live in a single person household. You're also not defaulting to Tor so by default every single-household user not behind a NAT can be determined by their IPv4 address. You pretending that IPv4 addresses don't matter doesn't change reality.
Also as for your vague threats of SLAPP lawsuits, let me give you a quick lesson on the Finnish law:
"Edellä 1 momentin 2 kohdassa tarkoitettuna kunnianloukkauksena ei pidetä arvostelua, joka kohdistuu toisen menettelyyn politiikassa, elinkeinoelämässä, julkisessa virassa tai tehtävässä, tieteessä, taiteessa taikka näihin rinnastettavassa julkisessa toiminnassa ja joka ei selvästi ylitä sitä, mitä voidaan pitää hyväksyttävänä."
or
"Defamation as referred to in subsection 1, point 2 above is not considered to be criticism directed at another person's conduct in politics, business, public office or task, science, art or similar public activities and which does not clearly exceed what can be considered acceptable."
https://www.finlex.fi/fi/laki/ajantasa/1889/18890039001
Tldr: Criticism of businesses is legal in Finland. Feel free to consult your lawyers on the matter.
Earlier quoted context omitted.
> Signal doesn't require sharing of phone numbers It does require a phone number to create an account. That’s the reason I do not consider it being private because at least in Germany a phone number can only be activated by using a personal ID card which it is connected to.
Private and anonymous are two very different things
They’re going hand in hand as soon as there’s a data breach or a back door
Earlier quoted context omitted.
It's called telegram-desktop -_-' > apt install signal-desktop-beta Very nice. Too bad it doesn't exist. Making up package names doesn't magically bring them into existence. So, yeah.
Beta version: # 1. Install our official public software signing key wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg cat signal-desktop-keyring.gpg | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null # 2. Add our repository to your list of repositories echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updat…