11–20 of 81 posts
>"To this day, we have disclosed 0 bytes of user data to third parties, including governments." A very specific way of saying what most would assume means their users' data is safe. Even if it's not an outright lie, allowing government agents to view user data in their office would not contradict their statement.
I love Telegram, but it is one of those apps that since it requires a phone number I don't really trust them with ultra-secret data. I think their E2E protocol is fairly sound, but even that isn't ideal. I think you may also get some minimum benefit by using the open-source Android app vs the Google Play Store app. Regardless, if you really desire secrecy (and I believe in privacy but would never advocate for serious…
> I think their E2E protocol is fairly sound How come? It's completely proprietary and it's never been audited.
One paper tried to validate Telegram's protocol: https://www.researchgate.net/publication/346702021_Automated... That seems to have gone well. The mechanisms used seem very similar to the mechanism used in Signal's last audit from 2017.
Another paper only verified part of the protocol in a specific way: https://www.computer.org/csdl/proceedings-article/sp/2022/13... This last paper found flaws that should allow some side channel attacks (though I find it hard to believe that 3 microsecond differences can be measured against the client unless the attacker controls the server) but concludes that the protocol should be secure enough with their proposed fixes, which Telegram seems to have implemented; the problems mainly stem from implementation bugs, something the Signal protocol wasn't necessarily checked for during their extensive audit.
Based on this research I can't say I can find much wrong with mtproto2. It's proprietary in the same way the Signal protocol is proprietary, in that it was originally invented for a specific purpose inside a specific app. Just because nobody has bothered to copy the protocol to their app like WhatsApp did with Signal doesn't mean it's any more or less secure.
In the context of an app that can't encrypt group messaging and doesn't encrypt private messaging by default, I don't think focusing on the potential insecurity of mtproto2 makes sense. Telegram made some dubious, foolish security theatre ("hack our server and win a prize!") but on a protocol level there are no glaring mistakes that necessarily invalidate the protocol itself. The big problem here is that only a fraction of users actually use this seemingly-secure protocol on the first place.
Earlier quoted context omitted.
> I think their E2E protocol is fairly sound How come? It's completely proprietary and it's never been audited.
it has been audited, and they said it was a total mess and was full of vulnerabilities
I love Telegram, but it is one of those apps that since it requires a phone number I don't really trust them with ultra-secret data. I think their E2E protocol is fairly sound, but even that isn't ideal. I think you may also get some minimum benefit by using the open-source Android app vs the Google Play Store app. Regardless, if you really desire secrecy (and I believe in privacy but would never advocate for serious…
Signal also requires a phone number, IIRC
Earlier quoted context omitted.
> I think their E2E protocol is fairly sound How come? It's completely proprietary and it's never been audited.
Like other algorithms, it's a fairly simple mix of existing encryption paradigms. One paper tried to validate Telegram's protocol: https://www.researchgate.net/publication/346702021_Automated... That seems to have gone well. The mechanisms used seem very similar to the mechanism used in Signal's last audit from 2017. Another paper only verified part of the protocol in a specific way: https://www.computer.org/csdl/pro…
>"To this day, we have disclosed 0 bytes of user data to third parties, including governments." A very specific way of saying what most would assume means their users' data is safe. Even if it's not an outright lie, allowing government agents to view user data in their office would not contradict their statement.
I love Telegram, but it is one of those apps that since it requires a phone number I don't really trust them with ultra-secret data. I think their E2E protocol is fairly sound, but even that isn't ideal. I think you may also get some minimum benefit by using the open-source Android app vs the Google Play Store app. Regardless, if you really desire secrecy (and I believe in privacy but would never advocate for serious…
Easy to install, works on every platform I need it, super-simple bot support and the UX is very nice. You even have tools to make write-only groups (microblogs of sorts) and actual moderation tools for larger groups.
For a "community", I'd pick Discord though.
Matrix as a technology is a good competitor, but the UI/UX for every client I've tried rangers from "death by a thousand cuts" to atrocious.
Case in point: I got a notification about a message on a channel on my phone from my Element client. I open it and what do I see? Not the message. A "Syncing" -message that lasts longer than I can stand to wait. My phone actually falls back to sleep and turns off the screen while I'm waiting for it to sync. And after it has synced, does clicking the notification take me to the channel? Of course not and now I've already forgotten where the notification was from.
It's honestly not realistic to expect any free service provider to martyr themselves for your privacy. With that in mind, remember that anywhere you don't control the metal someone is watching you. Always.
Earlier quoted context omitted.
Signal also requires a phone number, IIRC
Yes, a significant flaw, however, it's not that difficult to source a disposable phone number.
>"To this day, we have disclosed 0 bytes of user data to third parties, including governments." A very specific way of saying what most would assume means their users' data is safe. Even if it's not an outright lie, allowing government agents to view user data in their office would not contradict their statement.
What is your definition of "disclosed"? https://www.merriam-webster.com/dictionary/disclosed