Because Russians want easy access to conversations.
Why Isn’t Telegram End-to-End Encrypted by Default (2017)
111–120 of 151 posts
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#112The why doesn't matter. (the tl;dr is that they apparently never bothered to support some popular features within the context of e2ee, and believe people ultimately don't care about e2ee by default) What matters is that: - It doesn't do e2ee by default. - It is not a properly documented protocol[0]. - It is not an open protocol. - It has a history of extremely poor cryptography practices[1][2]. - It is not open sourc…
I've been exploring options with a friend, their requirements: 1) option for large groups (around 250) This drops Signal out which has a limit of 150 on groups: https://support.signal.org/hc/en-us/articles/360007319331-Gr... 2) e2e encrypted (because it sounds good, not because people actually understand what it is), including groups. This drops Telegram out: no e2e rooms. 3) handles sending photos, videos, and voice…
What about Wire (groups up to 500, e2e, handles photos etc, Swiss firm, easy to use)?
https://wire.com/en/products/personal-secure-messenger/
And why's Threema out? You can hardly complain that there is no solution to your needs, and then, when one is offered, say "no need for yet another solution"...
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#113Earlier quoted context omitted.
>handles sending photos, videos, and voice messages More or less kills XMPP, unless people are on the latest-and-greatest version of Conversations and maybe ChatSecure. Are there any popular XMPP clients that don't support "HTTP File Upload" at this point? I went looking for a list of those that do and had to give up. They all support it now.
Well... that's complicated. On it's own, XEP-0363 (HTTP File Upload) and OMEMO both work well everywhere, even in my horribly overpatched Pidgin. But if you put the two together, Conversations, for example, will encrypt the message and encrypt the upload as well. My Pidgin then will handle the message well, but display an url starting with aesgcm:// leading to the still encrypted file. The question is then: is the co…
I feel like encryption before payload and OMEMO are 2 different layers like, say, TLS compression and HTTP compression.
When you send a pic in a conversation, the content-type of the resource is "image/*". It doesn't matter whether the image is encrypted, compressed on-the-fly, or whatever, the receiving end must "undo" all of it to present the intended resource to the user
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#114Earlier quoted context omitted.
How about email? Seriously... setting up your own email server. All users use a web client (there are tonnes out there, with the option of using thicker clients). Bots can be used to organise the groups, add new users, etc.
By the way before anyone shouts at me, I know email isn't E2E encrypted. As I've said before on HN: if you are looking to communicate securly, you shouldn't be using anyone else's infrastructure. That includes Signal et al. Most people chatting to their friends and family don't need that level of security. If you don't want China listening to you: don't use someone else's system.
You could even allow only emails to the same domain (handled on the same server itself). Then emails never leave the server, and people can access them with their favourite tool, such as web or IMAP/SMPT, which encrypts everything in transit these days, if set up properly, unless I'm mistaken.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#115Earlier quoted context omitted.
Have you heard about Wire? Groups up to 500, when they switch to MLS protocol then thousands, e2e, Swiss based and it has kind of ok UI.
> has kind of ok UI It has a single UI, so it's out. Wire specifically disallows anything 3rd party.
App is available on Android, iOS, Mac, Win, Linux though - what more do you need?
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#116Earlier quoted context omitted.
I keep hearing this, but is there an actual reliable source that confirms it? If it were that easy, then I could technically restore anyone's GDrive backup from WhatsApp on my Android phone simply if I got access to the same Google account, but I believe this is not possible as you have to also verify the phone number via SMS.
They say it themselves https://faq.whatsapp.com/android/chats/about-google-drive-ba... "Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive."
That statement is correct. E2E encryption is only in effect between two devices communicating with each other. The moment the messages leave the app in any capacity (e.g., screenshots, backup, forwarded to another convo/contact, etc.) it is not longer protected by E2E encryption.
The backup file itself that is uploaded to iCloud/GDrive is encrypted; see: https://security.stackexchange.com/questions/136072/how-can-...
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#117Earlier quoted context omitted.
I've been exploring options with a friend, their requirements: 1) option for large groups (around 250) This drops Signal out which has a limit of 150 on groups: https://support.signal.org/hc/en-us/articles/360007319331-Gr... 2) e2e encrypted (because it sounds good, not because people actually understand what it is), including groups. This drops Telegram out: no e2e rooms. 3) handles sending photos, videos, and voice…
> This drops Signal out which has a limit of 150 on groups Your own link mentions "Size limit of 1000", where did you see 150? To be fair that's for new groups, maybe the limit used to be lower. Or do you mean that in practice it's not usable beyond 150 people?
The page seems to have been updated recently to say 1000 instead of 150, definitely less than a month based on archive.org
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#118> 1) Users don’t want to lose their entire message history when they lose/change their phones so apps of this kind never become massively popular. I think this is a key point to consider for Signal and the other "good" messengers - there's ways to do secure backups, it just needs to be implemented so well that you won't miss the convenience of Google Drive backups. I tend to fall back on anecdotes a lot, but the firs…
Matrix already has solved it. Message history is stored on the servers, like in Telegram. With the difference, that the end user has a secret. This secret can be written down/saved and/or be implicitly passed through his/her own devices by e.g. scanning a QR code. This works simultaneously across arbitrary platforms with arbitrary many devices including web. Telegram seems to want to create the illusion that there is…
If you requires them to write down or print, then there will be people just not do it and still lost their data all together.
If you just infer it from user password. Someone is definitely going to use weak password and get cracked in seconds.
If you requires a strict password rule to enforce strong password, someone is going to forget it and lock them out of their account. Because they only use this password here and there is literally no reason you use it the second time(most people only login from 1 device. Unless it is broken, you are not going to login the second time).
Requires a physical device is also a no go. Because devices can break. Unless you have another backup, you are screwed.
I am not sure there is a method that is secure(that don't lost message by accident) to most of the users.
Lost messages and contacts is way more risky then your message may be seen by CIA to most users, I believe.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#119Earlier quoted context omitted.
And he is right. If you want e2e use signal, threema, or OTR/OMEMO. The majority of telegram users want convenient messaging, group chats, news channels and voice group calls. Think slack with a fast native app.
> news channels I love getting glimpses of how other people use certain apps. I can't imagine _wanting_ news in my messaging app - that's what my news app is for! Very valuable reminder that our own perspective is not always widespread.
Even I hated those things in my messenger app.
Until this happened https://instantview.telegram.org/
Instant View is so fast (and private) i'm never reading articles any other way.
Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)
#120Earlier quoted context omitted.
My understanding is that WhatsApp backups are plaintext. It's true that Apple/Google can't recover your WhatsApp account with just the plaintext, but I believe they can read the messages.
Thanks for replying! This is concerning if true. Is this documented or proven anywhere? I had heard something similar, but can't seem to find any reliable source that confirms the messages are in plaintext.
https://www.tomshardware.com/news/whatsapp-google-drive-back...
WhatsApp recently announced that users will soon be able to backup all of their data to Google Drive without that storage eating into their allocated Drive storage. What the company ommitted to say at the time was that the data backed-up to Drive will be stored in plaintext, without any encryption.