Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Isn’t Telegram End-to-End Encrypted by Default (2017)

telegra.ph

Post reply on HN
Print view View original

141–150 of 151 posts

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#141

Post by olah_1 »

ta1610429351 wrote: post #129
olah_1 wrote: post #99

Earlier quoted context omitted.

No, Durav made a post about this recently but it was on his Telegram channel. Basically they don't have servers in Russia and it has been banned there in the past.

Durov's servers may be anywhere but his arse is in Russia. That's more than enough leverage for KGB to silent him and/or Telegram at will. Yet, for some inexplicable reason, he still lives in Russia all this time. Food for thought.

Russia has already "silenced" Telegram in the past. I think he lives in Russia because he is Russian and enjoys it there.

Your attitude towards Russia is humorous, given that you're far more likely to be silenced in America these days. Except it's worse in America because you won't just be silenced. You will be completely cut off from life financially, communications-wise, commercially.

Ironically, the only people pressuring Durav to do things like ban Telegram channels is Apple and Google.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#142

Post by troyvit »

behnamoh wrote: post #48
dhsysusbsjsi wrote: post #39

Earlier quoted context omitted.

Amazingly this is why I’m attracted to Signal and have set all chats to 1 week auto delete. To me text chats should be ephemeral. If I want something to stick around for years, send to email.

Even email is not permanent. There was a discussion a few months ago on HN where people were complaining that very old attachments just don't load up in Gmail, because they are not backed up on the servers.

There's a difference between email not being permanent and gmail not being permanent.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#143

Post by chanmad29 »

dhsysusbsjsi wrote: post #39
meibo wrote: post #3

> 1) Users don’t want to lose their entire message history when they lose/change their phones so apps of this kind never become massively popular. I think this is a key point to consider for Signal and the other "good" messengers - there's ways to do secure backups, it just needs to be implemented so well that you won't miss the convenience of Google Drive backups. I tend to fall back on anecdotes a lot, but the firs…

Amazingly this is why I’m attracted to Signal and have set all chats to 1 week auto delete. To me text chats should be ephemeral. If I want something to stick around for years, send to email.

Or better copy that to your notes- icloud/OneNote.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#144

Post by fuzxi »

noxer wrote: post #137
fuzxi wrote: post #125

Earlier quoted context omitted.

>manual delete including deleting your partners messages if you want to (on both sides - obviously not in groups You can delete other people's messages for everyone in the chat if you're an admin of the group.

Yes, obviously you can as admin but that's just the admin power. You can also delete/edit your own messages in groups but they will be visible in the admin log for 2 days. So these 2 features are not meant to remove your messages from being stored/archived. Its just the normal moderation feature of group chats.

It's trivial to give everyone in a group admin rights with only the permission to delete messages.

You can also delete all messages in a group from a specific user in one action.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#145

Post by srhngpr »

ffpip wrote: post #121
srhngpr wrote: post #116

Earlier quoted context omitted.

That statement is correct. E2E encryption is only in effect between two devices communicating with each other. The moment the messages leave the app in any capacity (e.g., screenshots, backup, forwarded to another convo/contact, etc.) it is not longer protected by E2E encryption. The backup file itself that is uploaded to iCloud/GDrive is encrypted; see: https://security.stackexchange.com/questions/136072/how-can-...

It used to be encrypted. However, Google and Whatsapp have a deal that states Whatsapp backups dont count towards drive storage quotas. It became plaintext (or at least unencrypted after that) https://www.tomshardware.com/news/whatsapp-google-drive-back...

From 2018 but also, this is referring to moving away from E2E encryption, which is true. However, the backup file that gets uploaded to Google Drive (Android) or iCloud (iOS) is encrypted (i.e., Google and Apple cannot read its content). See: https://security.stackexchange.com/questions/136072/how-can-...

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#146

Post by behnamoh »

troyvit wrote: post #142
behnamoh wrote: post #48

Earlier quoted context omitted.

Even email is not permanent. There was a discussion a few months ago on HN where people were complaining that very old attachments just don't load up in Gmail, because they are not backed up on the servers.

There's a difference between email not being permanent and gmail not being permanent.

Logically speaking, my sentence is correct.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#147

Post by snvzz »

jayp1418 wrote: post #140
snvzz wrote: post #84

Earlier quoted context omitted.

I do not like it (I prefer Matrix, where accounts are not tied to phone lines), but I am ok with Signal, as it is open source, it is always e2ee and using it really offers privacy. Telegram, on the other hand, is not open source, nor does it do e2ee by default. Having to explicitly select "new secret chat" ultimately means the non-technical inclined can and will use it wrong, getting no privacy whatsoever. Therefore,…

Good thing. Signal coming up with usernames

Indeed. I found this: https://signal.org/blog/signal-pins/

But as far as I can tell, no steps have been taken since; In the downloads page, it warns me that for the Desktop version to work, I need to create an account with my phone first.

I'll keep an eye out.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#148

Post by rhn_mk1 »

alwaysdoit wrote: post #32
rhn_mk1 wrote: post #18

Earlier quoted context omitted.

Does wanting any of this automatically mean wanting e2e is wrong or invalid?

No, but it's automatically the right tradeoff for everyone. Security measures are always a tradeoff between convenience and security. Not everyone's tradeoffs work out evenly. Sometimes backups are a more important risk to mitigate than government surveillance.

> it's automatically the right tradeoff for everyone

That can be only true if there is no tradeoff. A tradeoff by definition is a situation where the optimum depends on individual preferences.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#149

Post by m4lvin »

pmlnr wrote: post #88
m4lvin wrote: post #82

Earlier quoted context omitted.

Encrypting the message AND the upload seems a no-brainer to me, if you want to call it E2EE. If the upload would not be encrypted then the (admin of the) server running XEP-0363 HTTP File Upload could see the contents.

I agree. The part I don't see is then what plugin should handle which part, and how. Most XMPP clients are plugin based as well. Should the OMEMO plugin then look for aesgcm:// urls, download it, and decrypt it, or should the http upload plugin look for the availability of encryption and try to decrypt?

That is only a question if HTTP upload and OMEMO are different plugins. With https://dino.im/ it also "just works" and as a user I do not care which part pf the program does what.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#150

Post by mcint »

tomp wrote: post #45
mcint wrote: post #6

Bait-and-switch topic in the opening paragraph. Insists that what people ask for, e2e chat, isn’t what they actually want or should want.

no, it says that what people ask for, e2e chat, isn't what people get (because of unencrypted cloud backups).

fair, especially of the opening sections mentioning backups.

It is a marketing piece, and I bristle at it raising issues I like to take seriously, e2e you can't misuse, and moving the goalposts to tout its more limited capabilities and defaults: pair-only(?) secret chats, and not on by default.

Telegram's cryptography and theater of justifications have been suspect from the start, so I read any advice coming from them about security with two raised eyebrows.

See also: The Most Backdoor-Looking Bug [Filippo's] Ever Seen

https://buttondown.email/cryptography-dispatches/archive/cry...

Post reply on HN