Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram has launched a pretty intense campaign to malign Signal as insecure

twitter.com

Post reply on HN
Print view View original

141–150 of 501 posts

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#141

Post by croes »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

Does Telegram still use their own crypto algorithm?

If so, up-to-date source code us pretty useless.

How many people check their app's source code?

With third party clients it's pretty easy to get malicious ones

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#142

Post by threeseed »

kome wrote: post #105
Quiark wrote: post #83

Earlier quoted context omitted.

Not sure if metadata is more important but ok. Signal has launched support to use nicknames instead of phone numbers although it's true this took a long time. I think Telegram is very wide-spread for running large group chats and communities, a use case that Signal is not interested in. Personally, I want my chats end to end encrypted and I'm grateful to Signal for pioneering this and inspiring Whatsapp, facebook mes…

People has been killed based on metadata https://www.nybooks.com/online/2014/05/10/we-kill-people-bas...

No is arguing the metadata is harmless but it's significantly less of an issue than not having E2EE.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#143

Post by benterix »

As far as we can tell, they are both insecure: Telegram is closed source and Signal published their source but basically forces users to use the Google Play version which lags behind the OS version and you can never be 100% sure what it does, not to mention things like SGX.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#144

Post by jojobas »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

Can these alternative telegram clients be sure the keys the server sent are from the other client, with no MITM? (Honest question, I don't know the answer.)

Matrix or bust.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#145

Post by FabHK »

Intermernet wrote: post #59

There seems to be a concerted effort to discredit Matthew's claims. Even here on HN. I find this suspicious. The Signal protocol has been heavily audited by many different people from many different countries. It's usually found to be sound. The telegram protocol has been found to have issues that are, if not malicious, amateur level mistakes. Once again, this is not my opinion. This is the result of independent audi…

Eh, split any important message into pieces, put a piece each in Signal, WhatsApp, Telegram, Threema, Line, and then the Americans, Russians, Swiss, and Koreans will each have some parts, but if you're lucky, nobody has all...

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#146

Post by Sakos »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

This comment sounds like astroturfing to me. Telegram doesn't even provide secure chats by default. Everybody I've talked to was unaware that the chat was unencrypted until I pointed it out. That's before considering that 1) I don't consider the company behind Telegram in any way trustworthy, 2) the servers for Telegram are closed source and it's unclear what's running there. Signal's server code is open source and the github is actively updated. We also know who works on Signal, as well as their credentials, and they're reasonably trustworthy compared to alternatives.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#147

Post by Dunedan »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

> You cannot download Signal from F-Droid. You need to download it from the Google Play Store.

You can also download the APK directly from their website: https://signal.org/android/apk/

When doing so Signal uses its own update mechanism to stay up-to-date.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#149

Post by Razengan »

alexpc201 wrote: post #111
OSI-Auflauf wrote: post #98

Earlier quoted context omitted.

Signal has got Usernames now. You can block number discovery. You can't resolve username to number. Your main account ID internally is not your number anymore. If 2 users add you using 2 different links or usernames. Its now harder to confirm its the same account.

Tell me, can you have a Signal account WITHOUT giving them your phone number?

Can you sign up for Telegram without a phone number?

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#150

Post by OSI-Auflauf »

rfoo wrote: post #103
Quiark wrote: post #83

Earlier quoted context omitted.

Not sure if metadata is more important but ok. Signal has launched support to use nicknames instead of phone numbers although it's true this took a long time. I think Telegram is very wide-spread for running large group chats and communities, a use case that Signal is not interested in. Personally, I want my chats end to end encrypted and I'm grateful to Signal for pioneering this and inspiring Whatsapp, facebook mes…

> Signal has launched support to use nicknames instead of phone numbers You will still need a phone number to sign up for Signal. Signal still knows your phone number, you just hide it from your contacts. To me this only makes it even more suspicious.

You need a phone number to sign up for Telegram as well.

And you can correlate username to phone number not that hard in most standard setting cases.

Post reply on HN