Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram has launched a pretty intense campaign to malign Signal as insecure

twitter.com

Post reply on HN
Print view View original

161–170 of 501 posts

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#161

Post by ants_everywhere »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

Telegram rolled their own crypto and is used for a lot of intelligence operations like monitoring dissident groups, promoting propaganda, recruiting agents, etc. That probably explains the push to discredit more private apps like Signal.

Researchers of Telegram's protocol have said in some ways it's weaker than TLS.

E.g.

- https://www.wired.com/story/the-kremlin-has-entered-the-chat...

- https://therecord.media/telegram-blocks-chatbots-used-by-ukr...

- https://www.oporaua.org/en/polit_ad/and-telega-is-still-ther...

- https://www.pravda.com.ua/eng/news/2024/05/8/7454849/

- https://time.com/6280190/cia-recruit-russian-spies-telegram/

- https://www.cia.gov/stories/story/cia-launches-telegram-chan...

- https://nordvpn.com/blog/is-telegram-safe/

- https://portswigger.net/daily-swig/multiple-encryption-flaws...

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#162

Post by richardw »

treprinum wrote: post #100
imjonse wrote: post #90

Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.

Why is home-rolled crypto inherently insecure?

Good answers here:

https://security.stackexchange.com/questions/18197/why-shoul...

I’d do a disservice to try copy and paste here so rather look at the top answer

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#163

Post by snvzz »

akie wrote: post #45
yreg wrote: post #38

So the entire argument for "Telegram isn’t a secure messenger, full stop." is that E2EE is opt-in? If that's all there is to it, then the opinion is rather weak. edit: maybe post a comment in addition to pressing the downbutton. I'm curious what's so problematic about what I've said.

Defaults are important because (very) many people don't change them.

Most.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#165

Post by bloqs »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

This is astroturfing. Telegram has never been secure

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#166

Post by nurumaik »

OSI-Auflauf wrote: post #93
yreg wrote: post #9

https://nitter.poast.org/matthew_d_green/status/178968789886...

On Signal vs Telegram: Telegrams Encryption is off most of the time. They have serverside access to messages. The optional E2E is annoying to use and isnt even available on every platform. For example Tdesktop afaik still has no E2E support. (And has a very brittle software architecture.) You can't register Telegram accounts with the open source client anymore. This should be a non-Discussion. MG implying that just b…

You can buy "anonymous number" on fragment without using any client and without providing any personal information and use it as much as you can

When signal becomes at least remotely as popular as telegram it will implement same protection to fight against spammers because you can't have free unrestricted registrations and don't drown in spam

Telegram currently makes it as accessible as possible: either use it freely but register using phone number and official app or pay and use anonymously as you want

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#167

Post by tssge »

OSI-Auflauf wrote: post #138
gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

Telegram Foss clients exist only because of unpaid volunteers that take Telegrams messy mix of open and closed parts and rip closed parts out and replace them. The Telegram organisation is notoriously late to release the source code to their current release. If they do, its a giant squashed commit without proper changelog. These releases must then be first wrangled by volunteers to be well buildable. The Telegram Org…

Telegram has fully reproducible builds and is not that complicated to build, no issues there. They even have a guide on how to build & verify. [0] No need to wrangle or modify, generally builds as is (at least from my experience).

Granted yes, the version commits are squashed like you said. [1] However I haven't seen source release to lag behind store releases, any sources on that?

0: https://core.telegram.org/reproducible-builds 1: https://github.com/DrKLO/Telegram

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#168

Post by vetinari »

lukan wrote: post #60
vbezhenar wrote: post #44

Earlier quoted context omitted.

Both Russians and Ukrainians use Telegram, including confidential messaging with their agents on the foreign territory. So that's a prove enough for me, that it's safe enough.

"including confidential messaging with their agents on the foreign territory" Possible, as many ridiculous things happened around the whole war. (Recently german generals on a video chat were targeted by the russians, wasn't too hard, they did not use any encyption at all) Sources would be nice though. But it really would not be a reason for me to trust telegrams security. Rather a confirmation again, that also secre…

> Recently german generals on a video chat were targeted by the russians, wasn't too hard, they did not use any encyption at all

They used Webex. Doesn't Webex use any encryption at all?

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#169

Post by danpalmer »

treprinum wrote: post #100
imjonse wrote: post #90

Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.

Why is home-rolled crypto inherently insecure?

It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily.

It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#170

Post by OSI-Auflauf »

gkbrk wrote: post #154
OSI-Auflauf wrote: post #138

Earlier quoted context omitted.

Telegram Foss clients exist only because of unpaid volunteers that take Telegrams messy mix of open and closed parts and rip closed parts out and replace them. The Telegram organisation is notoriously late to release the source code to their current release. If they do, its a giant squashed commit without proper changelog. These releases must then be first wrangled by volunteers to be well buildable. The Telegram Org…

This doesn't affect the user that downloads these from distro repos or F-Droid because every single update they get comes from the source code. There is never a lag even for 1 second because without the source code there are no builds. Pretty much all the packages on Linux repos come from package maintainers taking upstream source code, removing parts they don't like and then building that. This is a normal part of p…

Yes and thats why users spend sometimes months on old builds.

Also which distro packages Telegram?

Fedora doesn't. Debian does but at times it was so old the client crashed from receiving server comms because it wasn't fully compatible. It actually crashed as in segfault.

Post reply on HN