Live data from Hacker News

After Delhi High Court ruling, Telegram discloses personal details of users

livelaw.in

201–210 of 230 posts

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#201
post #122

Earlier quoted context omitted.

OTR doesn't do groups. So it isn't really applicable to IRC. At this point, I am not really sure that end to end encryption is generally applicable to groups. The identity management problem quickly spirals out of control. I note that Telegram doesn't even try. I think the best that can be done is a scheme that makes everyone entirely trust the moderator of the group.

>At this point, I am not really sure that end to end encryption is generally applicable to groups. You encrypt the message with all the public key's from persons in the group, what's the problem? You do it the same way with Mail...aka pgp. You don't need OTR just plain old gnupg: https://www.gnupg.org/gph/en/manual/x110.html

Each participant needs to verify each and every other participant. So for 2 participants that's 2 verifications. For 3 participants that is 9 verifications. For 4 it's 16. The square of the number of participants. With just 30 participants that works out to 900 verifications ... and who actually knows 30 people on the internet? Even if you could do the verification in a technical sense it wouldn't mean anything.

If you get a whole bunch of people together in real life for a meeting then chances are one or more of them is going to leak what happened. The problem is to a great extent inherent.

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#202
post #88

Earlier quoted context omitted.

> the keys are held by Telegram This is where the privacy promise falls apart. From a user's perspective on-disk encryption makes no difference, because there is no real enhancement of privacy for them. If a third party holds the key, they hold the key. If you put something into the hotel safe, the hotel could still steal it from you. As far as I can tell, most TG users are not aware or do not care, but for those who…

I’m interested to know about what makes Moxie a bit dubious, can you share more information? I have to say I’m slightly fascinated by the character, but it’s true it doesn’t tell anything about why I should trust him.

I have to say that I find him fascinating too, but there are a few things that raise my suspicion, but of course do not convict him of anything:

The way he is attacking this alternative Signal client and rules out interoperability:

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Signal was a word before he decided to turn it into a brand.

The signal server source code repo was not updated for a year. Communication intransparent.

https://www.androidpolice.com/2021/04/06/it-looks-like-signa...

I am not even against crypto integration, but I found the choice of MobileCoin odd. Instead of integrating an existing privacy coin or working with the community, he decided to integrate MOB and to be one of their "advisors":

https://techcrunch.com/2018/04/24/mobilecoin-moxie-marlinspi...

https://www.coingecko.com/en/coins/mobilecoin

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#204
post #134
post #37

Earlier quoted context omitted.

It is not. Session and Matrix alone use the same protocol Signal uses without needing your phone number or google play services.

I run Signal just fine without Google Play Services. I am using e/OS which doesn't have it bundled.

I disabled it, it complained a lot and images/media wouldn't load.

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#206

Earlier quoted context omitted.

yes. yes yes. yes. yes 100%. the same reason i avoid whatsapp and signal like the plague. "mobile number" is in itself a big identifier when you are living in a place where you have o do mandatory KYC so that the government knows which each mobile number is linked to the actual human being. i dont care signal doesnt hold any messages. the government can ask for my number and they can use the xkcd spanner method to do…

> i dont care signal doesnt hold any messages. the government can ask for my number Whose number? How are the government going to "ask for your number" ? Signal doesn't hold any data that would let them answer that query if they wanted to.

You realize, with a phone number, all payment details for the SIM can be accessed?

And that from the SIM, you get IMEI, which can be cross ref'd with telecom logs to get geolocation?

Phone numbers are basically a glorified UUID. Also, in most jurisdictions it is required by law that telcos have tight integration with Law Enforcement, and even with the U.S., any type of investigation will start with a pull for the individual's phone number from whereever, cross ref that with SIM financial payment info, cross ref'd with bank accounts/credit card activity for purchase activity. Then cross-ref with Driver's license/civic/court records?

By DEFAULT. Third party doctrine. It ain't protected by the Fourth Amendment. In less zealous states, forget about principled restraint. The phone number is effectively your citizen Id.

When people like me start raising hell about the dangers of UUID primitives, this is what we're trying to protect you from.

No one can be trusted with the view created by the aggregation and cross-reference of this type of info. Every government/legislature/population will eventually "think of the children/criminals" their way to it anyway though, while law enforcement jumps up and down with glee at how complete a picture they can get through their fusion centers. Then it's just a matter of how long it takes for an autocrat to insert themselves into a place of power until the technological marvel that empowers law enforcement to "ensnare the bad guys", has "bad guys" surreptitiously crossed out and replaced with some signifier for a set of people that contains you.

If you don't think that happens, you ain't been paying enough attention. If you wonder why that hasn't been an issue before, it was because part of what puts a check on LE was the burden of physically referencing and cross-ref'ing data, which would put a fundamental cap on the ability for any abuse of power to materialize.

We're losing that check. Quickly.

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#207
post #122

Earlier quoted context omitted.

>At this point, I am not really sure that end to end encryption is generally applicable to groups. You encrypt the message with all the public key's from persons in the group, what's the problem? You do it the same way with Mail...aka pgp. You don't need OTR just plain old gnupg: https://www.gnupg.org/gph/en/manual/x110.html

Each participant needs to verify each and every other participant. So for 2 participants that's 2 verifications. For 3 participants that is 9 verifications. For 4 it's 16. The square of the number of participants. With just 30 participants that works out to 900 verifications ... and who actually knows 30 people on the internet? Even if you could do the verification in a technical sense it wouldn't mean anything. If y…

Man you never hear of a trust-chain? How do you think end to end encryption works otherwise?

And no you don't need to verify each other keys, since every one has his public key you obliviously trust, you just try to make an excuse for not knowing how e2e works.

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#208

Earlier quoted context omitted.

Well, only republicans.

Each party picks something it seems. Republicans can’t seem to be bothered with the 4th amendment and Democrats seem to support it. At least at local levels. At the federal level nobody seems to care.

Both parties largely see the constitution as something they need to get around, and have largely (with full support of the courts) inverted the meaning of the constitution to be not a limit on government power, but a limit on individual rights

In your example where Democrats support the 4th amendment, what except if a random person says you are armed then the 4th goes out the window, except if you are deemed to be rich then the 4th goes out the window, except if you have the "Wrong" opinions then the 4th goes out the windows

Democrats like Republicans only support the 4th, and every other amendment to the point where it supports their narrative and desire for power, the second the constitution is deemed to stand in the way of their power well it is document that should be ignored "for the greater good"

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#209

Earlier quoted context omitted.

I'll get my mum right onto it

In all fairness, I got my entire non-technical family onto xmpp/jabber with Snikket (which is a highly opinionated packaging of existing xmpp server and clients with minor tweaks). They scan a QR code to download the app and join the server. It is e2ee out of the box and the experience is quite comfortable and seamless, even for a non-technical person.

[deleted]

Re: After Delhi High Court ruling, Telegram discloses personal details of users

#210
I am not defending Telegram, but as a social media application (and a private chat option), Telegram is only complying with existing laws. Copyright materials are a taboo on ANY electronic medium (including the open web). We just had a major issue around the Z-Library. Each time anything of this sort happens, I see the Signal users coming out from no-where. These news aren't a big deal, and numerous public channels have faced the axe. Most of them have changed tactics by going "private" by rapidly changing their invite links or using bot services to "verify users" before they join. Public groups earlier sharing copyright materials are "banned". There are numerous bots that connect to torrents and upload content to Telegram. Z Library still serves content; Nexus bots have just rolled out a feature to connect your bot (through API token). Signal serves a specific niche of users, and I think polarising arguments (or moralistic stands) are only to play to the gallery.
Post reply on HN