Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

211–220 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#211

Post by sroerick »

thisisabore wrote: post #193
lolinder wrote: post #157

Earlier quoted context omitted.

> It's the only messaging app where messages are stored on the cloud. Besides Slack and Discord and Teams and whatever the heck Google has these days and iMessage and... I think you mean it's the only messaging app that purports to have a focus on security where messages are stored in the cloud, which is true, but also sus. There's a reason why none of the others are doing it that way, and Telegram isn't really claim…

Matrix also keeps your message on the server. Except you can run your own server. And the messages are end to end encrypted. And you can keep a proper backup of the keys. Granted it can be clunky at times, but the properties are there and decentralised end to end encrypted messaging is quite and incredible thing. (Yes, Matrix nerds, it's not messaging per se it's really state replication, I know :))

Doesn’t Matrix replicate all chat metadata to any linked federated servers?

Re: Is Telegram really an encrypted messaging app?

#212

Post by p4bl0 »

jxi wrote: post #154
icepat wrote: post #141

Earlier quoted context omitted.

What's in Telegram that you don't see in Signal? Honest question, I only use Signal rather than Telegram.

Signal has probably the worst UX of any messaging app. It also used to require sharing phone numbers to add contacts, which imo is already a privacy violation. Telegram is fast, responsive, gets frequent updates, has great group chat, tons of animated emojis, works flawlessly on all desktop and mobile platforms, has great support for media, bots, and a great API, allows edits and deleting messages for all users, and…

> Signal has probably the worst UX of any messaging app

Really? I don't see any real difference between the UX of WhatsApp and Signal for example. And they're really on-par feature wise.

The only things in your list that are not available on Signal are "tons of animated emojis" and "bots". Recently they also introduced usernames to keep your phone number private. And Signal have had all the other things for a few years now, and with actual security.

Re: Is Telegram really an encrypted messaging app?

#213

Post by jraph »

EGreg wrote: post #162
jraph wrote: post #153

Earlier quoted context omitted.

> and earning some crypto You are not answering my main concern. Again, you snick in crypto into the discussion. Why? We have decentralized stuff. Email, xmpp, matrix, the fediverse, all this works without this web3/crypto stuff. Those things are not perfect, including their decentralized aspect (sometimes to the point of doubting that decentralization really works well, although I personally think decentralization i…

Because crypto is literally how entities on a decentralized network get paid in an autonomous network. It's not via cash transfers. It's not via bank transfers. Or having accounts in some central bank. Look at FileCoin and IPFS, for instance. Once you automate the micropayments and proofs of spacetime, it becomes a cryptocurrency. And then the providers of services can sell it to the next consumers. Just because you…

> Because crypto is literally how entities on a decentralized network get paid in an autonomous network

That doesn't ring true. What is an autonomous network? Those things runs on the internet, largely backed by infrastructure funded by traditional money. Moreover, emails, tor nodes, xmpp servers, matrix homeservers, fediverse hosts... None of those need cryptocoins to fund themselves, and are indeed largely and for the most part funded using traditional money. Micropayments are also not something needed for decentralization.

Decentralization is way more than just about decentralizing money and many of us don't trust crypto coins.

Re: Is Telegram really an encrypted messaging app?

#214

Post by maqp »

_niki_s_ wrote: post #146
yarg wrote: post #87

Earlier quoted context omitted.

Is there a nice solution for multiparty (n >= 3) end-to-end encryption?

simplex.chat

The entire platform is a joke. It pretends to have no identifiers and heavily markets queues (a programming technique) as a solution to privacy problem.

You ask the authors how they solved the problem of server needing to know to which client connection an incoming ciphertext needs to be forwarded, and they'll run to the hills.

They're lying by omission about their security, and misleading about what constitutes as a permanent identifier.

Re: Is Telegram really an encrypted messaging app?

#215

Post by sroerick »

chadsix wrote: post #99
tptacek wrote: post #48

Earlier quoted context omitted.

You can coherently argue that encryption doesn't matter, but you can't reasonably argue that Telegram is a serious encrypted messaging app (it's not an encrypted messaging app at all for group chats), which is the point of the article. The general attitude among practitioners in the field is: if you have to reason about how the operator will handle legal threats, you shouldn't bother reasoning about the messenger at…

> if you have to reason about how the operator will handle legal threats, you shouldn't bother reasoning about the messenger at all. That's true. You need to run your own platform people. XMPP is plenty simple, plenty powerful, and plenty safe -- and even your metadata is in your control. Just self host. There's no excuse in 2024. Wake up people! Why should the arrest of someone else affect YOU?

Sadly, you still have to pipe all messages through Apple’s notification API if you want notifications on iOS

Re: Is Telegram really an encrypted messaging app?

#216

Post by h4x0rr »

sroerick wrote: post #209
wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE

I don't think the plaintext is required to be part of the API call

Re: Is Telegram really an encrypted messaging app?

#217

Post by 3np »

mr_mitm wrote: post #131
lxgr wrote: post #94

Earlier quoted context omitted.

It indirectly has a lot to do with encryption, in that if Telegram was actually encrypted, they'd probably have no grounds on holding him in the first place. (At least at the moment, in most countries) it's not illegal to not ship a backdoor in your end-to-end-encrypted software upon government request, but in most it is illegal to not share data you're holding in a form accessible to you when you receive a warrant f…

Anyone can join these channels. How would encryption change anything?

Joins/leaves are visible to participants. Channel owners can decide if past history is to be made accessible for new joiners.

Re: Is Telegram really an encrypted messaging app?

#218

Post by alephnerd »

macintux wrote: post #182
codetrotter wrote: post #180

Earlier quoted context omitted.

Can I enroll my personal iPhone in MDM myself? And if I can have MDM with just my personal phone, do I need to buy some kind of subscription for it from Apple? Or pay some third-party? I thought MDM was only for enterprise businesses and schools and universities, but I may very well be mistaken about that.

Apple supplies a free application for managing MDM. https://support.apple.com/guide/apple-configurator-mac/welco...

^^^ Highly recommend this. If you are technical enough, a family managed Apple Configuration is more than enough to protect for most situations and from most threat actors.

If you're threat actor has the resource to break that, get a CC or a good lawyer on retainer I guess.

Re: Is Telegram really an encrypted messaging app?

#219

Post by wkat4242 »

sroerick wrote: post #209
wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

Telegram is the only messaging app that I know of which brought attention to the fact that your messages go through Google/Apple notification APIs, which seems like it would utterly defeat any privacy advantage offered by E2EE

The app can decrypt the notification before it's displayed.

Re: Is Telegram really an encrypted messaging app?

#220

Post by maqp »

dijit wrote: post #196
maqp wrote: post #181

Earlier quoted context omitted.

>it's just claiming that you can trust them more than you can trust the major messaging apps. All the cool kids in the block eliminated the need to trust the provider decades ago. PGP: 33 years ago, OTR 20 years ago, Signal 14 years ago.

You have to trust the provider with signal; they are fiercely anti-third party clients, control the network and have released version of the code that are not tracked by sources- in extreme cases we’re aware of years old code being in there (mobile coin for example). Signal evangelicalism needs to halt, you mean the Whisper protocol.

No serious project wants to collaborate with a bunch of hobbyist projects who may or may not keep their code up-to-date. Years ago, the Matrix ecosystem was a prime example of even basic features like end-to-end encryption being in many cases missing.

Having a single client gives you insane boost to security agility over decentralized alternatives.

Feel free to strive towards functional decentralized ecosystem that feels as good to use, then switching will be a no-brainer.

Post reply on HN