Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram has launched a pretty intense campaign to malign Signal as insecure

twitter.com

Post reply on HN
Print view View original

341–350 of 501 posts

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#341

Post by drunkan »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

Pure smear comment. Signal was and is the choice of personal messaging app for anyone I know who has ever worked in security or intelligence. That should say it all. Aside from apple, who did it because of them, it has set the gold standard for e2e chat. People moan about the phone number and “metadata” when in reality all this can be used for is to say yes x has a signal account and this is when they last used it. That’s it. It’s effectively useless to anyone. People moan about it leveraging the local social graph of the device it’s a necessary convenience for the adoption of any modern chat app. They go into great detail about how it is and isn’t used in a way that it cannot be used/viewed by others. Frankly I’d bet half the people smearing it have X and Facebook apps installed on there phones and really aren’t serious people. If I wanted to smear off topic I’d point out that telegram, along with the usual suspects, is a gold mine for intelligence gathering for what I’ve heard.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#342

Post by Intermernet »

vetinari wrote: post #300
Intermernet wrote: post #240

Earlier quoted context omitted.

Thanks for the explanation. I'll try to be less proactive, I guess...

Proactive is fine, if you know what is the overall impact. There's another: proactive idiot is worse than the class enemy[1]. [1] "Class enemy" or "třídní nepřítel" (cz) might be an unknown term in itself - https://en.wikipedia.org/wiki/Enemy_of_the_people#Soviet_Uni...

Ok, apparently I can now reply to this comment... Weird HN delays aside.

I don't care if the people who can decrypt Telegram chats are allied with any one side or another. I believe the idea of "Class enemy" to be abhorrent, and the moral / social threats of "the overall impact" to be negligible when compared to the fact that using compromised communications platforms will inevitably lead to greater problems than the act of calling them out.

This is the equivalent of "You'll keep quiet if you know what's good for you".

If Telegram is broken, certain people need to stop using it. The socio-political climate of the areas most likely to be using Telegram just makes this more urgent. This applies independent of if / how / why it's broken, and who, if anyone, may benefit from this.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#343

Post by laniakean »

deepsun wrote: post #306

It seems like a twitter thread of multiple messages. How can I read the rest of the messages, not just /1? There's no links to them.

https://threadreaderapp.com/thread/1789687898863792453.html

You can use the above link. Otherwise, you will have to log in, unfortunately. Earlier, we could have used a nitter instance, but all of them have been blocked.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#344

Post by [deleted] »

gkbrk wrote: post #74

You can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play…

[deleted]

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#345

Post by craigmart »

hifromwork wrote: post #315
craigmart wrote: post #212

Earlier quoted context omitted.

You are speaking of metadata as if all metadata is equal. Signal does collect phone numbers (even though, since usernames have been introduced [1], this can be made opt in from now on), but not the contacts or social graph, neither many other relevant metadata [2]. What they can gather from this, is only when the specified phone number registered to signal services and its last connection to the server [3]. So, if yo…

>but not the contacts or social graph, neither many other relevant metadata [2]. Assuming you trust them (notice all your links point to signal.org own publications). Most of the privacy people are cautious/paranoid and assume that everything that can be collected is collected. Even assuming a lack of malicious intent, what's stopping NSA from hacking into Signal's infrastructure and logging who's talking to who alon…

The point is that you don't have to trust them because the client (where the relevant cryptography is performed) is open source and the fact that my links point to signal.org is completely irrelevant, those blog posts are just ways to advertise facts that are freely verifiable. You can read the source code to check the implementation of sealed senders or how the social graph is handled.

NSA can hack into Signal's infrastructure, and what they will be able to gather are the same information provided by Signal in reply to subpoenas (the whole list here https://signal.org/bigbrother/), because everything else is end-to-end encrypted.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#346

Post by Dudhbbh3343 »

nottorp wrote: post #234
OSI-Auflauf wrote: post #150

Earlier quoted context omitted.

You need a phone number to sign up for Telegram as well. And you can correlate username to phone number not that hard in most standard setting cases.

Yeah, basically both super duper encrypted privacy oriented services want your phone number. Sorry, but that's not privacy. I don't care what they do to encrypt your messages, they are still tied to me, which makes the super duper encryption pointless.

SimpleX is the best E2E chat app that doesn't require phone numbers (or even any account signup) that I've tried.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#347

Post by ale42 »

riffraff wrote: post #203
ale42 wrote: post #107

Earlier quoted context omitted.

All true. But where are the sources of Telegram server? They are not open source, simply! What are they actually doing with our messages? Only they know. And they can read them because by default there's no E2E encryption.

would it matter if the server was open source? You'd know have no proof what is what they run on the actual server anyway, nor can you use a custom server.

It can matter if you can trust them to do the proper thing, i.e. if you assume they are not a malicious entity. In this case, checking the server source code can give experts insights about possible security risks.

If you assume they are malicious, (a) I wouldn't use their product in the first point, and (b) of course they can do whatever they want independently from the published code.

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#348

Post by [deleted] »

TacticalCoder wrote: post #66

I don't know about Telegram being nasty towards Signal but Signal brought this upon themselves. Metadata are more important than the content of the messages and yet Signal has always been about knowing your phone number, with handwaving when the subject is mentioned. Sessions, a Signal fork, had its tagline right: "Share encrypted messages, not metadata" . Signal is a metadata exchanging app and it's about collecting…

[deleted]

Re: Telegram has launched a pretty intense campaign to malign Signal as insecure

#349

Post by GuB-42 »

treprinum wrote: post #100
imjonse wrote: post #90

Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.

Why is home-rolled crypto inherently insecure?

To add to the idea that crypto is hard, it is not just hard in the same way that, say, making a physics engine is hard. It is hard because there is no telltale sign you did it wrong.

All crypto algorithms, even weak ones output what looks like random numbers that can be deciphered back into the original plaintext. Just by looking at it, there is no way to differentiate between secure and insecure crypto. Contrast to a physics engine, it is hard to get right, but at least, if you did it wrong, it tends to be obvious.

Also, like everything security-related, it is adverserial. You may have some of the smartest and most resourceful guys on the planet working to break your thing. It is worse than even critical systems. Aircraft engine control is critical, people may die if it goes wrong, so robustness and correctness are crucial, but at least, pilots won't go out of their way to break it.

Post reply on HN