Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Isn’t Telegram End-to-End Encrypted by Default (2017)

telegra.ph

Post reply on HN
Print view View original

51–60 of 151 posts

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#51

Post by snvzz »

skrowl wrote: post #29
snvzz wrote: post #8

The why doesn't matter. (the tl;dr is that they apparently never bothered to support some popular features within the context of e2ee, and believe people ultimately don't care about e2ee by default) What matters is that: - It doesn't do e2ee by default. - It is not a properly documented protocol[0]. - It is not an open protocol. - It has a history of extremely poor cryptography practices[1][2]. - It is not open sourc…

> - It doesn't do e2ee by default. When creating a 1 to 1 chat, it's one of the default buttons. In Android, you click a {pencil} icon, then "new chat" (encrypted in transit and at rest like your bank website) or "new secret chat" (end to end encrypted) > - It is not an open protocol. The protocol is fully open source and audited. https://telegram.org/apps scroll down to source code. > - It is not open source. As abo…

>When creating a 1 to 1 chat, it's one of the default buttons. (...)

That's a really long way to say e2ee requires special steps: Deliberately selecting "new secret chat".

If there's ANY barriers to e2ee such as this one, then non-e2ee ends up being used.

That's just how it is, how non-technical people are, and why we should steer everybody away from Telegram.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#52

Post by pampa »

pmlnr wrote: post #10

E2E chat is an interesting topic. Say I'm using XMPP, my own server, talking to a federated one, all over TLS, including S2S. E2E on top of that, in my personal opinion, is a massive overkill for most cases and people. Related read: https://homebrewserver.club/have-you-considered-the-alternat... It is, however, different, when it comes to a server that I don't control in any form. In that scenario, it is rather usefu…

> Thoughts?

Pick your adversaries and scale your opsec accordingly. Unless you are a person of interest in national security matters, just the fact that you communicated with somebody does not incriminate you.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#54

Post by pmlnr »

upofadown wrote: post #38
pmlnr wrote: post #20

Earlier quoted context omitted.

I've been exploring options with a friend, their requirements: 1) option for large groups (around 250) This drops Signal out which has a limit of 150 on groups: https://support.signal.org/hc/en-us/articles/360007319331-Gr... 2) e2e encrypted (because it sounds good, not because people actually understand what it is), including groups. This drops Telegram out: no e2e rooms. 3) handles sending photos, videos, and voice…

>handles sending photos, videos, and voice messages More or less kills XMPP, unless people are on the latest-and-greatest version of Conversations and maybe ChatSecure. Are there any popular XMPP clients that don't support "HTTP File Upload" at this point? I went looking for a list of those that do and had to give up. They all support it now.

Well... that's complicated.

On it's own, XEP-0363 (HTTP File Upload) and OMEMO both work well everywhere, even in my horribly overpatched Pidgin.

But if you put the two together, Conversations, for example, will encrypt the message and encrypt the upload as well.

My Pidgin then will handle the message well, but display an url starting with aesgcm:// leading to the still encrypted file.

The question is then: is the correct behaviour what of Conversations is doing - encrypt the message and upload as well? If yes, is OMEMO a requirement to HTTP File Upload or the other way around?

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#55

Post by srhngpr »

Ashoat wrote: post #35
srhngpr wrote: post #16

Genuine question, and I'm certainly no expert in this - just a curious end-user, aren't the backups that WhatsApp creates and uploads to iCloud/GDrive kind of encrypted? As in, I can't simply download the backup file and access the messages and media? My understanding is that in order to restore/access said messages and media, you would need the SIM/phone number that created the backup file and would have to register…

My understanding is that WhatsApp backups are plaintext. It's true that Apple/Google can't recover your WhatsApp account with just the plaintext, but I believe they can read the messages.

Thanks for replying! This is concerning if true. Is this documented or proven anywhere? I had heard something similar, but can't seem to find any reliable source that confirms the messages are in plaintext.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#56

Post by Tepix »

Even with e2e encrypted chats, the servers could store the encrypted conversations if the devices do not have enough storage to have all them stored locally.

Device Backups: it's an important point that users need to be educated about. But it's also a distraction just like talking about the privacy of keyboard apps or unwanted link previews while composing/reading messages.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#57

Post by kitkat_new »

pmlnr wrote: post #10

E2E chat is an interesting topic. Say I'm using XMPP, my own server, talking to a federated one, all over TLS, including S2S. E2E on top of that, in my personal opinion, is a massive overkill for most cases and people. Related read: https://homebrewserver.club/have-you-considered-the-alternat... It is, however, different, when it comes to a server that I don't control in any form. In that scenario, it is rather usefu…

Honestly you have no idea about real use cases. Almost no one is going to set up a dedicated local server for all of his conversations, hosting only conversations in which you are part of anyways.

Most people aren't even able to do this.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#59

Post by t-writescode »

scubbo wrote: post #26
pampa wrote: post #9

Earlier quoted context omitted.

And he is right. If you want e2e use signal, threema, or OTR/OMEMO. The majority of telegram users want convenient messaging, group chats, news channels and voice group calls. Think slack with a fast native app.

> news channels I love getting glimpses of how other people use certain apps. I can't imagine _wanting_ news in my messaging app - that's what my news app is for! Very valuable reminder that our own perspective is not always widespread.

I mostly see the news feed tool used for art.

Re: Why Isn’t Telegram End-to-End Encrypted by Default (2017)

#60

Post by srhngpr »

tomp wrote: post #49
srhngpr wrote: post #16

Genuine question, and I'm certainly no expert in this - just a curious end-user, aren't the backups that WhatsApp creates and uploads to iCloud/GDrive kind of encrypted? As in, I can't simply download the backup file and access the messages and media? My understanding is that in order to restore/access said messages and media, you would need the SIM/phone number that created the backup file and would have to register…

If WhatsApp has the decryption key, it's not end-to-end encrypted. If Apple has your decryption key, then iCloud uploads aren't encrypted (and Apple seems to have the decryption key, as they offer "reset password" functionality).

The backups aren't E2E encrypted, WhatsApp even tells you this in the backup settings page in the app. But if they hold the decryption key and the only way to get it is via registering with a WhatsApp server via SMS verification, then doesn't that imply that Apple and Google don't have the key and can't read or restore the messages?
Post reply on HN