Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Telegram really an encrypted messaging app?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

581–590 of 609 posts

Re: Is Telegram really an encrypted messaging app?

#581

Post by johnisgood »

ParetoOptimal wrote: post #534
raxxorraxor wrote: post #508

Earlier quoted context omitted.

You cannot be sure and yet Telegram often gets mentioned for being the only platform where states do not have easy access to user information or the ability to censor certain messages/content. So from a broad perspective, they probably behave better than comparable services. I think Telegram should not be trusted, but I also do not trust the alternatives, that readily share information with states. A special focus fo…

> Telegram often gets mentioned for being the only platform where states do not have easy access to user information or the ability to censor certain messages/content. By who? Simplex especially or even Signal are far better.

Or Ricochet / Ricochet Refresh: https://github.com/blueprint-freespeech/ricochet-refresh

Or Briar

Or maybe even Session?

Re: Is Telegram really an encrypted messaging app?

#582

Post by protonmail »

bandrami wrote: post #342

Same thing with proton mail. I have never understood the "Trust me bro we encrypt it" business model. If it's not your key on your client machine it's not encrypted.

Note that Proton Mail servers don't hold your private master key directly — it is always stored encrypted with your password. Also, Proton Mail allows you to import your keys: https://proton.me/support/pgp-key-management

Re: Is Telegram really an encrypted messaging app?

#583

Post by johnisgood »

ikt wrote: post #487
wkat4242 wrote: post #164

Earlier quoted context omitted.

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

> They probably should implement E2EE for everything He explained in his blog why he doesn't like E2EE: https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Why Isn’t Telegram End-to-End Encrypted by Default? Pavel Durov August 15, 2017

I do not think it is a remarkable feat to be more secure than WhatsApp.

Re: Is Telegram really an encrypted messaging app?

#584

Post by [deleted] »

tcfhgj wrote: post #579
medo-bear wrote: post #564

Earlier quoted context omitted.

How would you securely sync priv keys? How would you securely sync plaintext messages? Telegram supports e2ee but it is device centric for this reason

> How would you securely sync plaintext messages? Same as with private keys: Verified e2ee > Telegram supports e2ee but it is device centric for this reason At least this is what they told you

[deleted]

Re: Is Telegram really an encrypted messaging app?

#585

Post by medo-bear »

tcfhgj wrote: post #544
medo-bear wrote: post #517

Earlier quoted context omitted.

Can you use the desktop app without the phone present? For example, if the phone is turned off.

I have heard you can, for about 2 weeks. Then the phone must be at least become active.

With Telegram I do not have to worry about losing my "primary" device in order to access my account. Telegram is more a social network than a chat app. Moreover Telegram does not require me to feed it my whole Contact List in order to communicate. WhatsApp has this limitation on purpose (there actually are workarounds but they are "hacks" and not how Meta wants you to use the app). It is very suspicious: why can't I search for a WhatsApp contact by manually typing in a number into WhatsApp? Instead I need to put it inside my Contact App and grant WhatsApp full access to it. LOL

Re: Is Telegram really an encrypted messaging app?

#586

Post by gangorgasm »

medo-bear wrote: post #585
tcfhgj wrote: post #544

Earlier quoted context omitted.

I have heard you can, for about 2 weeks. Then the phone must be at least become active.

With Telegram I do not have to worry about losing my "primary" device in order to access my account. Telegram is more a social network than a chat app. Moreover Telegram does not require me to feed it my whole Contact List in order to communicate. WhatsApp has this limitation on purpose (there actually are workarounds but they are "hacks" and not how Meta wants you to use the app). It is very suspicious: why can't I…

There recently was a link making rounds here that purportedly allowed you to send WhatsApps to phone numbers not in your address book

Re: Is Telegram really an encrypted messaging app?

#587

Post by maqp »

guappa wrote: post #578
maqp wrote: post #573

Earlier quoted context omitted.

No. The way I see it, I'm downloading an open-source, *always* end-to-end encrypted desktop-application Signal from official repository, instead of downloading an open-source *never* end-to-end encrypted desktop-application Telegram from official repository. Having to add the ppa is 10 seconds of additional trouble. I'll live. Without end-to-end encryption, a lot of dissidents however, might not.

10 seconds of additional trouble, a lifetime of root access to a 3rd party :)

What? You have factual evidence Signal's apt repo is installing rootkits to people's computers? Let's see it.

Re: Is Telegram really an encrypted messaging app?

#588

Post by medo-bear »

tcfhgj wrote: post #579
medo-bear wrote: post #564

Earlier quoted context omitted.

How would you securely sync priv keys? How would you securely sync plaintext messages? Telegram supports e2ee but it is device centric for this reason

> How would you securely sync plaintext messages? Same as with private keys: Verified e2ee > Telegram supports e2ee but it is device centric for this reason At least this is what they told you

> Same as with private keys: Verified e2ee

Yikes

Re: Is Telegram really an encrypted messaging app?

#589

Post by maximinus_thrax »

wkat4242 wrote: post #164
bryanlarsen wrote: post #34

Try the mud puddle test: log into your account on a new device using the password recovery flow. Can you see your old messages? If the answer is yes then law enforcement can too. https://www.forbes.com/sites/anthonykosner/2012/08/05/how-se...

> If the answer is yes then law enforcement can too. Is it technically possible for them to see it: yes Does Telegram let them see it: I don't think so. That seems to be the core issue around Durov being arrested. They probably should implement E2EE for everything. Then they will have a good excuse not to cooperate, because they simply don't have the data.

> Does Telegram let them see it: I don't think so.

I do think so: https://archive.is/M5zw4

Also, 'exile' https://istories.media/en/news/2024/08/27/pavel-durov-has-vi...

Re: Is Telegram really an encrypted messaging app?

#590

Post by waynecochran »

maqp wrote: post #566
waynecochran wrote: post #556

Earlier quoted context omitted.

But then it is obvious you are using encryption. A lot can be learned just from the timing of the message and noting it is encrypted. I always thought it best to send an encrypted message every hour of every day .. most messages would be just nonsense. The one eavesdropping could not only not read the message, but they would gain no knowledge about when the "real" messages are being sent.

Yeah that hourly packet rate is called traffic masking or traffic flow confidentiality. It's offered in some instances of IPSec, but given that it's not exactly a common protocol in end-user products you don't really see it. I did implement it for my messaging system however https://github.com/maqp/tfc/wiki/Commands#14-traffic-masking

Cool -- now I have a name for it. This seems critical to keep things truly secret.
Post reply on HN