81–90 of 127 posts
I'm very hopeful this reverse engineering effort will enable the creation of a tool to export my conversations (WhatsApp can do email export, which let's be real, doesn't cut it for most cases). A point to those that support migrating to alternatives such as Signal. Signal is good, but far from great for a single reason: you need a phone number. This is very bad in necsec and reliability terms, my case: Reliability:…
iMessage works with email addresses too.
Earlier quoted context omitted.
I would like to use Signal, but I am forced to use Telegram for the same reason. (I have also to say that Telegram mac client is pretty awesome). It makes no sense to create a "secure" chat app, and then to force your users to use cellphones, which is the most unsafe technology I can imagine... Why this cellphone fetish?
Cellphones are far more safe than your computer - especially iPhones. All apps are run in a sandboxed environment and are vetted before being released. Further, the secure enclave is far better at protecting secrets than anything on a typical laptop/desktop machine.
Also there are not good free software mobile operating systems, sure there is LineageOS and other ROMs that still require some proprietary parts, mainly the firmware of the device and binary blobs in the kernel, for one person concerned about privacy that is a problem, because proprietary software means backdoors, and it's useless to use a fantastic free software secure communication app if we can't trust the OS where we run it.
Earlier quoted context omitted.
they still have to support older clients. so it is not that easy to just change the protocol.
No, because it is a website.
Curious to know why they chose to require python in addition to node, wouldn't node with npmjs/yarn be sufficient and require less setup? Does python/pip provide any benefits here?
Hi, I'm sigalor, the original creator of the project. Actually, now I also regret using Python in addition to NodeJS. When I started all of this back in November, I originally chose Python, because it's, well, "quick and dirty". Especially trimming arrays and working with byte strings requires a lot more code in JS than it does in Python. I even wrote a reimplementation of the decryption routines in JavaScript, but i…
Earlier quoted context omitted.
Better? Yes. Easier? No. Besides, what's more open, as usable and secure?
Signal. It is at least as secure as Whats App by design, has pratically the same interface and also a Chrome-based desktop app that works untethered from the phone app.
Telegram in my opinion is far better, it's completely cloud based, you can use it from whatever device you want, it has real desktop apps, you can send files, you have bots, channels, large groups, usernames, you name it.
I don't get why using Signal, yes it's free software, also Telegram it is (ok, the server is proprietary but even if you have the source how can you be sure that what they release is what is running on the servers ? If you don't run your own server the source are useless), but I don't see other advantages, so why bother with a third messaging app ? I use WhatsApp for the large user base, and I use Telegram for the advanced features if I need them.
Earlier quoted context omitted.
Signal. It is at least as secure as Whats App by design, has pratically the same interface and also a Chrome-based desktop app that works untethered from the phone app.
Signal has most of the problems that has WhatsApp: mainly the fact that it's dependent on a smartphone, yes you have a Chrome-based application that is the same as WhatsApp web, it's only a remote interface that connects to your phone. Telegram in my opinion is far better, it's completely cloud based, you can use it from whatever device you want, it has real desktop apps, you can send files, you have bots, channels,…
Earlier quoted context omitted.
Someone has to roll new crypto, otherwise we're stuck. That said, I know about the potential issues with Telegram's encryption.
You don't roll a new crypto and use it the day after, it must be tested for vulnerabilities, reviewed by expert cryptoanalysts. It can take years, much like a car has to be crash tested, a new crypto algorithm must go through a certain process to be considered good enough.
Curious to know why they chose to require python in addition to node, wouldn't node with npmjs/yarn be sufficient and require less setup? Does python/pip provide any benefits here?
Earlier quoted context omitted.
You don't roll a new crypto and use it the day after, it must be tested for vulnerabilities, reviewed by expert cryptoanalysts. It can take years, much like a car has to be crash tested, a new crypto algorithm must go through a certain process to be considered good enough.
Any flaws in Telegrams crypto that lead to decryption?
Earlier quoted context omitted.
Out of curiosity: I’ve noticed a long-term sceptical attitude to telegram in HN audience and have seen multiple arguments against it. Something like that their crypto can’t be trusted, that it’s not time-proven. Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted? No intention to start any flame against Signal, only curiosity regarding telegram flaws. Person…
> Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted? People like tptacek have talked here at length about why Telegram is not trustworthy, you can see a history of his comments with a simple search: https://hn.algolia.com/?query=tptacek%20telegram&sort=byPopu... . Moxie Marlinspike has also pointed out a bunch of problems with Telegram, and even if you don…