5 ms·

I was just about to post something similar. I'm actually surprised to see a positive post of Telegram on HN. For the love of crypto, please stick to Signal prot

I was just about to post something similar. I'm actually surprised to see a positive post of Telegram on HN. For the love of crypto, please stick to Signal protocol-based messaging applications. https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol Edit: add link http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-contest http://www.cryptofails.com/post/70546720222/telegrams-crypta...

Freak_NL 10y ago
Are there any Signal-based messaging applications that work on the desktop without having to tether an Android or IOS smartphone to it, and without having to use a phone number as identifier?
- lucb1e 10y ago
  This. People say Telegram is bad even though it's no worse than any other popular product, or has a different set of advantages/disadvantages both security- and privacy-wise.
  - tptacek 10y ago
    From a security and privacy perspective, Telegram is substantially worse than its competitors, so this is a little rhetorical sleight of hand you've just pulled here. If you want to argue that Telegram and Signal are comparable because Telegram has better UX and Signal better security and some people prefer UX to security, that's fine (I could not disagree more strongly, but at least it's a coherent argument). But don't pretend the thread isn't about security to make people believe that there's controversy about whether Signal is more secure. There is no controversy: Signal won the Levchin prize this year for the Signal Protocol and sets the standard for secure chat, and Telegram... well, let's just suffice it to say that it does not meet that standard.
- jhasse 10y ago
  OMEMO [1] is based on Axolotl (aka Signal's protocol) and you can use it with Gajim on the desktop. Still very experimental though :( [1] https://conversations.im/omemo/ https://conversations.im/omemo/
- hn159753 10y ago
  Facebook Messenger.
  - jhasse 10y ago
    It's rather a web app than a desktop application, isn't it?
    - hn159753 10y ago
      It's not a desktop app, but the original requirement never stated that.
      - akjainaj 10y ago
        There's a desktop app for Windows. There's also a web app at https://messenger.com https://messenger.com. You can disable your Facebook account and still use Messenger
  - rand77763 10y ago
    Wait, are you saying messenger is secure and private? As if Facebook would want to give up a source of data for marketing?
    - tptacek 10y ago
      It's opt-in end-to-end encrypted with Signal Protocol now, so Facebook does in fact give up that data. Having said that, you should prefer protocols that aren't opt-in for security, which is what Signal buys you.
  - FabHK 10y ago
    Is Facebook Messenger Signal-based (i.e. end-to-end encrypted with a Signal/Axolotl double ratchet) as GP requested? I somehow doubt it. EDIT: Oh, I was mistaken, apparently there is an option now. From Wikipedia: On October 4, 2016, Facebook deployed end-to-end encryption as an optional feature for Facebook Messenger users. It is available in an optional mode called "Secret Conversations" and uses the Signal Protocol.
- detaro 10y ago
  Wire? (Haven't tried it personally, and I don't think there is an independent review of their implementation of the crypto)
- mrbiber 10y ago
  Riot.im uses the OLM encryption library (that is also used by XMPP OMEMO, see the OMEMO XEP). The OLM protocol is (I gather) very similar to the Signal protocol. Riot is based on Matrix which is a decentralized protocol (you're not tied to one company), and it doesn't need your phone number.
- FabHK 10y ago
  Wire. * open source, code on github * e2e encryption (apparently derivative of Signal's Axolotl double ratchet) * chat/voice/video, and group chats (all encrypted always) * based in Switzerland, coding out of Berlin * clients for iOS, Android, Mac, Windows, Linux, Web * can sign up with phone number or email (or username? Not sure - I think you can find contacts via username, not sure you can sign up without email) * reasonably responsive on twitter * yada yada yada
  - throwaway122916 10y ago
    I like it, but what about all the tracking? Things like this: https://github.com/wireapp/wire-desktop/issues/80 https://github.com/wireapp/wire-desktop/issues/80 Then there is the fact that the client acts as a browser that fetches information from the web automatically without blocking trackers itself. This is leaking metadata and actual data.
kijin 10y ago
For the love of crypto, I would like to see Signal and WhatsApp make proper desktop applications for all major platforms including Linux. Until they do so, Telegram will serve as an excellent competitor to remind them that good cryptography is not enough.
dbrgn 10y ago
The Signal desktop-app stores all messages unencrypted on the filesystem: https://github.com/WhisperSystems/Signal-Desktop/issues/1017 https://github.com/WhisperSystems/Signal-Desktop/issues/1017
- throwaway122916 10y ago
  Sure, but telegram doesn't even have a secret chat feature on desktop client. I can't believe there still isn't a single usable e2e mobile + desktop chat client that won't drain your cell phone battery super quickly.
newscracker 10y ago
> For the love of crypto, The problem is that most people value convenience and speed over security and privacy. Telegram provides a very good trade off, much better than some other apps. If Signal were to be developed at the pace Telegram is, I would use it all the time, but it's not. For my use and likes, both Telegram and Wire are very good fits.

Freak_NL 10y ago

Are there any Signal-based messaging applications that work on the desktop without having to tether an Android or IOS smartphone to it, and without having to use a phone number as identifier?

lucb1e 10y ago
This. People say Telegram is bad even though it's no worse than any other popular product, or has a different set of advantages/disadvantages both security- and privacy-wise.
- tptacek 10y ago
  From a security and privacy perspective, Telegram is substantially worse than its competitors, so this is a little rhetorical sleight of hand you've just pulled here. If you want to argue that Telegram and Signal are comparable because Telegram has better UX and Signal better security and some people prefer UX to security, that's fine (I could not disagree more strongly, but at least it's a coherent argument). But don't pretend the thread isn't about security to make people believe that there's controversy about whether Signal is more secure. There is no controversy: Signal won the Levchin prize this year for the Signal Protocol and sets the standard for secure chat, and Telegram... well, let's just suffice it to say that it does not meet that standard.
jhasse 10y ago
OMEMO [1] is based on Axolotl (aka Signal's protocol) and you can use it with Gajim on the desktop. Still very experimental though :( [1] https://conversations.im/omemo/ https://conversations.im/omemo/
hn159753 10y ago
Facebook Messenger.
- jhasse 10y ago
  It's rather a web app than a desktop application, isn't it?
  - hn159753 10y ago
    It's not a desktop app, but the original requirement never stated that.
    - akjainaj 10y ago
      There's a desktop app for Windows. There's also a web app at https://messenger.com https://messenger.com. You can disable your Facebook account and still use Messenger
- rand77763 10y ago
  Wait, are you saying messenger is secure and private? As if Facebook would want to give up a source of data for marketing?
  - tptacek 10y ago
    It's opt-in end-to-end encrypted with Signal Protocol now, so Facebook does in fact give up that data. Having said that, you should prefer protocols that aren't opt-in for security, which is what Signal buys you.
- FabHK 10y ago
  Is Facebook Messenger Signal-based (i.e. end-to-end encrypted with a Signal/Axolotl double ratchet) as GP requested? I somehow doubt it. EDIT: Oh, I was mistaken, apparently there is an option now. From Wikipedia: On October 4, 2016, Facebook deployed end-to-end encryption as an optional feature for Facebook Messenger users. It is available in an optional mode called "Secret Conversations" and uses the Signal Protocol.
detaro 10y ago
Wire? (Haven't tried it personally, and I don't think there is an independent review of their implementation of the crypto)
mrbiber 10y ago
Riot.im uses the OLM encryption library (that is also used by XMPP OMEMO, see the OMEMO XEP). The OLM protocol is (I gather) very similar to the Signal protocol. Riot is based on Matrix which is a decentralized protocol (you're not tied to one company), and it doesn't need your phone number.
FabHK 10y ago
Wire. * open source, code on github * e2e encryption (apparently derivative of Signal's Axolotl double ratchet) * chat/voice/video, and group chats (all encrypted always) * based in Switzerland, coding out of Berlin * clients for iOS, Android, Mac, Windows, Linux, Web * can sign up with phone number or email (or username? Not sure - I think you can find contacts via username, not sure you can sign up without email) * reasonably responsive on twitter * yada yada yada
- throwaway122916 10y ago
  I like it, but what about all the tracking? Things like this: https://github.com/wireapp/wire-desktop/issues/80 https://github.com/wireapp/wire-desktop/issues/80 Then there is the fact that the client acts as a browser that fetches information from the web automatically without blocking trackers itself. This is leaking metadata and actual data.

kijin 10y ago

For the love of crypto, I would like to see Signal and WhatsApp make proper desktop applications for all major platforms including Linux. Until they do so, Telegram will serve as an excellent competitor to remind them that good cryptography is not enough.

dbrgn 10y ago

The Signal desktop-app stores all messages unencrypted on the filesystem: https://github.com/WhisperSystems/Signal-Desktop/issues/1017 https://github.com/WhisperSystems/Signal-Desktop/issues/1017

throwaway122916 10y ago
Sure, but telegram doesn't even have a secret chat feature on desktop client. I can't believe there still isn't a single usable e2e mobile + desktop chat client that won't drain your cell phone battery super quickly.

newscracker 10y ago

> For the love of crypto, The problem is that most people value convenience and speed over security and privacy. Telegram provides a very good trade off, much better than some other apps. If Signal were to be developed at the pace Telegram is, I would use it all the time, but it's not. For my use and likes, both Telegram and Wire are very good fits.