3 ms·

They do encrypt group messages to their servers, just not E2E. > you're offering security advice I'm not offering security advice.

CiPHPerCoder 9y ago
> They do encrypt group messages to their servers, just not E2E. Transport-layer encryption that leaves messages totally readable to the service operator should not be classified as "they do encrypt". It muddies the water and will confuse users. For the sake of communicating risk effectively, only E2E should count when we talk about encryption. Lack of transport-layer security (TLS, Noise, etc.) simply demonstrates severe negligence and/or incompetence. > I'm not offering security advice. Above you said: > WhatsApp had a severe vulnerability for groups disclosed not so long ago. Telegram has had no such vulnerabilities as far as I'm aware. A casual observer might read this and think, "Wow, WhatsApp is vulnerable and Telegram isn't. I should use Telegram" despite being even more at risk by choosing Telegram. Whether it was your intention or not, it will have the same effect on HN readers as formal security advice from any other commenter.
- fwdpropaganda 9y ago
  > Transport-layer encryption that leaves messages totally readable to the service operator should not be classified as "they do encrypt". In that case, you should consider WhatsApp's group security issue as severe.
  - CiPHPerCoder 9y ago
    I don't know how many different ways I can explain why this conclusion is false, but I suspect none of them would sink in. Maybe the question to your "true or false?" comment to 'tptacek will elucidate adequately why the worst case of the WhatsApp vulnerability is still miles above what Telegram offers in terms of privacy, and even aside from Telegram, would be most generously a sev:medium (but by most measurements a sev:low).
tptacek 9y ago
By that definition, AOL Instant Messenger was encrypted too, just not E2E. It's fine not to keep up with this stuff and not to have solid answers for basic questions about it. I just think you should use a lot more question marks when you write about it.
- fwdpropaganda 9y ago
  Whatever definition. Telegram leaves messages exposed to the operator, and so did WhatsApp's group security flaw. True or not?
  - tptacek 9y ago
    Not remotely true; practically a non-sequitur.
  - CiPHPerCoder 9y ago
    > Whatever definition. Telegram leaves messages exposed to the operator, and so did WhatsApp's group security flaw. No, WhatsApp did not. Messages are not exposed to the operator. If you exploited this vulnerability, you could not read messages that had already been sent. Instead, what happens is, everyone is notified of a new arrival, and then can decide whether or not to keep communicating through that channel. That is NOT the same thing as "leave messages exposed to the operator" in any stretch of the imagination.

CiPHPerCoder 9y ago

> They do encrypt group messages to their servers, just not E2E. Transport-layer encryption that leaves messages totally readable to the service operator should not be classified as "they do encrypt". It muddies the water and will confuse users. For the sake of communicating risk effectively, only E2E should count when we talk about encryption. Lack of transport-layer security (TLS, Noise, etc.) simply demonstrates severe negligence and/or incompetence. > I'm not offering security advice. Above you said: > WhatsApp had a severe vulnerability for groups disclosed not so long ago. Telegram has had no such vulnerabilities as far as I'm aware. A casual observer might read this and think, "Wow, WhatsApp is vulnerable and Telegram isn't. I should use Telegram" despite being even more at risk by choosing Telegram. Whether it was your intention or not, it will have the same effect on HN readers as formal security advice from any other commenter.

fwdpropaganda 9y ago
> Transport-layer encryption that leaves messages totally readable to the service operator should not be classified as "they do encrypt". In that case, you should consider WhatsApp's group security issue as severe.
- CiPHPerCoder 9y ago
  I don't know how many different ways I can explain why this conclusion is false, but I suspect none of them would sink in. Maybe the question to your "true or false?" comment to 'tptacek will elucidate adequately why the worst case of the WhatsApp vulnerability is still miles above what Telegram offers in terms of privacy, and even aside from Telegram, would be most generously a sev:medium (but by most measurements a sev:low).

tptacek 9y ago

By that definition, AOL Instant Messenger was encrypted too, just not E2E. It's fine not to keep up with this stuff and not to have solid answers for basic questions about it. I just think you should use a lot more question marks when you write about it.

fwdpropaganda 9y ago
Whatever definition. Telegram leaves messages exposed to the operator, and so did WhatsApp's group security flaw. True or not?
- tptacek 9y ago
  Not remotely true; practically a non-sequitur.
- CiPHPerCoder 9y ago
  > Whatever definition. Telegram leaves messages exposed to the operator, and so did WhatsApp's group security flaw. No, WhatsApp did not. Messages are not exposed to the operator. If you exploited this vulnerability, you could not read messages that had already been sent. Instead, what happens is, everyone is notified of a new arrival, and then can decide whether or not to keep communicating through that channel. That is NOT the same thing as "leave messages exposed to the operator" in any stretch of the imagination.