4 ms·

> people use WhatsApp and Telegram (and even dare to speak about them in terms of "privacy", which is mind boggling) I don't know about WhatsApp, but from what

> people use WhatsApp and Telegram (and even dare to speak about them in terms of "privacy", which is mind boggling) I don't know about WhatsApp, but from what I recall about Telegram, its main criticism is the fact that it isn't using secret chats (i.e. private conversations) by default. However when using secret chats, the communication is end-to-end encrypted. Is there anything else wrong with it?

215163831328308 9y ago
The main criticism of Telegram is that it created it's own cryptography. It does not use a well established cryptographic scheme. Instead the creators of Telegram created their own scheme, and that has not been checked as thoroughly. The mostly strict rule in these things is, don't roll your own crypto. This is reiterated in [1] and an attack on telegram [2] [1]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr... [2]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr...
pigeons 9y ago
not only not default, secret chats are not even available on linux.
- jhasse 9y ago
  They are (e.g. https://github.com/Aseman-Land/Cutegram https://github.com/Aseman-Land/Cutegram), but not with the official Desktop client.
krick 9y ago
First off, I consider no e2e enryption by default a big deal, given even WhatsApp does that. In Telegram it's so inconvenient — "they" obviously don't want you to use it. So yeah. But for me all these apps are broken on more fundamental level. First, as somebody else already noted that I'm "confusing security and privacy" let me introduce my custom definition (or rather a trait) of "security" for the sake of this argument: no 3rd party can access any data of mine without explicit permission, unless it's absolutely necessary for the app to work. So any messenger that must use a phone number for a log in without giving me any choice is shit, regardless of whether its crypto is broken or not. Any messenger that can non-locally access all of my contacts without asking me which contacts I agree to share — is shit. Any messenger that won't work without Google Services or cannot be installed without Google Play account — is shit. And so on. That said, Matrix/Riot probably is the only messenger out there that has any chance of becoming not-shitty messenger. But nobody uses it.

215163831328308 9y ago

The main criticism of Telegram is that it created it's own cryptography. It does not use a well established cryptographic scheme. Instead the creators of Telegram created their own scheme, and that has not been checked as thoroughly. The mostly strict rule in these things is, don't roll your own crypto. This is reiterated in [1] and an attack on telegram [2] [1]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr... [2]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr...

pigeons 9y ago

not only not default, secret chats are not even available on linux.

jhasse 9y ago
They are (e.g. https://github.com/Aseman-Land/Cutegram https://github.com/Aseman-Land/Cutegram), but not with the official Desktop client.

krick 9y ago

First off, I consider no e2e enryption by default a big deal, given even WhatsApp does that. In Telegram it's so inconvenient — "they" obviously don't want you to use it. So yeah. But for me all these apps are broken on more fundamental level. First, as somebody else already noted that I'm "confusing security and privacy" let me introduce my custom definition (or rather a trait) of "security" for the sake of this argument: no 3rd party can access any data of mine without explicit permission, unless it's absolutely necessary for the app to work. So any messenger that must use a phone number for a log in without giving me any choice is shit, regardless of whether its crypto is broken or not. Any messenger that can non-locally access all of my contacts without asking me which contacts I agree to share — is shit. Any messenger that won't work without Google Services or cannot be installed without Google Play account — is shit. And so on. That said, Matrix/Riot probably is the only messenger out there that has any chance of becoming not-shitty messenger. But nobody uses it.