4 ms·

Have you actually seen the implementation of the WhatsApp clients on iOS / Android? How can you say that the data is E2EE when there are no sources, no verifiab

Have you actually seen the implementation of the WhatsApp clients on iOS / Android? How can you say that the data is E2EE when there are no sources, no verifiable builds, nothing but just statements that "yes, we do use E2EE"? On the contrary, you have open protocol with verifiable implementation and available sources of the Telegram client for mobile platforms; yet you automatically disregard it just because it is not developed by Moxie or whatever. I am still baffled how people completely turn off their critical thinking when it comes to encryption; I guess this is a fine example how marketing actually works well.

Fnoord 8y ago
Yes, WhatsApp is proprietary software and you did describe some issues. However, the context of the discussion is finding a WhatsApp alternative and rolling it out; Telegram is not a viable alternative. The point never was we should stick to WhatsApp. If the standards Telegram opted not to use are broken we can all be easily hacked. So avoiding those standards just for the sake of using your own, is snake oil. Thinking you know better than the consensus of the whole security community is, in this case, unnecessarily arrogant and harmful. [EDIT]I'll edit my post since I can't reply: WhatsApp has E2EE, but you cannot verify the source. Telegram uses home brew crypto. Stop distracting the reader from that, you scum. As for the issues with Telegram it isn't "one" security researcher. I found 2 in 30 seconds: Matthew Green and Micah Lee [1] [2] [1] https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a https://medium.com/@thegrugq/operational-telegram-cbbaadb901... [2] https://www.schneier.com/blog/archives/2016/06/comparing_messa.html https://www.schneier.com/blog/archives/2016/06/comparing_mes... [/EDIT]
- arkadiytehgraet 8y ago
  The only context in the post I replied was about WhatsApp being E2EE, which is factually wrong and incorrect, and we should not propogate this misbelief any further than it already is. I mean, this is literally the quote from the post: >The advantage WhatsApp has over MSN is that the data is E2EE. Where in my post have I mentioned that Telegram uses their own crypto just for the sake of using their own? I'll save you some time: I did not mention it at all. Why did you then even bother to say anything about "snake oil" and "considered harmful"? Moreover, if security community (for some reason always represented by 1 person) says that unverifiable, closed-source solution is secure just because they said so, then I'll be better off without trusting them, and the actual common sense tells me to stay away as far as I can from anything they do.
Canada 8y ago
Yes, and Telegram being open allows us to confirm with absolute certainty that it uses no E2EE by default. We don't have the WhatsApp source code, but we don't have to do a lot of reverse engineering to see that it uses this: https://github.com/signalapp/libsignal-protocol-c https://github.com/signalapp/libsignal-protocol-c But yeah, you're right, it could be sending plaintext or deliberately leaking keys somewhere. Unless someone really reverses it we won't know it doesn't as surely as we know that Telegram doesn't use encryption at all.
- reitanqild 8y ago
  > Unless someone really reverses it we won't know it doesn't as surely as we know that Telegram doesn't use encryption at all. Telegram uses encryption by default, just not E2EE. You can criticise them for - using their own crypto - misleading advertising regarding the quality of said crypto ... and possibly more, but I still suggest we try to stick to the facts.
  - Canada 8y ago
    In the context of a messaging system anything other than E2EE is pretty worthless as far as I'm concerned. If just using encryption is good enough for you, then why not use Facebook Messanger, Google Hangouts or whatever they call it these days, or WeChat? You can verify their use of encryption with Wireshark. You argue that Telegram is great because it's open source, but what difference does that really make when it's a centralized service and that centralized service has access to all the plaintext? So what if the client is open source? What does that actually help us verify in this case?
    - reitanqild 8y ago
      > In the context of a messaging system anything other than E2EE is pretty worthless as far as I'm concerned. To each their own. I've made a choice that I'd rather take the risk of leaking data to Telegram (real but I've reason to belive kow risk) than leaking metadata to Facebook (a given). I'm considering Signal though. But don't lie and say not not encrypted when you mean not end-to-end-encrypted.

Fnoord 8y ago

Yes, WhatsApp is proprietary software and you did describe some issues. However, the context of the discussion is finding a WhatsApp alternative and rolling it out; Telegram is not a viable alternative. The point never was we should stick to WhatsApp. If the standards Telegram opted not to use are broken we can all be easily hacked. So avoiding those standards just for the sake of using your own, is snake oil. Thinking you know better than the consensus of the whole security community is, in this case, unnecessarily arrogant and harmful. [EDIT]I'll edit my post since I can't reply: WhatsApp has E2EE, but you cannot verify the source. Telegram uses home brew crypto. Stop distracting the reader from that, you scum. As for the issues with Telegram it isn't "one" security researcher. I found 2 in 30 seconds: Matthew Green and Micah Lee [1] [2] [1] https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a https://medium.com/@thegrugq/operational-telegram-cbbaadb901... [2] https://www.schneier.com/blog/archives/2016/06/comparing_messa.html https://www.schneier.com/blog/archives/2016/06/comparing_mes... [/EDIT]

arkadiytehgraet 8y ago
The only context in the post I replied was about WhatsApp being E2EE, which is factually wrong and incorrect, and we should not propogate this misbelief any further than it already is. I mean, this is literally the quote from the post: >The advantage WhatsApp has over MSN is that the data is E2EE. Where in my post have I mentioned that Telegram uses their own crypto just for the sake of using their own? I'll save you some time: I did not mention it at all. Why did you then even bother to say anything about "snake oil" and "considered harmful"? Moreover, if security community (for some reason always represented by 1 person) says that unverifiable, closed-source solution is secure just because they said so, then I'll be better off without trusting them, and the actual common sense tells me to stay away as far as I can from anything they do.

Canada 8y ago

Yes, and Telegram being open allows us to confirm with absolute certainty that it uses no E2EE by default. We don't have the WhatsApp source code, but we don't have to do a lot of reverse engineering to see that it uses this: https://github.com/signalapp/libsignal-protocol-c https://github.com/signalapp/libsignal-protocol-c But yeah, you're right, it could be sending plaintext or deliberately leaking keys somewhere. Unless someone really reverses it we won't know it doesn't as surely as we know that Telegram doesn't use encryption at all.

reitanqild 8y ago
> Unless someone really reverses it we won't know it doesn't as surely as we know that Telegram doesn't use encryption at all. Telegram uses encryption by default, just not E2EE. You can criticise them for - using their own crypto - misleading advertising regarding the quality of said crypto ... and possibly more, but I still suggest we try to stick to the facts.
- Canada 8y ago
  In the context of a messaging system anything other than E2EE is pretty worthless as far as I'm concerned. If just using encryption is good enough for you, then why not use Facebook Messanger, Google Hangouts or whatever they call it these days, or WeChat? You can verify their use of encryption with Wireshark. You argue that Telegram is great because it's open source, but what difference does that really make when it's a centralized service and that centralized service has access to all the plaintext? So what if the client is open source? What does that actually help us verify in this case?
  - reitanqild 8y ago
    > In the context of a messaging system anything other than E2EE is pretty worthless as far as I'm concerned. To each their own. I've made a choice that I'd rather take the risk of leaking data to Telegram (real but I've reason to belive kow risk) than leaking metadata to Facebook (a given). I'm considering Signal though. But don't lie and say not not encrypted when you mean not end-to-end-encrypted.