3 ms·

This is precisely the kind of FUD I'm talking about. The spec is public, there's code in GitHub that you can compile and run a working client. Whether updates a

This is precisely the kind of FUD I'm talking about. The spec is public, there's code in GitHub that you can compile and run a working client. Whether updates are being dropped in a timely fashion or not does not change anything. It's sufficient to verify that the protocol is implemented faithfully.

cop_riq90 8y ago
This is not FUD. Telegram HAS NO ENCRYPTION. Telegram stores all messages on the server in plain-text mode. Even whatsapp doesn’t do that. Which means we must trust Telegram developers to not sell out our data to corrupt law enforcement agencies. The service is free. Which means they would need to get profitable. Which means they would parse the chats or are already doing it.
- saagarjha 8y ago
  > Telegram stores all messages on the server in plain-text mode. Sorry, do you have source for this claim?
  - cop_riq90 8y ago
    1. All historical messages are always downloaded when you sign in. It is possible to implement this feature without storing messages on the server, but Telegram intentionally decided to use servers. You can verify this by logging out of all your sessions and logging in again. All messages would be downloaded from the server. 2. If you ask if the actual messages on the server are in plain-text, it doesn’t matter. The keys for decryption are in memory. Which means anyone with backdoors or server access can get the messages.
  - LurkersWillLurk 8y ago
    This API endpoint will get you all past messages (except for those encrypted by Secret Chats): https://core.telegram.org/method/messages.getMessages https://core.telegram.org/method/messages.getMessages
saagarjha 8y ago
> The spec is public That’s good… > there's code in GitHub that you can compile and run a working client No, not really. The code pushed to GitHub doesn’t really compile and the author of the project is quite unhelpful in resolving these issues. > Whether updates are being dropped in a timely fashion or not does not change anything. It does: the project is licensed under the GPL, and in a sense “benefits” from having the name of the license associated with their product. But they are not compliant with software licenses, they’re basically source-available maybe possibly if you beg them enough, except also the sources they publish cannot be verified to and likely do not correspond to what they are currently shipping. For a project who’s entire goal should be increasing trust in their product’s security, keeping the development process opaque and violating open source licenses (in addition to their adoption of custom crypto, which I will ignore for this because I cannot comment on it) does not inspire trust at all. Plus it’s just plain annoying.

cop_riq90 8y ago

This is not FUD. Telegram HAS NO ENCRYPTION. Telegram stores all messages on the server in plain-text mode. Even whatsapp doesn’t do that. Which means we must trust Telegram developers to not sell out our data to corrupt law enforcement agencies. The service is free. Which means they would need to get profitable. Which means they would parse the chats or are already doing it.

saagarjha 8y ago
> Telegram stores all messages on the server in plain-text mode. Sorry, do you have source for this claim?
- cop_riq90 8y ago
  1. All historical messages are always downloaded when you sign in. It is possible to implement this feature without storing messages on the server, but Telegram intentionally decided to use servers. You can verify this by logging out of all your sessions and logging in again. All messages would be downloaded from the server. 2. If you ask if the actual messages on the server are in plain-text, it doesn’t matter. The keys for decryption are in memory. Which means anyone with backdoors or server access can get the messages.
- LurkersWillLurk 8y ago
  This API endpoint will get you all past messages (except for those encrypted by Secret Chats): https://core.telegram.org/method/messages.getMessages https://core.telegram.org/method/messages.getMessages

saagarjha 8y ago

> The spec is public That’s good… > there's code in GitHub that you can compile and run a working client No, not really. The code pushed to GitHub doesn’t really compile and the author of the project is quite unhelpful in resolving these issues. > Whether updates are being dropped in a timely fashion or not does not change anything. It does: the project is licensed under the GPL, and in a sense “benefits” from having the name of the license associated with their product. But they are not compliant with software licenses, they’re basically source-available maybe possibly if you beg them enough, except also the sources they publish cannot be verified to and likely do not correspond to what they are currently shipping. For a project who’s entire goal should be increasing trust in their product’s security, keeping the development process opaque and violating open source licenses (in addition to their adoption of custom crypto, which I will ignore for this because I cannot comment on it) does not inspire trust at all. Plus it’s just plain annoying.