9 ms·
Telegram moves to protect identity of Hong Kong protesters
- roenxi 7y agoIf Telegram were protecting the identity of HK protestors they would say this. If they were selling the HK protestors out to the Chinese government they would also say this. True trustworthyness can only come from open source code and concepts designed into the protocol. I don't think this can be achieved on Apple's platform, might be possible on Android.
- lonelappde 7y agoNo, it's impossible to know what code is running on someone else's server. If you give your phone number to someone, you are at their mercy to keep it confidential.
- est31 7y agoWhat about https://tox.chat/ https://tox.chat/
- jsmeaton 7y agoThe article is discussing specific features that Telegram is adding to make it harder to do matching on numbers to identify aliases. This is not a general proclamation.
- abstract7 7y agoI think it's hard to make an argument that China has a lot of leverage on Telegram as an organization, but that could change in years to come. A decade ago, no one really thought Google would become this hostile to users and even seek to collaborate with the CPC govt and its totalitarian vision. Everything you said about open-source applies to Android too. At the very least all kinds of backdoors are in Android phone because of chip firmware. But I guess you might be alluding to the fact that Tim Cook handed over Apple iCloud keys to the Chinese govt.
- snitko 7y agoKnowing the founder, find it hard to believe. The guy who fled Russia to avoid persecution has little tolerance for any government trying to mess with people's privacy. Culturally, Russia itself has a lot more in common with the west. China is completely separated, from, I would say, the rest of the world, in terms of mentality. It's even different from most Asian countries and Hong Kong. Find it hard to imagine why would anyone cooperate with China on doing things the western world considers immoral and unacceptable.
- bishalb 7y agoI am not sure how open sourcing the code would help? If they have a bad intent, they could publish a "clean" source code and deploy something else.
- IIAOPSW 7y agoYou can compile the open source and compare the result to the version on the store.
- throwaway1997 7y agoThe protestors aren't using the encryption features. They just don't want their phone numbers to be revealed as being associated with the groups used to coordinate the demonstrations.
- langitbiru 7y agoTrue for the client side but you can not be sure on the server side. Smart contract enables the true transparent and honest program but the technology is not ready yet. It is still early days.
- paulcarroty 7y ago> might be possible on Android. Especially on Google platform with every click tracking.
- myself248 7y ago> Protesters believe Chinese security officials have exploited the function by uploading large quantities of phone numbers. > The app automatically matches phone numbers with the user names in the group. Chinese authorities then only need to request the owners of the phone numbers from the local telecom service in order to learn the users’ true identities. > Telegram has detected evidence that Chinese authorities may have uploaded numbers to identify protesters, said a person with direct knowledge of the situation. Signal does/did this too: https://news.ycombinator.com/item?id=12590979 https://news.ycombinator.com/item?id=12590979
- segmondy 7y agoNot the same thing. The flaw in Telegram happens with the group feature.
- jobigoud 7y agoAre you sure? I wanted to install Telegram and it insisted on having the contacts permission from the get go. I think it's sending contacts to their database so they can match friends. Isn't there a secure messaging app that doesn't require a phone number and doesn't ask me to upload my contacts?
- tripzilch 7y agoMatrix doesn't ask for anything. But I wouldn't use it for super critical things, cause the user interface (of the Riot client) is confusing enough that I'm afraid I'll make mistakes in verifying devices or fingerprints or something. Weird things happened when I tried it myself (I got more device IDs than devices, and I'm not sure where the other ones came from ... )
- Mediterraneo10 7y ago> The app automatically matches phone numbers with the user names in the group. Chinese authorities then only need to request the owners of the phone numbers from the local telecom service in order to learn the users’ true identities. This is a flaw common to services that rely on phone numbers as IDs. In many countries, one cannot purchase a SIM card without showing ID (and the seller makes a photocopy of the ID to provide to the authorities). That means that there cannot be true anonymity. Know the phone number, know the person. I am always baffled when people claim that PGP-encrypted e-mail is passé because it leaks metadata, when Signal and Telegram leak metadata too and, furthermore, metadata that can be immediately associated with a specific person in many countries.
- saagarjha 7y ago> But wide adoption of the optional security setting would make the app far harder to use for the vast majority of its more than 200 consumers, who rely on uploading phone contacts to identify friends and family members on the app, the source said. This is false: regardless of Telegram’s nags to upload my phone book to them, I find it quite easy to use the app without doing this.
- jen_h 7y agoYou are correct. I will never understand why apps that profess allegiance to privacy upload entire contact lists. Sure, users will complain it’s harder. They’ll always complain, but you’re protecting them and their contacts who have NOT provided consent.
- jobigoud 7y agoI just tried installing it again and it's asking for contacts permission on every operation.
- 29_29 7y agoWhy not use Hacker News to Organize a protest?
- temptemptemp111 7y agoHN is so obviously controlled by globalist interests.
- foobiekr 7y agoThe only actual way to protect them is to purge any potentially compromising data immediately.
- lysp 7y ago> The fix Telegram is working on would allow users to disable matching by phone number. That option represents a balance between making it easy for users to find their contacts and the privacy needs of those who rely on the app for protection against state security agents. > Telegram hopes to help protect Hong Kong protesters with the update, the source said. But wide adoption of the optional security setting would make the app far harder to use for the vast majority of its more than 200 consumers, who rely on uploading phone contacts to identify friends and family members on the app, the source said. Make the match 2 way then. If you both have reach other's number allow the match. If it's one sided - deny.
- Thorrez 7y ago200 consumers, ouch
- dosy 7y agoSo Telegram will break China's laws. Can't these tech companies be charged for aiding law breakers?
- solarkraft 7y agoThis should have been a feature from the beginning. Not everyone wants their Telegram profile to be discoverable by anyone who has their number.
- codedokode 7y agoThey should only notify users if they both have each other's phone. Otherwise it is trivial to create several thousands of accounts and upload thousands of numbers from each to get a mapping between an id and a phone number. Here is a quote from a head of Russian company that claims to do this: > A phone number used by [Telegram] account @silovikicat was discovered using a program titled "Insider-Telegram" developed by the "Center of research of legitimacy and political protest". The head of the "Center" Eugene Venediktov explains: "Currently the database contains over 10 million of numbers. We just go through all possible numbers and check whether they are registered in Telegram: for example, we take all numbers starting with a prefix +7911 and check them. You automatically see all contacts from you address book in your Telegram, don't you? We just have a very "fat" address book with phones of all users from our country." > When a phone number provided by Eugene is added into an address book, Telegram automatically matches it with account @silovikicat («Siloviks' cat»). Having a phone number means that the government can track its rough location and know owner's identity. This also means that other messengers using similar contact discovery allow to de-anonymize its users the same way. [1] (in Russian) https://meduza.io/feature/2019/08/10/kto-takoy-tovarisch-mayor https://meduza.io/feature/2019/08/10/kto-takoy-tovarisch-may...
- heyoni 7y agoThis feature should never have been enabled in this one-way manner but being a social platform means trying everything to get users tied down to it. It’s just like Venmo. I’m seeing users in my newsfeed because they’re in my contacts but not because we added each other. Really bizarre.
- codedokode 7y agoEven better, Telegram should allow to register without a phone numbner (they could charge a little sum in Bitcoins if they are afraid that there will be bot registrations). This could even increase their user base because there are users who don't want to give away a phone number.
- eitland 7y ago
- xivzgrev 7y ago“But wide adoption of the optional security setting would make the app far harder to use for the vast majority of its more than 200 consumers, who rely on uploading phone contacts to identify friends and family members on the app, the source said.” With only 200 users on the app me thinks adoption will be fast - think they forgot a “K”
- mappu 7y ago> think they forgot a “K” an "M" - 200 million users as of March 2018. https://telegram.org/blog/200-million https://telegram.org/blog/200-million
- logicallee 7y agoThat's pretty funny :)
- baby 7y agoThat’s when you realize that every insignificant feature Signal was working on is actually freaking useful in real life. Btw why all these apps require a phone #? Is it required by the gov?
- input_sh 7y agoCan we stop referring to Telegram as an "encrypted app"? End-to-end encryption only works in "secret chats" and voice calls. Outside of those, it's as encrypted as HN is (connection happens over TLS, but that's about it).
- batat 7y agoAlso there are no secret chats on desktop client at all.
- Proven 7y agoA freeware protecting privacy of the people from the government they pay to protect their privacy (among other things).
- ryanlol 7y agoJust a reminder that Telegram has shipped deliberate backdoors in the past https://habr.com/post/206900/ https://habr.com/post/206900/ It is terribly unlikely that they’d have their users best interest in mind.
- jen_h 7y agoThere’s also that tidbit from the Steele Dossier about it being cracked.
- kome 7y agothe obsession with phone numbers is crazy, we should stop to use them as ID
- thekyle 7y agoA big pro of using phone #s is that it allows users to effectively take their social network with them from app to app instead of being locked in. IMO phone numbers are a pretty terrible system (you would never ask people to remember dozens of IP addresses for all the websites they want to visit but historically people have been expected to remember phone #s for all the people they want to contact), but they are the system we have and it could be worse.
- code_infinity28 7y agoso what is new in that
- code_infinity28 7y agohahahaha
- wtdata 7y agoThese are good news. But, why don't they use Signal to start with?
- n_ary 7y agoSignal also needs a phone# to activate & iirc, if you have someone's phone number in Contact List, they'll appear, so sort of same issue may be. Only one I know of so far not needing a phone# is Wire.
- newscracker 7y agoThis was covered in other news pieces. In Signal, your number gets exposed to everyone else in the group (similar to WhatsApp). The protestors didn’t want their numbers to be exposed to other people they were talking to. Telegram doesn’t, by default, show your number to others you chat with unless you choose to. Telegram also allows usernames to be used to contact and refer to people. The other factor is that Telegram allows really large groups (like 200K members), which Signal and WhatsApp don’t.
- nick_dmnd 7y agotelegram rolls their own encryption. Anyone who does this should label their software as experimental, and not to be trusted with sensitive information - and they should absolutely not compare it to actual serious secure messaging apps. I gave up on Telegram long ago. As for me, Utopia messenger is much better. It is guaranteed to keep my chats securely locked. Check it out yourself https://beta.u.is https://beta.u.is