4 ms·

> Well, to be fair, there is also this other minor bug about encryption being off by default and only available on a few clients and not synchronizing between d

> Well, to be fair, there is also this other minor bug about encryption being off by default and only available on a few clients and not synchronizing between different encryption-supporting clients... Here we go again. Encryption is not off by default. It is just not E2E encrypted, i.e. it works just like any bank, Gmail etc etc etc. (except, based on what I've heard Telegram, unlike any mainstream bank, put the extra effort in to keep encryption keys not only on separate servers but in a different jurisdiction than your messages.) Edit: Now if we could stop spreading misinformation we could discuss one thing that might be the real flaw in Telegrams model and which I would consider trying to move to a different messenger over - if they fixed it while delivering the same experience: The one huge issue I have with Telegram is the funding model. Whatsapp more or less nailed this early on: - low, reasonable price that still made them plenty profit - possibility to pay for others (kids, friends etc) Give me the same offer as Whatsapp once gave me: I pay them, they deliver my messages, provide quality clients on all platforms, doesn't snoop, doesn't spam etc, and I'll download the beta today. Provide a legally binding agreement that makes their company worthless and publishes the code under Apache or another liberal[0] license somehow if they sell out or becomes sleazy and I'll be walking around pondering how to help them. [0]: yep, I want it to be as simple as possible to make a good chunk of cash from transporting my messages securely and elegantly from my device to other peoples devices as well as the other way.

ryanlol 7y ago
Telegram has shipped deliberate backdoors in the past, they can’t possibly be trusted https://m.habr.com/en/post/206900/ https://m.habr.com/en/post/206900/
- eitland 7y ago
  I can't read Russian well enough to understand that ;-) What I know however is that I can't recall anyone except you[0] claiming that, not even tptacek. [0]: Thought I remembered your nick and had to look up: https://duckduckgo.com/?q=Ryanlol+Telegram+site%3Anews.ycombinator.com&t=fpas&ia=web https://duckduckgo.com/?q=Ryanlol+Telegram+site%3Anews.ycomb...
  - ryanlol 7y ago
    https://twitter.com/FiloSottile/status/987376021589692416 https://twitter.com/FiloSottile/status/987376021589692416 Here you can see a couple of people with better CVs than mine discussing this. But I agree, it’s incredible that I’m probably the only person in the world constantly bringing this up re:telegram
    - lucb1e 7y ago
      That is weird indeed, I never heard of this (and I'm relatively involved in Telegram-related thread / some tech groups on Telegram). It is fixed now, though. If it was ever a backdoor (which the thread does not conclusively say, just "backdoor looking" which sounds like either Telegram invented some unknown crypto that allows them to create a backdoor without anyone else having access, or an unfortunate mistake), it is no longer in there. As far as I know, this mtproto thing is weird but not broken. It is indeed something to be aware of though, I guess it's fair to bring it up, though I would not put it as black and white as "they backdoored it" when that is not actually certain. If you want to put it like that, you could also say that every vulnerability in the world could have been placed there intentionally. Which it could, but...
      - ryanlol 7y ago
        >It is fixed now, though I think this is utterly irrelevant. Telegram deliberately shipped a backdoor, removing it after they got caught doesn't change anything at all. >which the thread does not conclusively say, just "backdoor looking" which sounds like either Telegram invented some unknown crypto that allows them to create a backdoor without anyone else having access, or an unfortunate mistake Look, I'm not going to speculate on what some individuals may or may not think about this in private. However, many people would not be comfortable making such direct accusations in public. >though I would not put it as black and white as "they backdoored it" when that is not actually certain This is as certain as it could ever be, I'll refer you to this comment that worded the explanation better than I would https://news.ycombinator.com/item?id=17621104 https://news.ycombinator.com/item?id=17621104 If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck. What do you think would be sufficient evidence to call this a backdoor? >If you want to put it like that, you could also say that every vulnerability in the world could have been placed there intentionally That assumes this was anything like every other vulnerability, which isn't true.
lucb1e 7y ago
E(nd to end)ncryption is off by default, that's not an opinion. Gmail (afaik) doesn't have that at all, so saying it's off in Gmail by default is weird. It's not the same thing. (It's like saying a car's radio is off by default versus a bicycle's (non-existent) radio.) Anyway, I guess that's just semantics. We both understand what is the case, whether you like calling it a default setting or "just not encrypted". I do fully agree that Telegram is shady because it's just a money sink, and that WhatsApp had a great profit model (pre-Facebook of course). I did the math once (though that was just messages, not media) and a euro a year (times a few hundred million users, back then) was plenty to support a chat system with only a few developers as employees. If Telegram would adopt the same profit model, that would be great.
- eitland 7y ago
  Here is what you wrote: > encryption being off by default and only available on a few clients and not synchronizing between different encryption-supporting clients This more than implies that Telegram sends messages in plaintext. Which isn't true. In your reply now you prove that you are aware of this with this little sentence at the start: > E(nd to end)ncryption is off by default, that's not an opinion. E2E encryption is of course better than other forms of encryption but writing in a way that makes people think that something sends data as plaintext instead of encrypted is not acceptable at all IMO. Edit: You are also misquoting me: > Anyway, I guess that's just semantics. We both understand what is the case, whether you like calling it a default setting or "just not encrypted" That's not what I call it. I call it encrypted. The secret chats option I call end-to-end encrypted.
  - lucb1e 7y ago
    Alright, you got me, I said encrypted instead of end to end encrypted. I did not think it was necessary to specify that level of detail, given that everything is encrypted-to-the-server these days. I see what you mean, there is indeed a difference, but it feels to me like you're trying to trap me on words for the sole reason of being to say that you're right and I'm wrong about something.
    - 7y ago

ryanlol 7y ago

Telegram has shipped deliberate backdoors in the past, they can’t possibly be trusted https://m.habr.com/en/post/206900/ https://m.habr.com/en/post/206900/

eitland 7y ago
I can't read Russian well enough to understand that ;-) What I know however is that I can't recall anyone except you[0] claiming that, not even tptacek. [0]: Thought I remembered your nick and had to look up: https://duckduckgo.com/?q=Ryanlol+Telegram+site%3Anews.ycombinator.com&t=fpas&ia=web https://duckduckgo.com/?q=Ryanlol+Telegram+site%3Anews.ycomb...
- ryanlol 7y ago
  https://twitter.com/FiloSottile/status/987376021589692416 https://twitter.com/FiloSottile/status/987376021589692416 Here you can see a couple of people with better CVs than mine discussing this. But I agree, it’s incredible that I’m probably the only person in the world constantly bringing this up re:telegram
  - lucb1e 7y ago
    That is weird indeed, I never heard of this (and I'm relatively involved in Telegram-related thread / some tech groups on Telegram). It is fixed now, though. If it was ever a backdoor (which the thread does not conclusively say, just "backdoor looking" which sounds like either Telegram invented some unknown crypto that allows them to create a backdoor without anyone else having access, or an unfortunate mistake), it is no longer in there. As far as I know, this mtproto thing is weird but not broken. It is indeed something to be aware of though, I guess it's fair to bring it up, though I would not put it as black and white as "they backdoored it" when that is not actually certain. If you want to put it like that, you could also say that every vulnerability in the world could have been placed there intentionally. Which it could, but...
    - ryanlol 7y ago
      >It is fixed now, though I think this is utterly irrelevant. Telegram deliberately shipped a backdoor, removing it after they got caught doesn't change anything at all. >which the thread does not conclusively say, just "backdoor looking" which sounds like either Telegram invented some unknown crypto that allows them to create a backdoor without anyone else having access, or an unfortunate mistake Look, I'm not going to speculate on what some individuals may or may not think about this in private. However, many people would not be comfortable making such direct accusations in public. >though I would not put it as black and white as "they backdoored it" when that is not actually certain This is as certain as it could ever be, I'll refer you to this comment that worded the explanation better than I would https://news.ycombinator.com/item?id=17621104 https://news.ycombinator.com/item?id=17621104 If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck. What do you think would be sufficient evidence to call this a backdoor? >If you want to put it like that, you could also say that every vulnerability in the world could have been placed there intentionally That assumes this was anything like every other vulnerability, which isn't true.

lucb1e 7y ago

E(nd to end)ncryption is off by default, that's not an opinion. Gmail (afaik) doesn't have that at all, so saying it's off in Gmail by default is weird. It's not the same thing. (It's like saying a car's radio is off by default versus a bicycle's (non-existent) radio.) Anyway, I guess that's just semantics. We both understand what is the case, whether you like calling it a default setting or "just not encrypted". I do fully agree that Telegram is shady because it's just a money sink, and that WhatsApp had a great profit model (pre-Facebook of course). I did the math once (though that was just messages, not media) and a euro a year (times a few hundred million users, back then) was plenty to support a chat system with only a few developers as employees. If Telegram would adopt the same profit model, that would be great.

eitland 7y ago
Here is what you wrote: > encryption being off by default and only available on a few clients and not synchronizing between different encryption-supporting clients This more than implies that Telegram sends messages in plaintext. Which isn't true. In your reply now you prove that you are aware of this with this little sentence at the start: > E(nd to end)ncryption is off by default, that's not an opinion. E2E encryption is of course better than other forms of encryption but writing in a way that makes people think that something sends data as plaintext instead of encrypted is not acceptable at all IMO. Edit: You are also misquoting me: > Anyway, I guess that's just semantics. We both understand what is the case, whether you like calling it a default setting or "just not encrypted" That's not what I call it. I call it encrypted. The secret chats option I call end-to-end encrypted.
- lucb1e 7y ago
  Alright, you got me, I said encrypted instead of end to end encrypted. I did not think it was necessary to specify that level of detail, given that everything is encrypted-to-the-server these days. I see what you mean, there is indeed a difference, but it feels to me like you're trying to trap me on words for the sole reason of being to say that you're right and I'm wrong about something.
  - 7y ago