6 ms·

>- Security / Privacy (eg Telegram) But Telegram offers just as much security and privacy as Slack.

eitland 7y ago
1. They are vey different. Those who arent aware of the large differences shouldn't comment as if they are they are subject experts. Telegram might be full of holes but it is a very different thing to Slack. (I use both for different things.) 2. I have my own issues with Telegram (the refusal to introduce sustainable funding, pushing of crypto currencies, possibly also marketing it as more than it is) but except that there's a lot to like about it and I think it is a decent starting point if someone with strong cryptographic skills wants to start with a decent client and go ahead to provide something better (either introduce e2e-encryption or improve, document and provide some way to verify the current solution.)
- johnmorrison 7y ago
  E2E encryption is kind of a fucky thing, some suggest it is fundamentally impossible for central web services and even mobile / desktop apps. Basically, if there is a third party involved in the code besides Alice and Bob, the two can never guarantee E2E encryption. Web part is simple, as there are countless ways you can get malicious code delivered from what you think is the correct, safe, web server. Same concept applies to app store / desktop program updates, but with a slightly slower and more difficult attack prospect. Anyways, Telegram does seem to have the best encryption of any major service, and it's what we use at my company for almost all internal communications.
  - ryanlol 7y ago
    >E2E encryption is kind of a fucky thing, some suggest it is fundamentally impossible for central web services and even mobile / desktop apps "some suggest" How about you actually name some competent people who suggest this? >Basically, if there is a third party involved in the code besides Alice and Bob, the two can never guarantee E2E encryption. Oh, this is a downright insane, dishonest argument. Perfection is impossible, so we shouldn't even try! >Anyways, Telegram does seem to have the best encryption of any major service, and it's what we use at my company for almost all internal communications. Why do you think this? This is such a fundamentally ridiculous claim, I find it absolutely fascinating that someone might arrive at this conclusion.
    - eitland 7y ago
      An upvote for that just to prove that we can agree as long as we stick to the facts however harsh they are.
    - johnmorrison 7y ago
      > How about you actually name some competent people who suggest this? As I don't remember the name of everybody I read about, it would take significant effort to go find the source. It's much simpler to prove the concept logically: Any time you're communicating on a service provided, programmed, and updated by at least one third party, it is fundamentally impossible to guarantee E2EE without being omniscient of what they're doing. This is simply because the unen/decrypted data is in the software at some point in time, and the third party controls the software. > Oh, this is a downright insane, dishonest argument. Perfection is impossible, so we shouldn't even try! I did not say or imply this in any way, and no it is neither an insane nor dishonest argument, it's just a consequence of allowing a third party to control your data.
  - teknologist 7y ago
    Two words: Signal Protocol
    - krageon 7y ago
      It's an american development by a company that refuses to release actually open software. Perhaps it's good in theory! As far as I am aware there is no open implementation of it and it is also inside a problematic regime and therefore just as suspect.
      - eitland 7y ago
        Signal clients are released aa open source as far as I am aware and mathematics doesn't care about what regime it is developed under. You guys will normally find me defending Telegram here but the more important point is that we should stick to the facts even if they go in favor of "the other side".
        krageon 7y ago
        I have not to date found anything that allows me to build a client myself and subsequently actually use it. Never mind the server, which is about as opaque as they come. This isn't about Telegram advocacy, it's about how I keep reading "Signal is so good!" even though the devs have a very bad attitude to anyone asking about reproducible builds. When they are that hostile they do not earn trust, so it is mystifying to me that people seem to love them so much.
      - ryanlol 7y ago
        Yeah, the Kremlin backed startup that was already caught shipping blatant backdoors is so much better https://habr.com/en/post/206900/ https://habr.com/en/post/206900/
        eitland 7y ago
        1. The man behind Telegram cannot even safely visit Russia after people with friends in high places stole his previous startup there or so the story goes. 2. As have been pointed out before, while this is really bad if true, but you are pointing to something that happened extremely early in the development of Telegram and later fixed (and as I've mentioned before you keep throwing a link to an old Russian post in a forun where most people have never read a word Russian. I'll add this time that it is almost as you don't want anyone to read it.)
- ryanlol 7y ago
  >1. They are vey different. Those who arent aware of the large differences shouldn't comment as if they are they are subject experts. Telegram might be full of holes but it is a very different thing to Slack. (I use both for different things.) This is just bullshit. Slack does TLS, Telegram does their own weird TLS replacement. In both cases essentially zero conversations are E2EE. As far as privacy and security goes they're essentially the same (although Slack has a better track record of honesty than Telegram!) >the refusal to introduce sustainable funding What do you mean? Selling out their customers seems to be rather sustainable, they've been at it since the start and nobody cares to even talk about it. https://habr.com/en/post/206900/ https://habr.com/en/post/206900/
  - eitland 7y ago
    This is getting tiresome and I don't think I'll move ryanlol, but for everyone else: One big difference between slack and Telegram is that Slack can and will give my data to the administrator at work if they ask for it. ryanlol seems to be thinking only about the last hop from their data center to the device. In practice security is about a whole lot more than just checking of the coolest boxes: WhatsApp for example has had e2e encryption for a while now all while uploading every last message of every conversation to datacenters that are easily accessible for anyone with an American subpoena. That is totally OK, I'm posting this from my old account and I don't have anything to hide from American authorities but hardly compatible with what certain people here think that just because something is e2e encrypted then it safe and good. So why is Telegram bulletproof. That was a trick question : it isn't. But we should stick to the facts instead of trying to tear down a strawman. Re the rest of ryanlols post: as I've mentioned before most people here don't understand Russian, yet ryanlol keep posting old Russian posts. I don't know why.
    - ryanlol 7y ago
      >The big difference between slack and Telegram is that Slack can easily give my data to the administrator at work if they ask for it. Sure, that's perfectly fair. With Slack you have to trust Slack and the admins of your workspace (which could very well be you!), with Telegram you have to trust Telegram but don't get workspaces. >Re the rest of your post: as I've mentioned begore most people here don't understand Russian, yet you keep posting old Russian posts. It's hardly unreasonable to assume that people in 2019 have access to translation software, I also think it'd be presumptuous to directly link to a machine translated version.

1. They are vey different. Those who arent aware of the large differences shouldn't comment as if they are they are subject experts. Telegram might be full of holes but it is a very different thing to Slack. (I use both for different things.) 2. I have my own issues with Telegram (the refusal to introduce sustainable funding, pushing of crypto currencies, possibly also marketing it as more than it is) but except that there's a lot to like about it and I think it is a decent starting point if someone with strong cryptographic skills wants to start with a decent client and go ahead to provide something better (either introduce e2e-encryption or improve, document and provide some way to verify the current solution.)

johnmorrison 7y ago
E2E encryption is kind of a fucky thing, some suggest it is fundamentally impossible for central web services and even mobile / desktop apps. Basically, if there is a third party involved in the code besides Alice and Bob, the two can never guarantee E2E encryption. Web part is simple, as there are countless ways you can get malicious code delivered from what you think is the correct, safe, web server. Same concept applies to app store / desktop program updates, but with a slightly slower and more difficult attack prospect. Anyways, Telegram does seem to have the best encryption of any major service, and it's what we use at my company for almost all internal communications.
- ryanlol 7y ago
  >E2E encryption is kind of a fucky thing, some suggest it is fundamentally impossible for central web services and even mobile / desktop apps "some suggest" How about you actually name some competent people who suggest this? >Basically, if there is a third party involved in the code besides Alice and Bob, the two can never guarantee E2E encryption. Oh, this is a downright insane, dishonest argument. Perfection is impossible, so we shouldn't even try! >Anyways, Telegram does seem to have the best encryption of any major service, and it's what we use at my company for almost all internal communications. Why do you think this? This is such a fundamentally ridiculous claim, I find it absolutely fascinating that someone might arrive at this conclusion.
  - eitland 7y ago
    An upvote for that just to prove that we can agree as long as we stick to the facts however harsh they are.
  - johnmorrison 7y ago
    > How about you actually name some competent people who suggest this? As I don't remember the name of everybody I read about, it would take significant effort to go find the source. It's much simpler to prove the concept logically: Any time you're communicating on a service provided, programmed, and updated by at least one third party, it is fundamentally impossible to guarantee E2EE without being omniscient of what they're doing. This is simply because the unen/decrypted data is in the software at some point in time, and the third party controls the software. > Oh, this is a downright insane, dishonest argument. Perfection is impossible, so we shouldn't even try! I did not say or imply this in any way, and no it is neither an insane nor dishonest argument, it's just a consequence of allowing a third party to control your data.
- teknologist 7y ago
  Two words: Signal Protocol
  - krageon 7y ago
    It's an american development by a company that refuses to release actually open software. Perhaps it's good in theory! As far as I am aware there is no open implementation of it and it is also inside a problematic regime and therefore just as suspect.
    - eitland 7y ago
      Signal clients are released aa open source as far as I am aware and mathematics doesn't care about what regime it is developed under. You guys will normally find me defending Telegram here but the more important point is that we should stick to the facts even if they go in favor of "the other side".
      - krageon 7y ago
        I have not to date found anything that allows me to build a client myself and subsequently actually use it. Never mind the server, which is about as opaque as they come. This isn't about Telegram advocacy, it's about how I keep reading "Signal is so good!" even though the devs have a very bad attitude to anyone asking about reproducible builds. When they are that hostile they do not earn trust, so it is mystifying to me that people seem to love them so much.
    - ryanlol 7y ago
      Yeah, the Kremlin backed startup that was already caught shipping blatant backdoors is so much better https://habr.com/en/post/206900/ https://habr.com/en/post/206900/
      - eitland 7y ago
        1. The man behind Telegram cannot even safely visit Russia after people with friends in high places stole his previous startup there or so the story goes. 2. As have been pointed out before, while this is really bad if true, but you are pointing to something that happened extremely early in the development of Telegram and later fixed (and as I've mentioned before you keep throwing a link to an old Russian post in a forun where most people have never read a word Russian. I'll add this time that it is almost as you don't want anyone to read it.)
ryanlol 7y ago
>1. They are vey different. Those who arent aware of the large differences shouldn't comment as if they are they are subject experts. Telegram might be full of holes but it is a very different thing to Slack. (I use both for different things.) This is just bullshit. Slack does TLS, Telegram does their own weird TLS replacement. In both cases essentially zero conversations are E2EE. As far as privacy and security goes they're essentially the same (although Slack has a better track record of honesty than Telegram!) >the refusal to introduce sustainable funding What do you mean? Selling out their customers seems to be rather sustainable, they've been at it since the start and nobody cares to even talk about it. https://habr.com/en/post/206900/ https://habr.com/en/post/206900/
- eitland 7y ago
  This is getting tiresome and I don't think I'll move ryanlol, but for everyone else: One big difference between slack and Telegram is that Slack can and will give my data to the administrator at work if they ask for it. ryanlol seems to be thinking only about the last hop from their data center to the device. In practice security is about a whole lot more than just checking of the coolest boxes: WhatsApp for example has had e2e encryption for a while now all while uploading every last message of every conversation to datacenters that are easily accessible for anyone with an American subpoena. That is totally OK, I'm posting this from my old account and I don't have anything to hide from American authorities but hardly compatible with what certain people here think that just because something is e2e encrypted then it safe and good. So why is Telegram bulletproof. That was a trick question : it isn't. But we should stick to the facts instead of trying to tear down a strawman. Re the rest of ryanlols post: as I've mentioned before most people here don't understand Russian, yet ryanlol keep posting old Russian posts. I don't know why.
  - ryanlol 7y ago
    >The big difference between slack and Telegram is that Slack can easily give my data to the administrator at work if they ask for it. Sure, that's perfectly fair. With Slack you have to trust Slack and the admins of your workspace (which could very well be you!), with Telegram you have to trust Telegram but don't get workspaces. >Re the rest of your post: as I've mentioned begore most people here don't understand Russian, yet you keep posting old Russian posts. It's hardly unreasonable to assume that people in 2019 have access to translation software, I also think it'd be presumptuous to directly link to a machine translated version.