4 ms·

At least WhatsApp has End to End encryption by default. I would be surprised if more than 1% of Telegram communications were similarly secure. I also find the c

At least WhatsApp has End to End encryption by default. I would be surprised if more than 1% of Telegram communications were similarly secure. I also find the constant mention of the vulns being "backdoors" disingenuous. I'm a big fan of Telegram for its top notch bot support, but I'm flagging this submission.

dijit 7y ago
No point having E2EE if you can just ask for the history of all chats from the application. Not saying telegram is better. But this is a common use-case for whatsapp. (Whatsapp web transports all history). So the E2EE argument is disingenuous if the client is closed imo.
- ensiferum 7y ago
  No it doesn't. Your chats are on your phone. If you activate WhatsApp on another phone without having backed up your chats you will lose them.
  - dijit 7y ago
    If you activate WhatsApp on another phone while your first phone is still active and you open both apps it will copy them over, but that wasn’t the point I was making. The case for whatsapp web is absolutely true- and you can’t say that it 100% doesn’t have any remote admin features, because it’s closed. EDIT: I'd like to clarify; many people's reasoning seems to be: "Whatsapp == Signal" && "Signal > *" But that's not at all true.
    - bad_user 7y ago
      > If you activate WhatsApp on another phone while your first phone is still active and you open both apps it will copy them over, but that wasn’t the point I was making. To my knowledge, that's not true. But even if true, that doesn't mean e2e encryption isn't in effect. --- > The case for whatsapp web is absolutely true The web interface is completely driven by your phone, acting as a remote control and WhatsApp still doesn't have access to your conversations. https://signal.org https://signal.org uses the exact same model and it's open source, so you can review it. It is true that WhatsApp being proprietary, Facebook could insert local content scanners that bypasses e2e encryption. Which they actually threatened to do in the past, not sure what the status of that is. But in spite of this, WhatsApp is still much better than any other service that doesn't do e2e encryption by default. Yes, I'd prefer Signal.org personally, but it's not what my acquaintances use ¯\_(ツ)_/¯ And I'll never use Telegram, unless it reaches FB Messenger levels of popularity.
      - dancemethis 7y ago
        You can review for Signal, but you can't for WhatsApp. which is VERY concerning.
      - nostalgk 7y ago
        > To my knowledge, that's not true. But even if true, that doesn't mean e2e encryption isn't in effect. It's not true. I just recently switched phones. If you activate your phone on the app, you can't use the app on your previous phone without authenticating again, and it only shows your local history. I lost all my history when moving phones, as I chose not to back up my messages (who would?).
        cesarb 7y ago
        > I lost all my history when moving phones, as I chose not to back up my messages (who would?). The trick is to use the local backup option (it's encrypted with a key from the whatsapp servers, but all the files are kept on your device), and use syncthing to copy the whole folder structure (containing the backup and the media) to the new phone before installing whatsapp. When first run, the whatsapp client detects the presence of that backup, asks whether you want to use it, gets the key from the whatsapp servers (after you authenticate your account), and restores the backup. (By the way, Signal can do the same trick, but it's slightly less user-friendly: the encryption key does not come from the signal servers, it's a sequence of numbers you have to write down and type on the new phone.)
      - rfmw19 7y ago
        > The web interface is completely driven by your phone, acting as a remote control and WhatsApp still doesn't have access to your conversations. > https://signal.org https://signal.org uses the exact same model and it's open source, so you can review it. To be clear, Signal's desktop interface does not work like WhatsApp's web interface: Signal is not completely driven by your phone. Signal Desktop can still send and receive messages even if the phone it is tied to is completely off. I might have misunderstood what you're trying to say, but wanted to clarify this.
    - londons_explore 7y ago
      > If you activate WhatsApp on another phone while your first phone is still active and you open both apps it will copy them over, This is not true on Android. You cannot activate WhatsApp on 2 phones at once. If you try, the first will instantly deactivate and will not do any copying of messages. Message restore is from Google Drive backups. There is also a way to backup to a file, but it's an unsupported hack.
      - nostalgk 7y ago
        It is also not true across Android -> iOS, as I just made the switch and experienced the same thing.
dancemethis 7y ago
Allegedly*. Since both client and server side are proprietary, it can't be proven that the OpenWhisper implementation wasn't tampered with. and it's very disheartening to see Signal licking WhatsApp's metaphorical feet every step of the way.
- UncleMeat 7y ago
  Open source isn't magic. Closed source isn't a black box. Reading bytecode is trivial. Reading decompiled binaries is even not so bad. Hiding some tampering of the protocol in closed source clients is not that much easier than hiding it in open source clients. Especially if tens of thousands of engineers have access to the whatsapp source and change history and a deliberate backdoor would be international news.
arkadiytehgraet 7y ago
Have you seen sources of WhatsApp? Do you trust claims made by Facebook about privacy and encryption?
- anchpop 7y ago
  > Do you trust claims made by Facebook about privacy and encryption? I trust facebook that when they say something is E2E encrypted, it really is (except in the case of targeted attacks). If it weren't, I would expect an internal whistleblower to very quickly report it.
  - spaceandshit 7y ago
    You have a lot of trust in strangers.
anoncake 7y ago
End to end encryption has its disadvantages. If only 1% of communications use it then in only 1% of communications require the users consider it necessary and worth it. And there's nothing wrong with that.
- BoppreH 7y ago
  The problem is that many users think they are using E2E, because that's what Telegram advertises. Those people needed security, and looked for it, and are now vulnerable. Besides, security and privacy should be the default. It's not like the user experience of WhatsApp is drastically worse for having E2E.
  - anoncake 7y ago
    > The problem is that many users think they are using E2E Source, please. > Besides, security and privacy should be the default. Not at the cost of usability and freedom. Especially considering E2E encryption isn't necessary to protect against the attackers most people can expect. > It's not like the user experience of WhatsApp is drastically worse for having E2E. It absolutely is. WhatsApp doesn't even allow you to use multiple devices!
    - icebraining 7y ago
      >> It's not like the user experience of WhatsApp is drastically worse for having E2E. > It absolutely is. WhatsApp doesn't even allow you to use multiple devices! I'm pretty sure you couldn't use multiple devices before they implemented E2E. By the way, how does E2E cost freedom?
      - anoncake 7y ago
        It doesn't, I conflated Signal/WhatsApp and E2E. Sorry.

dijit 7y ago

No point having E2EE if you can just ask for the history of all chats from the application. Not saying telegram is better. But this is a common use-case for whatsapp. (Whatsapp web transports all history). So the E2EE argument is disingenuous if the client is closed imo.

ensiferum 7y ago
No it doesn't. Your chats are on your phone. If you activate WhatsApp on another phone without having backed up your chats you will lose them.
- dijit 7y ago
  If you activate WhatsApp on another phone while your first phone is still active and you open both apps it will copy them over, but that wasn’t the point I was making. The case for whatsapp web is absolutely true- and you can’t say that it 100% doesn’t have any remote admin features, because it’s closed. EDIT: I'd like to clarify; many people's reasoning seems to be: "Whatsapp == Signal" && "Signal > *" But that's not at all true.
  - bad_user 7y ago
    > If you activate WhatsApp on another phone while your first phone is still active and you open both apps it will copy them over, but that wasn’t the point I was making. To my knowledge, that's not true. But even if true, that doesn't mean e2e encryption isn't in effect. --- > The case for whatsapp web is absolutely true The web interface is completely driven by your phone, acting as a remote control and WhatsApp still doesn't have access to your conversations. https://signal.org https://signal.org uses the exact same model and it's open source, so you can review it. It is true that WhatsApp being proprietary, Facebook could insert local content scanners that bypasses e2e encryption. Which they actually threatened to do in the past, not sure what the status of that is. But in spite of this, WhatsApp is still much better than any other service that doesn't do e2e encryption by default. Yes, I'd prefer Signal.org personally, but it's not what my acquaintances use ¯\_(ツ)_/¯ And I'll never use Telegram, unless it reaches FB Messenger levels of popularity.
    - dancemethis 7y ago
      You can review for Signal, but you can't for WhatsApp. which is VERY concerning.
    - nostalgk 7y ago
      > To my knowledge, that's not true. But even if true, that doesn't mean e2e encryption isn't in effect. It's not true. I just recently switched phones. If you activate your phone on the app, you can't use the app on your previous phone without authenticating again, and it only shows your local history. I lost all my history when moving phones, as I chose not to back up my messages (who would?).
      - cesarb 7y ago
        > I lost all my history when moving phones, as I chose not to back up my messages (who would?). The trick is to use the local backup option (it's encrypted with a key from the whatsapp servers, but all the files are kept on your device), and use syncthing to copy the whole folder structure (containing the backup and the media) to the new phone before installing whatsapp. When first run, the whatsapp client detects the presence of that backup, asks whether you want to use it, gets the key from the whatsapp servers (after you authenticate your account), and restores the backup. (By the way, Signal can do the same trick, but it's slightly less user-friendly: the encryption key does not come from the signal servers, it's a sequence of numbers you have to write down and type on the new phone.)
    - rfmw19 7y ago
      > The web interface is completely driven by your phone, acting as a remote control and WhatsApp still doesn't have access to your conversations. > https://signal.org https://signal.org uses the exact same model and it's open source, so you can review it. To be clear, Signal's desktop interface does not work like WhatsApp's web interface: Signal is not completely driven by your phone. Signal Desktop can still send and receive messages even if the phone it is tied to is completely off. I might have misunderstood what you're trying to say, but wanted to clarify this.
  - londons_explore 7y ago
    > If you activate WhatsApp on another phone while your first phone is still active and you open both apps it will copy them over, This is not true on Android. You cannot activate WhatsApp on 2 phones at once. If you try, the first will instantly deactivate and will not do any copying of messages. Message restore is from Google Drive backups. There is also a way to backup to a file, but it's an unsupported hack.
    - nostalgk 7y ago
      It is also not true across Android -> iOS, as I just made the switch and experienced the same thing.

dancemethis 7y ago

Allegedly*. Since both client and server side are proprietary, it can't be proven that the OpenWhisper implementation wasn't tampered with. and it's very disheartening to see Signal licking WhatsApp's metaphorical feet every step of the way.

UncleMeat 7y ago
Open source isn't magic. Closed source isn't a black box. Reading bytecode is trivial. Reading decompiled binaries is even not so bad. Hiding some tampering of the protocol in closed source clients is not that much easier than hiding it in open source clients. Especially if tens of thousands of engineers have access to the whatsapp source and change history and a deliberate backdoor would be international news.

arkadiytehgraet 7y ago

Have you seen sources of WhatsApp? Do you trust claims made by Facebook about privacy and encryption?

anchpop 7y ago
> Do you trust claims made by Facebook about privacy and encryption? I trust facebook that when they say something is E2E encrypted, it really is (except in the case of targeted attacks). If it weren't, I would expect an internal whistleblower to very quickly report it.
- spaceandshit 7y ago
  You have a lot of trust in strangers.

anoncake 7y ago

End to end encryption has its disadvantages. If only 1% of communications use it then in only 1% of communications require the users consider it necessary and worth it. And there's nothing wrong with that.

BoppreH 7y ago
The problem is that many users think they are using E2E, because that's what Telegram advertises. Those people needed security, and looked for it, and are now vulnerable. Besides, security and privacy should be the default. It's not like the user experience of WhatsApp is drastically worse for having E2E.
- anoncake 7y ago
  > The problem is that many users think they are using E2E Source, please. > Besides, security and privacy should be the default. Not at the cost of usability and freedom. Especially considering E2E encryption isn't necessary to protect against the attackers most people can expect. > It's not like the user experience of WhatsApp is drastically worse for having E2E. It absolutely is. WhatsApp doesn't even allow you to use multiple devices!
  - icebraining 7y ago
    >> It's not like the user experience of WhatsApp is drastically worse for having E2E. > It absolutely is. WhatsApp doesn't even allow you to use multiple devices! I'm pretty sure you couldn't use multiple devices before they implemented E2E. By the way, how does E2E cost freedom?
    - anoncake 7y ago
      It doesn't, I conflated Signal/WhatsApp and E2E. Sorry.