10 ms·

Telegram is such an underappreciated platform. It has many features other platforms lack, is reasonably privacy-friendly, more so than fb/whatsapp/etc, but not

Telegram is such an underappreciated platform. It has many features other platforms lack, is reasonably privacy-friendly, more so than fb/whatsapp/etc, but not enough to sacrifice features or UX. The have an API ind both official and unofficial clients for almost all platforms, including command line and native, non-electron Windows (UWP). The client API is not easy to use, as crypto and similar features are involved, but C libraries exist. On the other hand, the bot API is one of the most pleasant APIs I've ever seen. It just works, can be tested in the browser, there's no oAuth crap one needs to set up. It's beautifully simple. I use Telegram whenever I can, and it has become my goto Messenger these days.

garaetjjte 6y ago
Privacy-wise Whatsapp is probably better due to E2E.
- newscracker 6y ago
  Depends on what you prefer. WhatsApp shares your messaging metadata with Facebook. WhatsApp also exposes your phone number to everyone else (for example, in groups). Telegram does not expose your phone number to others by default, and you can even make sure that phone number enumeration attacks can't be carried out (like the authorities did in Hong Kong last year).
- fr2null 6y ago
  AFAIK, WhatsApp has decent E2EE, but metadata is not encrypted. So even though Facebook can't see what you are saying, it can see to whom you are saying it, how often, at what times etc.
  - jolux 6y ago
    Telegram isn’t encrypted at all by default, and its encryption scheme is sketchy.
    - FalconSensei 6y ago
      Exactly. WhatsApp still wins by having the message encrypted
    - fullstop 6y ago
      Eh? It's encrypted by default. Not E2E, though, although that is an option which you can choose to use.
      - StavrosK 6y ago
        That's a bit disingenuous. Everything is encrypted these days, there's virtually nothing that doesn't use TLS. Therefore, when someone says "encrypted", it's a good bet they mean E2E.
        fullstop 6y ago
        Telegram non-E2E is more than just TLS, though.
        StavrosK 6y ago
        What more do they do? I'm not aware.
        fullstop 6y ago
        It is documented here: https://core.telegram.org/mtproto https://core.telegram.org/mtproto These layers are used in addition to any encryption done on the transport layer.
        jolux 6y ago
        Fair enough, but they have the keys for that layer, I don’t see how that’s an improvement over TLS.
- sonicggg 6y ago
  How do you know it has E2E? The app itself is closed source. As far as anyone is concerned, it's all claims. How do they handle the private keys, for example? Any backdoor?
  - jeroenhd 6y ago
    WhatsApp reverse engineering happens all the time. There's news channels out there with people dedicated to being the first to announce references to upcoming features every update. The same can be said of Signal or any other chat application distributed through Google Play. How do you know the binary corresponds to the source? Good luck getting reproducible builds on Android or iOS. If you want to be sure your chat app is secure, you need to review and compile the code every time. And, of course, you need the knowledge and skills of a good cryptographer to determine hidden backdoors in the algorithms. Whatsapp is reasonably secure, as long as you don't upload your unencrypted chats to Google Drive (the backup functionality). Telegram, with E2E enabled, hasn't been proven insecure enough despite its weird custom crypto scheme. However, WhatsApp brings E2E to group chats where Telegram needs manual configuration in private chats to do so. If we want to bring E2E to the masses, WhatsApp is the best option for now. I'm hoping Matrix will change this or Telegram will implement proper crypto, but until then, WhatsApp is probably the best option we have.
    - ryanlol 6y ago
      Reproducible builds are a red herring, they do nothing to defend against bugdoors.
  - jolux 6y ago
    It uses the Signal Protocol/Axolotl Ratchet and Open Whisper Systems helped them integrate it, which is a big reputational stake from very trustworthy people.
  - ryanlol 6y ago
    Open sourcing whatsapp would solve precisely zero of these problems. There’s no way to know if a bugdoor is a backdoor or just a mistake.
- vbezhenar 6y ago
  Does it still wants to upload unencrypted backups into Google cloud?
newscracker 6y ago
> Telegram is such an underappreciated platform. Seriously, that's how I feel whenever someone asks me for my WhatsApp number (no, I don't use WhatsApp, and there's nothing called a WhatsApp number) or asks me about Facebook Messenger. Great UX, fast and new features added at a pace that puts other chat platforms to shame. [I won't talk about the security aspect in this comment, since it has been rehashed many times here]
- newsbinator 6y ago
  A WhatsApp number would be the phone number to which a user has tied their WhatsApp, for cases in which users have multiple phones and multiple phone numbers, not all of which are accessible beyond SMS.
MrGilbert 6y ago
> is reasonably privacy-friendly, more so than fb/whatsapp/etc, but not enough to sacrifice features or UX. Welp, there is a lot of discussion around these claims. But we are also on Telegram, mostly because I'm using their API for our Home-Assistant instance to deliver status updates (left the bathroom window open for too long, weather-forecast on the morning and evening for the next 3 days). I like it.
- veeableful 6y ago
  Sorry if it’s off-topic but how does it know if the bathroom window open or not? Did you build some kind of device and connect it to the home assistant?
  - milgrim 6y ago
    You can easily integrate Zigbee devices. The Aqara or Xiaomi door/window sensors for example are cheap and pretty nice.
    - veeableful 6y ago
      Thanks! I didn't know Xiaomi made such sensors too. They are definitely one of the brands that I recognize.
      - dylz 6y ago
        Officially, they only work with Mi Home cloud-crap, but there are Zigbee drivers for interfacing with it.
        milgrim 6y ago
        I use a few different devices from them with zigbee2mqtt and it’s working great. It’s perfect for combining devices from different manufacturers and not having to use their individual gateways.
  - MrGilbert 6y ago
SXX 6y ago
> It has many features other platforms lack, is reasonably privacy-friendly Telegram still has no E2E encryption by default and their official desktop client dont have it either. So it's worth nothing if no one use it. It's not that I have much trust into proprietary fb code, but there are certainly better apps privacy-wise out there.
- jolux 6y ago
  Signal
  - qhwudbebd 6y ago
    Signal leaks your telephone number to everyone with whom you communicate, which is a privacy disaster before you even send your first message. (Please don't take this as implicit approval for Telegram's approach to secure messaging, but at least they managed not to cock up in such a basic way.)
    - jolux 6y ago
      This has been explained on HN ad nauseam. It leaks less metadata than anything else, the phone number is the only metadata that it leaks (only to people you’re messaging, mind), and they’re working on a solution to that problem right now. It works that way because the developers wanted to avoid holding a central server with metadata for their entire user base. Instead it uses your local contact list to discover other users. I would say that being unencrypted by default and having a centralized metadata directory in plaintext is more of a cock-up in secure messaging than taking a rigorous and cautious approach to metadata leakage.
      - qhwudbebd 6y ago
        The constant repetition is indeed nauseating. It's also nonsense. There is another unique identifier that's stored in the local contact list: email addresses. Use either email address or a phone number as an identifier, and you've no longer built a offensively privacy-violating service but have exactly the same distributed property.
vimslayer 6y ago
> non-electron Windows (UWP) Oh? I thought it was Qt. I don't want to seem like I'm complaining for nothing as it's definitely much better than, say, Slack client, but I still feel like the Windows client is a bit "out of place". Like the task bar context menu looks different from all the other menus for other apps in there, with rounded corners etc.
- ghego1 6y ago
  I'm not sure that Slack is a proper term of comparison for Telegram. A closer competitor would probably be WhatsApp, and Telegram Desktop easily beats the "desktop" version of WhatsApp on every single aspect. The only reason I'm still using WhatsApp is due to the fact that that's what all the people I know use.
- ComodoHacker 6y ago
  It's Qt. GP might have mixed it up with Unigram client[0], which is UWP. 0. https://github.com/UnigramDev/Unigram https://github.com/UnigramDev/Unigram
fsflover 6y ago
> reasonably privacy-friendly There is still no e2e encryption on GNU/Linux desktop, even as an option. Upd: https://github.com/telegramdesktop/tdesktop/issues/871 https://github.com/telegramdesktop/tdesktop/issues/871
seemslegit 6y ago
> is reasonably privacy-friendly, more so than fb/whatsapp/etc This is a harmfully misleading notion that we shouldn't be spreading. Without explicitly invoking "secret chats" which are not even available on desktop telegram is no different from skype and fb messenger and is categorically less secure than whatsapp.

garaetjjte 6y ago

Privacy-wise Whatsapp is probably better due to E2E.

newscracker 6y ago
Depends on what you prefer. WhatsApp shares your messaging metadata with Facebook. WhatsApp also exposes your phone number to everyone else (for example, in groups). Telegram does not expose your phone number to others by default, and you can even make sure that phone number enumeration attacks can't be carried out (like the authorities did in Hong Kong last year).
fr2null 6y ago
AFAIK, WhatsApp has decent E2EE, but metadata is not encrypted. So even though Facebook can't see what you are saying, it can see to whom you are saying it, how often, at what times etc.
- jolux 6y ago
  Telegram isn’t encrypted at all by default, and its encryption scheme is sketchy.
  - FalconSensei 6y ago
    Exactly. WhatsApp still wins by having the message encrypted
  - fullstop 6y ago
    Eh? It's encrypted by default. Not E2E, though, although that is an option which you can choose to use.
    - StavrosK 6y ago
      That's a bit disingenuous. Everything is encrypted these days, there's virtually nothing that doesn't use TLS. Therefore, when someone says "encrypted", it's a good bet they mean E2E.
      - fullstop 6y ago
        Telegram non-E2E is more than just TLS, though.
        StavrosK 6y ago
        What more do they do? I'm not aware.
        fullstop 6y ago
        It is documented here: https://core.telegram.org/mtproto https://core.telegram.org/mtproto These layers are used in addition to any encryption done on the transport layer.
        jolux 6y ago
        Fair enough, but they have the keys for that layer, I don’t see how that’s an improvement over TLS.
sonicggg 6y ago
How do you know it has E2E? The app itself is closed source. As far as anyone is concerned, it's all claims. How do they handle the private keys, for example? Any backdoor?
- jeroenhd 6y ago
  WhatsApp reverse engineering happens all the time. There's news channels out there with people dedicated to being the first to announce references to upcoming features every update. The same can be said of Signal or any other chat application distributed through Google Play. How do you know the binary corresponds to the source? Good luck getting reproducible builds on Android or iOS. If you want to be sure your chat app is secure, you need to review and compile the code every time. And, of course, you need the knowledge and skills of a good cryptographer to determine hidden backdoors in the algorithms. Whatsapp is reasonably secure, as long as you don't upload your unencrypted chats to Google Drive (the backup functionality). Telegram, with E2E enabled, hasn't been proven insecure enough despite its weird custom crypto scheme. However, WhatsApp brings E2E to group chats where Telegram needs manual configuration in private chats to do so. If we want to bring E2E to the masses, WhatsApp is the best option for now. I'm hoping Matrix will change this or Telegram will implement proper crypto, but until then, WhatsApp is probably the best option we have.
  - ryanlol 6y ago
    Reproducible builds are a red herring, they do nothing to defend against bugdoors.
- jolux 6y ago
  It uses the Signal Protocol/Axolotl Ratchet and Open Whisper Systems helped them integrate it, which is a big reputational stake from very trustworthy people.
- ryanlol 6y ago
  Open sourcing whatsapp would solve precisely zero of these problems. There’s no way to know if a bugdoor is a backdoor or just a mistake.
vbezhenar 6y ago
Does it still wants to upload unencrypted backups into Google cloud?

newscracker 6y ago

> Telegram is such an underappreciated platform. Seriously, that's how I feel whenever someone asks me for my WhatsApp number (no, I don't use WhatsApp, and there's nothing called a WhatsApp number) or asks me about Facebook Messenger. Great UX, fast and new features added at a pace that puts other chat platforms to shame. [I won't talk about the security aspect in this comment, since it has been rehashed many times here]

newsbinator 6y ago
A WhatsApp number would be the phone number to which a user has tied their WhatsApp, for cases in which users have multiple phones and multiple phone numbers, not all of which are accessible beyond SMS.

MrGilbert 6y ago

> is reasonably privacy-friendly, more so than fb/whatsapp/etc, but not enough to sacrifice features or UX. Welp, there is a lot of discussion around these claims. But we are also on Telegram, mostly because I'm using their API for our Home-Assistant instance to deliver status updates (left the bathroom window open for too long, weather-forecast on the morning and evening for the next 3 days). I like it.

veeableful 6y ago
Sorry if it’s off-topic but how does it know if the bathroom window open or not? Did you build some kind of device and connect it to the home assistant?
- milgrim 6y ago
  You can easily integrate Zigbee devices. The Aqara or Xiaomi door/window sensors for example are cheap and pretty nice.
  - veeableful 6y ago
    Thanks! I didn't know Xiaomi made such sensors too. They are definitely one of the brands that I recognize.
    - dylz 6y ago
      Officially, they only work with Mi Home cloud-crap, but there are Zigbee drivers for interfacing with it.
      - milgrim 6y ago
        I use a few different devices from them with zigbee2mqtt and it’s working great. It’s perfect for combining devices from different manufacturers and not having to use their individual gateways.
- MrGilbert 6y ago

SXX 6y ago

> It has many features other platforms lack, is reasonably privacy-friendly Telegram still has no E2E encryption by default and their official desktop client dont have it either. So it's worth nothing if no one use it. It's not that I have much trust into proprietary fb code, but there are certainly better apps privacy-wise out there.

jolux 6y ago
Signal
- qhwudbebd 6y ago
  Signal leaks your telephone number to everyone with whom you communicate, which is a privacy disaster before you even send your first message. (Please don't take this as implicit approval for Telegram's approach to secure messaging, but at least they managed not to cock up in such a basic way.)
  - jolux 6y ago
    This has been explained on HN ad nauseam. It leaks less metadata than anything else, the phone number is the only metadata that it leaks (only to people you’re messaging, mind), and they’re working on a solution to that problem right now. It works that way because the developers wanted to avoid holding a central server with metadata for their entire user base. Instead it uses your local contact list to discover other users. I would say that being unencrypted by default and having a centralized metadata directory in plaintext is more of a cock-up in secure messaging than taking a rigorous and cautious approach to metadata leakage.
    - qhwudbebd 6y ago
      The constant repetition is indeed nauseating. It's also nonsense. There is another unique identifier that's stored in the local contact list: email addresses. Use either email address or a phone number as an identifier, and you've no longer built a offensively privacy-violating service but have exactly the same distributed property.

vimslayer 6y ago

> non-electron Windows (UWP) Oh? I thought it was Qt. I don't want to seem like I'm complaining for nothing as it's definitely much better than, say, Slack client, but I still feel like the Windows client is a bit "out of place". Like the task bar context menu looks different from all the other menus for other apps in there, with rounded corners etc.

ghego1 6y ago
I'm not sure that Slack is a proper term of comparison for Telegram. A closer competitor would probably be WhatsApp, and Telegram Desktop easily beats the "desktop" version of WhatsApp on every single aspect. The only reason I'm still using WhatsApp is due to the fact that that's what all the people I know use.
ComodoHacker 6y ago
It's Qt. GP might have mixed it up with Unigram client[0], which is UWP. 0. https://github.com/UnigramDev/Unigram https://github.com/UnigramDev/Unigram

fsflover 6y ago

> reasonably privacy-friendly There is still no e2e encryption on GNU/Linux desktop, even as an option. Upd: https://github.com/telegramdesktop/tdesktop/issues/871 https://github.com/telegramdesktop/tdesktop/issues/871

seemslegit 6y ago

> is reasonably privacy-friendly, more so than fb/whatsapp/etc This is a harmfully misleading notion that we shouldn't be spreading. Without explicitly invoking "secret chats" which are not even available on desktop telegram is no different from skype and fb messenger and is categorically less secure than whatsapp.