5 ms·

Privacy-wise Whatsapp is probably better due to E2E.

newscracker 6y ago
Depends on what you prefer. WhatsApp shares your messaging metadata with Facebook. WhatsApp also exposes your phone number to everyone else (for example, in groups). Telegram does not expose your phone number to others by default, and you can even make sure that phone number enumeration attacks can't be carried out (like the authorities did in Hong Kong last year).
fr2null 6y ago
AFAIK, WhatsApp has decent E2EE, but metadata is not encrypted. So even though Facebook can't see what you are saying, it can see to whom you are saying it, how often, at what times etc.
- jolux 6y ago
  Telegram isn’t encrypted at all by default, and its encryption scheme is sketchy.
  - FalconSensei 6y ago
    Exactly. WhatsApp still wins by having the message encrypted
  - fullstop 6y ago
    Eh? It's encrypted by default. Not E2E, though, although that is an option which you can choose to use.
    - StavrosK 6y ago
      That's a bit disingenuous. Everything is encrypted these days, there's virtually nothing that doesn't use TLS. Therefore, when someone says "encrypted", it's a good bet they mean E2E.
      - fullstop 6y ago
        Telegram non-E2E is more than just TLS, though.
        StavrosK 6y ago
        What more do they do? I'm not aware.
        fullstop 6y ago
        It is documented here: https://core.telegram.org/mtproto https://core.telegram.org/mtproto These layers are used in addition to any encryption done on the transport layer.
        jolux 6y ago
        Fair enough, but they have the keys for that layer, I don’t see how that’s an improvement over TLS.
sonicggg 6y ago
How do you know it has E2E? The app itself is closed source. As far as anyone is concerned, it's all claims. How do they handle the private keys, for example? Any backdoor?
- jeroenhd 6y ago
  WhatsApp reverse engineering happens all the time. There's news channels out there with people dedicated to being the first to announce references to upcoming features every update. The same can be said of Signal or any other chat application distributed through Google Play. How do you know the binary corresponds to the source? Good luck getting reproducible builds on Android or iOS. If you want to be sure your chat app is secure, you need to review and compile the code every time. And, of course, you need the knowledge and skills of a good cryptographer to determine hidden backdoors in the algorithms. Whatsapp is reasonably secure, as long as you don't upload your unencrypted chats to Google Drive (the backup functionality). Telegram, with E2E enabled, hasn't been proven insecure enough despite its weird custom crypto scheme. However, WhatsApp brings E2E to group chats where Telegram needs manual configuration in private chats to do so. If we want to bring E2E to the masses, WhatsApp is the best option for now. I'm hoping Matrix will change this or Telegram will implement proper crypto, but until then, WhatsApp is probably the best option we have.
  - ryanlol 6y ago
    Reproducible builds are a red herring, they do nothing to defend against bugdoors.
- jolux 6y ago
  It uses the Signal Protocol/Axolotl Ratchet and Open Whisper Systems helped them integrate it, which is a big reputational stake from very trustworthy people.
- ryanlol 6y ago
  Open sourcing whatsapp would solve precisely zero of these problems. There’s no way to know if a bugdoor is a backdoor or just a mistake.
vbezhenar 6y ago
Does it still wants to upload unencrypted backups into Google cloud?

Depends on what you prefer. WhatsApp shares your messaging metadata with Facebook. WhatsApp also exposes your phone number to everyone else (for example, in groups). Telegram does not expose your phone number to others by default, and you can even make sure that phone number enumeration attacks can't be carried out (like the authorities did in Hong Kong last year).

fr2null 6y ago

AFAIK, WhatsApp has decent E2EE, but metadata is not encrypted. So even though Facebook can't see what you are saying, it can see to whom you are saying it, how often, at what times etc.

jolux 6y ago
Telegram isn’t encrypted at all by default, and its encryption scheme is sketchy.
- FalconSensei 6y ago
  Exactly. WhatsApp still wins by having the message encrypted
- fullstop 6y ago
  Eh? It's encrypted by default. Not E2E, though, although that is an option which you can choose to use.
  - StavrosK 6y ago
    That's a bit disingenuous. Everything is encrypted these days, there's virtually nothing that doesn't use TLS. Therefore, when someone says "encrypted", it's a good bet they mean E2E.
    - fullstop 6y ago
      Telegram non-E2E is more than just TLS, though.
      - StavrosK 6y ago
        What more do they do? I'm not aware.
        fullstop 6y ago
        It is documented here: https://core.telegram.org/mtproto https://core.telegram.org/mtproto These layers are used in addition to any encryption done on the transport layer.
        jolux 6y ago
        Fair enough, but they have the keys for that layer, I don’t see how that’s an improvement over TLS.

sonicggg 6y ago

How do you know it has E2E? The app itself is closed source. As far as anyone is concerned, it's all claims. How do they handle the private keys, for example? Any backdoor?

jeroenhd 6y ago
WhatsApp reverse engineering happens all the time. There's news channels out there with people dedicated to being the first to announce references to upcoming features every update. The same can be said of Signal or any other chat application distributed through Google Play. How do you know the binary corresponds to the source? Good luck getting reproducible builds on Android or iOS. If you want to be sure your chat app is secure, you need to review and compile the code every time. And, of course, you need the knowledge and skills of a good cryptographer to determine hidden backdoors in the algorithms. Whatsapp is reasonably secure, as long as you don't upload your unencrypted chats to Google Drive (the backup functionality). Telegram, with E2E enabled, hasn't been proven insecure enough despite its weird custom crypto scheme. However, WhatsApp brings E2E to group chats where Telegram needs manual configuration in private chats to do so. If we want to bring E2E to the masses, WhatsApp is the best option for now. I'm hoping Matrix will change this or Telegram will implement proper crypto, but until then, WhatsApp is probably the best option we have.
- ryanlol 6y ago
  Reproducible builds are a red herring, they do nothing to defend against bugdoors.
jolux 6y ago
It uses the Signal Protocol/Axolotl Ratchet and Open Whisper Systems helped them integrate it, which is a big reputational stake from very trustworthy people.
ryanlol 6y ago
Open sourcing whatsapp would solve precisely zero of these problems. There’s no way to know if a bugdoor is a backdoor or just a mistake.

vbezhenar 6y ago

Does it still wants to upload unencrypted backups into Google cloud?