3 ms·

> so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted

by hnarn 6y ago

> so my personal assumption is that telegram is the only messenger where five eyes has at least no protocol level access and have to exploit the OS it is hosted on. This is a very strange assumption, you mean that the "Pentagons guideline for secure military conversations" is actually not a guideline for secure conversations, but exploitable conversations? Why would the Pentagon tell their own people to use exploitable communications? There's no way of knowing if you are the only one with the capability. In my eyes this information (which I haven't verified and don't have time to dig into) would rather indicate that the Pentagon believes Threema, WhatsApp and Signal to be secure while they are doubtful about Telegram -- maybe because they know something we don't, or simply because it's harder to audit.

cookiengineer 6y ago
The underlying question really is when the point is reached between "security through trust" and "security through audit". I'm not anyhow claiming that Telegram is secure. But given the problems that legal courts have when the FBI and other three letter agencies want to get access to Telegram data (and the fact that the company moved their HQ around Europe every time a state wanted access) seems to me much more trustworthy than say, any Facebook software. And I would also argue that given the fact that Gotham has full administrative access for anything Facebook sends and that the end-to-end encryption cannot be verified as both clients never actually connect directly would speak also contra WhatsApp when it comes to their security claims. (install a Firewall on Android and you'll see the whatsapp gateways/proxies). To be honest, I doubt that the Pentagon would trust any software without having seen its source code or at least having full access to the data that's transferred. And I think that's a fair assumption. The underlying issue is that the field of security has is actually that it's not a field of trust - but rather a field of mistrust. Currently I'm mistrusting the Pentagon more than some random dudes I've never seen; which might be the actual point of the discussion: Can we trust the Pentagon given their fuckups in the past?

by hnarn 6y ago

cookiengineer 6y ago

The underlying question really is when the point is reached between "security through trust" and "security through audit". I'm not anyhow claiming that Telegram is secure. But given the problems that legal courts have when the FBI and other three letter agencies want to get access to Telegram data (and the fact that the company moved their HQ around Europe every time a state wanted access) seems to me much more trustworthy than say, any Facebook software. And I would also argue that given the fact that Gotham has full administrative access for anything Facebook sends and that the end-to-end encryption cannot be verified as both clients never actually connect directly would speak also contra WhatsApp when it comes to their security claims. (install a Firewall on Android and you'll see the whatsapp gateways/proxies). To be honest, I doubt that the Pentagon would trust any software without having seen its source code or at least having full access to the data that's transferred. And I think that's a fair assumption. The underlying issue is that the field of security has is actually that it's not a field of trust - but rather a field of mistrust. Currently I'm mistrusting the Pentagon more than some random dudes I've never seen; which might be the actual point of the discussion: Can we trust the Pentagon given their fuckups in the past?