14 ms·

Should the revolution fail, the digital trail left by these messages will give the government everything they need to hunt down every last activist. We saw it

Should the revolution fail, the digital trail left by these messages will give the government everything they need to hunt down every last activist. We saw it with the Green Revolution in Iran. We've seen it several times since. So long as messages are not encrypted, messaging apps are much more naturally suited as tools of oppression than tools of revolution.

mbowcutt 6y ago
I don't know too much about Telegram but isn't it encrypted?
- mauflows 6y ago
  I'm pretty sure Signal at least doesn't encrypt at rest on your phone. So the drive would have to be encrypted as well, which is not default on Android
  - t0astbread 6y ago
    Apart from that, regardless if you're on Signal or Telegram if authorities get hold of a protester's identity on such an app and have the power to access the app's servers they can gradually uncover social networks by reading metadata (if I'm not mistaken).
    - voxic11 6y ago
      I think you are mistaken. Before your text is sent to Signal your sender information is encrypted with the receiver's public key. So while Signal's servers can see who to deliver the message to they cannot see who sent it. Only the receiving client can decrypt and authenticate the message. This feature was rolled out in late 2018 and is called "sealed sender". It was developed to prevent leakage of any social network information via the message metadata. But as far as I know Telegram has no equivalent feature.
      - t0astbread 6y ago
        Oh, that's nice! I didn't know that. Ammendment to my above statement: This does not apply to Signal.
      - maqp 6y ago
        "So while Signal's servers can see who to deliver the message to they cannot see who sent it." Why can't they look at the TCP headers of incoming packets to determine source-IP? Also, why can't they look at session identifier or signal ID like phone number to determine who the sender is?
        voxic11 6y ago
        I assume if you are trying to hide your communications you aren't connecting directly to signals servers, so IP should get you nothing. There is no session identifier or signalID attached to your message, its contained within the encrypted part of the message so only the receiver can determine who the message was sent by. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
  - seanieb 6y ago
    Signal is encrypted at rest. It uses a special encrypted version of Sqlite. https://www.zetetic.net/sqlcipher/ https://www.zetetic.net/sqlcipher/
  - voxic11 6y ago
    Signal does encrypt your messages locally. Also Android supports file encryption you don't need to use full disk encryption anymore. Also I think the policy has changed in Android 10. > All compatible Android devices newly launching with Android Q are required to encrypt user data, with no exceptions.
    - upofadown 6y ago
      Signal traditionally had an easy to get encryption key for the local encryption. Now there is a PIN but I don't think it is any protection against having access to the disk. The signal people would prefer that that you deal with the end point security yourself, because they really can't do much there.
      - maqp 6y ago
        Indeed, the PIN is just for SVR. Exported message logs on Android use separate, client-generated, 30-digit, PINs. Unless the OS+HW provide API for some sort of TPM, it's not possible to provide strong protection for app databases without asking for strong password every time the app is opened. Android has had some sort of sandboxing for a while but it's not comparable to secure enclaves etc. AFAIK.
  - boring_twenties 6y ago
    Android has encrypted storage by default since a few years ago. Of course, by default it uses a default key. But, the point is, enabling "encryption" just means changing that key, not reencrypting the entire device.
- polyomino 6y ago
  Not by default.
- dgellow 6y ago
  Not by default, no, because that has UX implications (e.g the chat will only be available on one on your device instead of being synced between all your devices). Though it’s quite easy to start an encrypted chat, and you can decide to have auto destructive messages.
- lol2143651 6y ago
  Well it's server software is closed-source, so you would never really know who has a backdoor. There are much better options than Telegram if you want real security. Signal for one.
- BelleOfTheBall 6y ago
  It is encrypted by default but end-to-end is only for calls and Secret Chats (one-on-one). You can delete any message at any time without a trace for both sides, which protesters often do, really don't think the government needs messages to pin a crime on them. Hell, they've pinned crimes on people for literally no reason before.
  - vel0city 6y ago
    So when you try and go tell the other person's device to delete your message, how does it go into their iCloud backups and delete that message, or some other backup? Don't depend on asking someone else's device to delete the data as that data being gone.
    - BelleOfTheBall 6y ago
      Telegram doesn't store messages on the device, you don't need to "tell the other person's device" anything, it's deleted from the Telegram cloud.
      - throwaway8941 6y ago
        It is stored locally, although only temporarily. I rarely connect my phone to the internet and still can scroll through quite a bit of message history.
- input_sh 6y ago
  By default it's no more encrypted than HN (as in, traffic to their servers uses TLS, messages on the server are not encrypted at all). There's Secret Chats feature which they claim to be end-to-end encrypted, meaning that it's no more secure than Facebook's Messenger (also end-to-end encrypted in Secret Conversations). Even less so considering that they roll their own encryption (MTProto), while Facebook's Messenger uses Signal's protocol. Further info (which will also lead you to problems with their MTProto protocol, if you're interested): https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr...
  - ConsiderCrying 6y ago
    Can we stop using 6-year-old info for apps that get updated monthly? The problems they have with MTProto have been patched literally 5 years ago, the only other criticism comes from a direct competitor, and they recommend WhatsApp despite the fact that it's closed-source and nobody can verify if its encryption truly works. Facebook is planning to merge Messenger, WhatsApp and Instagram, which makes it even more awful of a choice.
    - input_sh 6y ago
      Fair point, but from my perspective, even if it was absolutely the best end-to-end encryption there is, it wouldn't mean much unless everyone's using Telegram for 1-to-1 communication using Secret Chats feature. > Some of its channels helped unconnected, scattered rallies mature into well-coordinated action. This line alone makes their encryption rather meaningless for this use case, since Secret Chats only work between two people.
      - skyyler 6y ago
        Which is why I'm confused people are even talking about their encryption in this thread. This has nothing to do with secure chats and everything to do with Telegram's Channels feature. But a ton of people that have never used Telegram nor read the article don't know that.
wintorez 6y ago
Telegram has a feature that I really like. It allows you to delete your messages from other people devices as well.
- iso8859-1 6y ago
  But there is an open source client. So it should be trivial to not actually delete, but instead log every attempt to delete.
  - godelski 6y ago
    I'm not sure what this has to do with anything. Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps and you're probably going to know if your friends do. The biggest use I see of bidirectional deletion is if you see your friends be picked up by a nefarious actor and you can delete the messages. This reduces the chance of self incrimination because you can probably delete the messages before the phone is cloned or the messages are saved in some way.
    - saagarjha 6y ago
      It has everything to do with this when the conversation is if the government is going to use your messages in the unencrypted channel to come after you. If your friends are picked up by a nefarious actor, you would have to know that they were–and also, you'd have to ensure that Telegram isn't keeping some sort of deletion log.
      - godelski 6y ago
        I want to repeat >> Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps The bidirectional part is helpful in the non-public channel context. How does this help? Why does this matter? Well you can keep a public face and a private face. Private channels, group chats with friends, or one on one messages you can be more open and use this tool. But this is normal. Everyone shows a different face in public than what they show to friends (offline!). > If your friends are picked up by a nefarious actor, you would have to know that they were Sure. But they're your friends. I don't know how you interact with your friends, but usually when I'm out with them I'm physically near them and know what they are doing. Chances are pretty high I'd know within a few hours if they got arrested/abducted. > you'd have to ensure that Telegram isn't keeping some sort of deletion log. This is a different issue and FWIW that's why I don't personally use Telegram. There's no verification so no trust. But that doesn't mean that the deletion tool can be useful in certain contexts if the implementation is correct. No reason to throw the baby out with the bath water. It is about the probability of reducing self incrimination, not guaranteeing.
commandlinefan 6y ago
So disappointing that true anonymous communication is technologically feasible but is only unavailable due to government intervention and public apathy.
- huhtenberg 6y ago
  The main issue is that any form of anonymous communication gets instantly abused for things that very few people are OK with. It's a classic Catch-22 and a very well-known at that.
  - maqp 6y ago
    There's also stuff like ISIS communication and CP in Telegram, so the disgusting stuff is where people are at, no matter what.
- suby 6y ago
  D
- maqp 6y ago
  This is not true at all. It's already available. https://cwtch.im/ https://cwtch.im/ https://briarproject.org/ https://briarproject.org/ https://ricochet.im/ https://ricochet.im/ https://github.com/maqp/tfc https://github.com/maqp/tfc
- swebs 6y ago
  How is it possible? You'd either have to give your IP address to the other person (Tox) or a central server (Telegram, Discord, etc).
pvg 6y ago
That can happen anywhere and not just with Telegram - imagine what a repressive government can do with a dump of GMail. Iran's a much bigger country with a regime much more capable and willing to use violence.
- sneak 6y ago
  Imagine how hard it must be to run a presidential campaign in the US when your incumbent opponent in an election controls the systems that get to read any message in GMail.
  - maqp 6y ago
    Explain how this works. A blue party voter writes to another blue party voter: Hey, let's vote blue this year. NSA that intercepts the message and __________.
    - pvg 6y ago
      The thing being suggested here is that the campaign of the incumbent is reading all the communications of the campaign of the challenger. I don't think anything of the sort actually happens or is really that easy to (completely secretly!) make happen, but that's the proposed scenario.
      - maqp 6y ago
        Ah you mean reading communications of the opposition. https://en.wikipedia.org/wiki/ECHELON#Public_disclosures_(1972%E2%80%932000) https://en.wikipedia.org/wiki/ECHELON#Public_disclosures_(19... discusses it: 'Congressional investigators determined that "targeting of US political figures would not occur by accident, but was designed into the system from the start."' So yeah that might still be going on. Signal etc. make it harder but it's not like the NSA isn't hacking endpoints so hard to say if it's actually secure. We can only hope the next Snowden will let us know if NSA's spying on the opposing political party.
        6y ago
deleted 6y ago
[deleted]
stjohnswarts 6y ago
I don't understand how they will get the chats except from individual phones. The convo is encrypted between telegram app and their servers and the servers aren't available to Bealrus' government officials, so how are they going to get the messages? Obviously they can if they're monitoring public group chats because all they have to do is join, but person to person or private groups, how are they going to get to those? Confiscate everyone's phones?
- BTCOG 6y ago
  They are not going to get them, and the people saying otherwise don't use Telegram, and/or do not know what they are arguing over;pedantry. Telegram works well. Anyone can start a private chat encrypted end-to-end, those messages only stay on the device, and you can set them to auto-delete from BOTH user devices in 3 seconds, 5, 10, 30 second, 1min, 1 hour, 1 day. Nobody at all is going to get those messages. Go ahead and wireshark your connection and start using Telegram.
  - ldarby 6y ago
    > wireshark your connection This isn't good advice for trying to show someone their messages aren't being sent in clear text. It could be encrypted using a weak cipher or have other implementation bugs that make it trivial for a nation state to decrypt it. You need to be able to look at the application's source code to tell what encryption it's using and if it's secure enough.
    - maqp 6y ago
      Wireshark would show group messages in Telegram are indeed encrypted. However, they are encrypted only in-transit, meaning the server will see 100% of group chats. This can not be trivially detected with wireshark hence the advice to use the analyzer is useless and downright dangerous. It's like using a radiation detector to find cancer.
  - Krasnol 6y ago
    > Anyone can start a private chat encrypted end-to-end, those messages only stay on the device, and you can set them to auto-delete from BOTH user devices in 3 seconds, 5, 10, 30 second, 1min, 1 hour, 1 day. Sure they can encrypt E2E but they don't. Most chats on Telegram are unencrypted. Huge channels like the one mentioned above are full of agents and nothing prevents them from taking screenshots. Don't spread false security.
BTCOG 6y ago
Telegram polls are anonymous. Messages are encrypted.
- maqp 6y ago
  Telegram knows who you are because you register with your phone number. Telegram group messages are not end-to-end encrypted. Telegram desktop messages are not end-to-end encrypted. Telegram's messages are never end-to-end encrypted by default. Now go away or I shall taunt you a second time.
  - BTCOG 6y ago
    I never replied as you simply restated plainly obvious information about Telegram. I'm intimately familiar with, and would not trust Bruce Schneier. It's not my first day in cryptography. What you've counterpointed doesn't exactly negate what I said. There are no Belarus state controlled or regionally located Telegram servers. I fully understand and take that risk that server side code is manipulable, and I also fully know they are able to edit open conversations from the server and this has been done. Still a better alternative to choose a foreign state adversarial network these days and to choose E2E and do as best you can to use a throwaway number than to choose something that's been gamed by your own state, for fun and for profit to eavesdrop all conversations out of the gate, or use backdoored WhatsApp. Choose all throwaway, blend in, and don't talk too much.
Balgair 6y ago
I agree that the danger is tremendous, but that is all the more reason to participate in changing the government. If you fear such a reprisal then in being afraid you have only your life to save. If you try and make it succeed then you have everything to gain. It is total gamble, but there seems to be little choice now for the Belorussian people: a chance at freedom or worse reprisals.
- rectang 6y ago
  Let's differentiate between the heroic individual activists striving against all odds, versus the technologists whose market-driven decisions ensure that the activists are betrayed to their oppressive governments.
  - biscotti 6y ago
    It's not so against the odds. The EU just implemented mass sanctions against Belarus and mobilised €53m to support agitators. Top politicians such as Varadkar tweet support. If Russia so overtly threw money at organising American riots it would be front page news. There's been a year of mass unrest and yellow vest riots in France yet Marcons junta still reigns supreme.
avodonosov 6y ago
People are not hiding. The news sites forums, where you need to validate your account with phone number, are full of anti-government comments. Also, the article is not about people exchanging messages, it's about telegram channels read by many.
gardaani 6y ago
Encryption isn't enough. They could just suspect or arrest anyone who has Telegram installed. Or they could check teleoperators' logs for anyone who has used Telegram during the past weeks. In Turkey, they arrested people who had the ByLock app installed. It didn't matter how people had used it. Having installed it was enough. https://en.wikipedia.org/wiki/ByLock_(application) https://en.wikipedia.org/wiki/ByLock_(application)
- nickflood 6y ago
  But Telegram is really popular. You can't do that if the number of people using telegram that day was literally 20% of the country's population.

mbowcutt 6y ago

I don't know too much about Telegram but isn't it encrypted?

mauflows 6y ago
I'm pretty sure Signal at least doesn't encrypt at rest on your phone. So the drive would have to be encrypted as well, which is not default on Android
- t0astbread 6y ago
  Apart from that, regardless if you're on Signal or Telegram if authorities get hold of a protester's identity on such an app and have the power to access the app's servers they can gradually uncover social networks by reading metadata (if I'm not mistaken).
  - voxic11 6y ago
    I think you are mistaken. Before your text is sent to Signal your sender information is encrypted with the receiver's public key. So while Signal's servers can see who to deliver the message to they cannot see who sent it. Only the receiving client can decrypt and authenticate the message. This feature was rolled out in late 2018 and is called "sealed sender". It was developed to prevent leakage of any social network information via the message metadata. But as far as I know Telegram has no equivalent feature.
    - t0astbread 6y ago
      Oh, that's nice! I didn't know that. Ammendment to my above statement: This does not apply to Signal.
    - maqp 6y ago
      "So while Signal's servers can see who to deliver the message to they cannot see who sent it." Why can't they look at the TCP headers of incoming packets to determine source-IP? Also, why can't they look at session identifier or signal ID like phone number to determine who the sender is?
      - voxic11 6y ago
        I assume if you are trying to hide your communications you aren't connecting directly to signals servers, so IP should get you nothing. There is no session identifier or signalID attached to your message, its contained within the encrypted part of the message so only the receiver can determine who the message was sent by. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
- seanieb 6y ago
  Signal is encrypted at rest. It uses a special encrypted version of Sqlite. https://www.zetetic.net/sqlcipher/ https://www.zetetic.net/sqlcipher/
- voxic11 6y ago
  Signal does encrypt your messages locally. Also Android supports file encryption you don't need to use full disk encryption anymore. Also I think the policy has changed in Android 10. > All compatible Android devices newly launching with Android Q are required to encrypt user data, with no exceptions.
  - upofadown 6y ago
    Signal traditionally had an easy to get encryption key for the local encryption. Now there is a PIN but I don't think it is any protection against having access to the disk. The signal people would prefer that that you deal with the end point security yourself, because they really can't do much there.
    - maqp 6y ago
      Indeed, the PIN is just for SVR. Exported message logs on Android use separate, client-generated, 30-digit, PINs. Unless the OS+HW provide API for some sort of TPM, it's not possible to provide strong protection for app databases without asking for strong password every time the app is opened. Android has had some sort of sandboxing for a while but it's not comparable to secure enclaves etc. AFAIK.
- boring_twenties 6y ago
  Android has encrypted storage by default since a few years ago. Of course, by default it uses a default key. But, the point is, enabling "encryption" just means changing that key, not reencrypting the entire device.
polyomino 6y ago
Not by default.
dgellow 6y ago
Not by default, no, because that has UX implications (e.g the chat will only be available on one on your device instead of being synced between all your devices). Though it’s quite easy to start an encrypted chat, and you can decide to have auto destructive messages.
lol2143651 6y ago
Well it's server software is closed-source, so you would never really know who has a backdoor. There are much better options than Telegram if you want real security. Signal for one.
BelleOfTheBall 6y ago
It is encrypted by default but end-to-end is only for calls and Secret Chats (one-on-one). You can delete any message at any time without a trace for both sides, which protesters often do, really don't think the government needs messages to pin a crime on them. Hell, they've pinned crimes on people for literally no reason before.
- vel0city 6y ago
  So when you try and go tell the other person's device to delete your message, how does it go into their iCloud backups and delete that message, or some other backup? Don't depend on asking someone else's device to delete the data as that data being gone.
  - BelleOfTheBall 6y ago
    Telegram doesn't store messages on the device, you don't need to "tell the other person's device" anything, it's deleted from the Telegram cloud.
    - throwaway8941 6y ago
      It is stored locally, although only temporarily. I rarely connect my phone to the internet and still can scroll through quite a bit of message history.
input_sh 6y ago
By default it's no more encrypted than HN (as in, traffic to their servers uses TLS, messages on the server are not encrypted at all). There's Secret Chats feature which they claim to be end-to-end encrypted, meaning that it's no more secure than Facebook's Messenger (also end-to-end encrypted in Secret Conversations). Even less so considering that they roll their own encryption (MTProto), while Facebook's Messenger uses Signal's protocol. Further info (which will also lead you to problems with their MTProto protocol, if you're interested): https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr...
- ConsiderCrying 6y ago
  Can we stop using 6-year-old info for apps that get updated monthly? The problems they have with MTProto have been patched literally 5 years ago, the only other criticism comes from a direct competitor, and they recommend WhatsApp despite the fact that it's closed-source and nobody can verify if its encryption truly works. Facebook is planning to merge Messenger, WhatsApp and Instagram, which makes it even more awful of a choice.
  - input_sh 6y ago
    Fair point, but from my perspective, even if it was absolutely the best end-to-end encryption there is, it wouldn't mean much unless everyone's using Telegram for 1-to-1 communication using Secret Chats feature. > Some of its channels helped unconnected, scattered rallies mature into well-coordinated action. This line alone makes their encryption rather meaningless for this use case, since Secret Chats only work between two people.
    - skyyler 6y ago
      Which is why I'm confused people are even talking about their encryption in this thread. This has nothing to do with secure chats and everything to do with Telegram's Channels feature. But a ton of people that have never used Telegram nor read the article don't know that.

wintorez 6y ago

Telegram has a feature that I really like. It allows you to delete your messages from other people devices as well.

iso8859-1 6y ago
But there is an open source client. So it should be trivial to not actually delete, but instead log every attempt to delete.
- godelski 6y ago
  I'm not sure what this has to do with anything. Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps and you're probably going to know if your friends do. The biggest use I see of bidirectional deletion is if you see your friends be picked up by a nefarious actor and you can delete the messages. This reduces the chance of self incrimination because you can probably delete the messages before the phone is cloned or the messages are saved in some way.
  - saagarjha 6y ago
    It has everything to do with this when the conversation is if the government is going to use your messages in the unencrypted channel to come after you. If your friends are picked up by a nefarious actor, you would have to know that they were–and also, you'd have to ensure that Telegram isn't keeping some sort of deletion log.
    - godelski 6y ago
      I want to repeat >> Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps The bidirectional part is helpful in the non-public channel context. How does this help? Why does this matter? Well you can keep a public face and a private face. Private channels, group chats with friends, or one on one messages you can be more open and use this tool. But this is normal. Everyone shows a different face in public than what they show to friends (offline!). > If your friends are picked up by a nefarious actor, you would have to know that they were Sure. But they're your friends. I don't know how you interact with your friends, but usually when I'm out with them I'm physically near them and know what they are doing. Chances are pretty high I'd know within a few hours if they got arrested/abducted. > you'd have to ensure that Telegram isn't keeping some sort of deletion log. This is a different issue and FWIW that's why I don't personally use Telegram. There's no verification so no trust. But that doesn't mean that the deletion tool can be useful in certain contexts if the implementation is correct. No reason to throw the baby out with the bath water. It is about the probability of reducing self incrimination, not guaranteeing.

commandlinefan 6y ago

So disappointing that true anonymous communication is technologically feasible but is only unavailable due to government intervention and public apathy.

huhtenberg 6y ago
The main issue is that any form of anonymous communication gets instantly abused for things that very few people are OK with. It's a classic Catch-22 and a very well-known at that.
- maqp 6y ago
  There's also stuff like ISIS communication and CP in Telegram, so the disgusting stuff is where people are at, no matter what.
suby 6y ago
D
maqp 6y ago
This is not true at all. It's already available. https://cwtch.im/ https://cwtch.im/ https://briarproject.org/ https://briarproject.org/ https://ricochet.im/ https://ricochet.im/ https://github.com/maqp/tfc https://github.com/maqp/tfc
swebs 6y ago
How is it possible? You'd either have to give your IP address to the other person (Tox) or a central server (Telegram, Discord, etc).

pvg 6y ago

That can happen anywhere and not just with Telegram - imagine what a repressive government can do with a dump of GMail. Iran's a much bigger country with a regime much more capable and willing to use violence.

sneak 6y ago
Imagine how hard it must be to run a presidential campaign in the US when your incumbent opponent in an election controls the systems that get to read any message in GMail.
- maqp 6y ago
  Explain how this works. A blue party voter writes to another blue party voter: Hey, let's vote blue this year. NSA that intercepts the message and __________.
  - pvg 6y ago
    The thing being suggested here is that the campaign of the incumbent is reading all the communications of the campaign of the challenger. I don't think anything of the sort actually happens or is really that easy to (completely secretly!) make happen, but that's the proposed scenario.
    - maqp 6y ago
      Ah you mean reading communications of the opposition. https://en.wikipedia.org/wiki/ECHELON#Public_disclosures_(1972%E2%80%932000) https://en.wikipedia.org/wiki/ECHELON#Public_disclosures_(19... discusses it: 'Congressional investigators determined that "targeting of US political figures would not occur by accident, but was designed into the system from the start."' So yeah that might still be going on. Signal etc. make it harder but it's not like the NSA isn't hacking endpoints so hard to say if it's actually secure. We can only hope the next Snowden will let us know if NSA's spying on the opposing political party.
      - 6y ago

deleted 6y ago

[deleted]

stjohnswarts 6y ago

I don't understand how they will get the chats except from individual phones. The convo is encrypted between telegram app and their servers and the servers aren't available to Bealrus' government officials, so how are they going to get the messages? Obviously they can if they're monitoring public group chats because all they have to do is join, but person to person or private groups, how are they going to get to those? Confiscate everyone's phones?

BTCOG 6y ago
They are not going to get them, and the people saying otherwise don't use Telegram, and/or do not know what they are arguing over;pedantry. Telegram works well. Anyone can start a private chat encrypted end-to-end, those messages only stay on the device, and you can set them to auto-delete from BOTH user devices in 3 seconds, 5, 10, 30 second, 1min, 1 hour, 1 day. Nobody at all is going to get those messages. Go ahead and wireshark your connection and start using Telegram.
- ldarby 6y ago
  > wireshark your connection This isn't good advice for trying to show someone their messages aren't being sent in clear text. It could be encrypted using a weak cipher or have other implementation bugs that make it trivial for a nation state to decrypt it. You need to be able to look at the application's source code to tell what encryption it's using and if it's secure enough.
  - maqp 6y ago
    Wireshark would show group messages in Telegram are indeed encrypted. However, they are encrypted only in-transit, meaning the server will see 100% of group chats. This can not be trivially detected with wireshark hence the advice to use the analyzer is useless and downright dangerous. It's like using a radiation detector to find cancer.
- Krasnol 6y ago
  > Anyone can start a private chat encrypted end-to-end, those messages only stay on the device, and you can set them to auto-delete from BOTH user devices in 3 seconds, 5, 10, 30 second, 1min, 1 hour, 1 day. Sure they can encrypt E2E but they don't. Most chats on Telegram are unencrypted. Huge channels like the one mentioned above are full of agents and nothing prevents them from taking screenshots. Don't spread false security.

BTCOG 6y ago

Telegram polls are anonymous. Messages are encrypted.

maqp 6y ago
Telegram knows who you are because you register with your phone number. Telegram group messages are not end-to-end encrypted. Telegram desktop messages are not end-to-end encrypted. Telegram's messages are never end-to-end encrypted by default. Now go away or I shall taunt you a second time.
- BTCOG 6y ago
  I never replied as you simply restated plainly obvious information about Telegram. I'm intimately familiar with, and would not trust Bruce Schneier. It's not my first day in cryptography. What you've counterpointed doesn't exactly negate what I said. There are no Belarus state controlled or regionally located Telegram servers. I fully understand and take that risk that server side code is manipulable, and I also fully know they are able to edit open conversations from the server and this has been done. Still a better alternative to choose a foreign state adversarial network these days and to choose E2E and do as best you can to use a throwaway number than to choose something that's been gamed by your own state, for fun and for profit to eavesdrop all conversations out of the gate, or use backdoored WhatsApp. Choose all throwaway, blend in, and don't talk too much.

Balgair 6y ago

I agree that the danger is tremendous, but that is all the more reason to participate in changing the government. If you fear such a reprisal then in being afraid you have only your life to save. If you try and make it succeed then you have everything to gain. It is total gamble, but there seems to be little choice now for the Belorussian people: a chance at freedom or worse reprisals.

rectang 6y ago
Let's differentiate between the heroic individual activists striving against all odds, versus the technologists whose market-driven decisions ensure that the activists are betrayed to their oppressive governments.
- biscotti 6y ago
  It's not so against the odds. The EU just implemented mass sanctions against Belarus and mobilised €53m to support agitators. Top politicians such as Varadkar tweet support. If Russia so overtly threw money at organising American riots it would be front page news. There's been a year of mass unrest and yellow vest riots in France yet Marcons junta still reigns supreme.

avodonosov 6y ago

People are not hiding. The news sites forums, where you need to validate your account with phone number, are full of anti-government comments. Also, the article is not about people exchanging messages, it's about telegram channels read by many.

gardaani 6y ago

Encryption isn't enough. They could just suspect or arrest anyone who has Telegram installed. Or they could check teleoperators' logs for anyone who has used Telegram during the past weeks. In Turkey, they arrested people who had the ByLock app installed. It didn't matter how people had used it. Having installed it was enough. https://en.wikipedia.org/wiki/ByLock_(application) https://en.wikipedia.org/wiki/ByLock_(application)

nickflood 6y ago
But Telegram is really popular. You can't do that if the number of people using telegram that day was literally 20% of the country's population.