8 ms·

Telegram has a feature that I really like. It allows you to delete your messages from other people devices as well.

iso8859-1 6y ago
But there is an open source client. So it should be trivial to not actually delete, but instead log every attempt to delete.
- godelski 6y ago
  I'm not sure what this has to do with anything. Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps and you're probably going to know if your friends do. The biggest use I see of bidirectional deletion is if you see your friends be picked up by a nefarious actor and you can delete the messages. This reduces the chance of self incrimination because you can probably delete the messages before the phone is cloned or the messages are saved in some way.
  - saagarjha 6y ago
    It has everything to do with this when the conversation is if the government is going to use your messages in the unencrypted channel to come after you. If your friends are picked up by a nefarious actor, you would have to know that they were–and also, you'd have to ensure that Telegram isn't keeping some sort of deletion log.
    - godelski 6y ago
      I want to repeat >> Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps The bidirectional part is helpful in the non-public channel context. How does this help? Why does this matter? Well you can keep a public face and a private face. Private channels, group chats with friends, or one on one messages you can be more open and use this tool. But this is normal. Everyone shows a different face in public than what they show to friends (offline!). > If your friends are picked up by a nefarious actor, you would have to know that they were Sure. But they're your friends. I don't know how you interact with your friends, but usually when I'm out with them I'm physically near them and know what they are doing. Chances are pretty high I'd know within a few hours if they got arrested/abducted. > you'd have to ensure that Telegram isn't keeping some sort of deletion log. This is a different issue and FWIW that's why I don't personally use Telegram. There's no verification so no trust. But that doesn't mean that the deletion tool can be useful in certain contexts if the implementation is correct. No reason to throw the baby out with the bath water. It is about the probability of reducing self incrimination, not guaranteeing.
      - saagarjha 6y ago
        I certainly do not know what my friends are doing 24/7, perhaps not even within a day or two. And that's plenty of time for law enforcement to install a third-party client on their phone, or just read the messages. I agree that having it is better than not having it, but I would not put too much faith in it being useful against law enforcement. Perhaps retracting a mistakenly sent message, but not much more than that.
        godelski 6y ago
        I feel like you're being needlessly dense. The threat scenario is being at a protest with your friends, not some midnight abduction. And I'll I'm arguing is that it is better to have it than not have it because there's a __chance__. When it comes down to it every aspect of security and privacy is probabilistic. Security walls aren't impenetrable, but unlikely to be penetrated in a given time-frame. If it doesn't reduce the floor on security or privacy but increases the probabilistic upper bound, why not? So my complaint to Signal is why shoot yourself in the foot by limiting this to 1 hour? (24 if you run a custom app) There's a reason big companies/government employers want root access to your phone and will wipe data if it is lost or stolen. Because it reduces the chance that company/state secrets. No one thinks it is a guarantee. But if given the choice of "revealing a secret" vs "rolling a dice to see if I reveal a secret or not" I'm going with the latter no matter the odds.
godelski 6y ago
I have been frustrated with Signal on this. I pitched that it is a good idea because of a scenario: > You're protesting with people. Cops pick them up, but not you. You can delete their messages and it is likely that you are able to do so before the police can clone your phone or copy the messages (screenshot, whatever). I got a few strange responses back: - Deleting messages doesn't mean they can't be saved (yeah... this is probabilistic privacy, not guaranteed) - My device, my data (okay?) - Some people run custom apps that save everything (how does that apply here? Funny enough, a sibling comment said something similar) - Just own up to your typos (-_____-) - Don't use Signal for communication then because you can't be guaranteed privacy (great, I'll use smoke signals with my friends to organize) To be fair to Signal, the devs did not get into the forums. To also be fair, Signal is taking the same position and is going to only allow deletion an hour after a message was sent. As much as I love Signal, it is my preferred messaging app, I think they are not in touch with the needs of people. We should look at why people are turning to Telegram when protesting. What can we do to better preserve the privacy of people protesting in HK, Belarus, America, etc? Everything is probabilistic security and privacy when it comes down to it. But what tools would help these people the most? I would argue that bidirectional deletion to reduce the chance of self incrimination is one of them. The other is group messaging, channels, and anonymous messages (so your phone number isn't visible in channels). Emojis are nice and fun for day to day use, but it is getting more and more important to push these other features (yes, I know they are extremely difficult to do and actually preserve privacy to the standard Signal currently does. I think many would be fine if it was an incremental increase in privacy with these newer features).
- johnchristopher 6y ago
  I was pitching the following idea to a friend of mine yesterday: - the UI should hide e2e/“reallyprivate” conversations by default - as in "not visible anywhere" (edit: unless the app is in the foreground and you are chatting of course) Unless you: - do the “add a new user/conversation" - then instead of adding mail/GUID/phone you add a whatevercanberemembered number/emoji/sentence that unlocks the private conversation you initiated long before There should be no trace in the UI that private conversations are going on. What does HN think ? Why hasn't it been done before ? Edit: there could even be notifications disguised as another app (news subscriptions, medical reminders, battery low, etc.)
shawnz 6y ago
Whatsapp also has this useful feature, and it also provides always-on E2E encryption unlike Telegram.

But there is an open source client. So it should be trivial to not actually delete, but instead log every attempt to delete.

godelski 6y ago
I'm not sure what this has to do with anything. Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps and you're probably going to know if your friends do. The biggest use I see of bidirectional deletion is if you see your friends be picked up by a nefarious actor and you can delete the messages. This reduces the chance of self incrimination because you can probably delete the messages before the phone is cloned or the messages are saved in some way.
- saagarjha 6y ago
  It has everything to do with this when the conversation is if the government is going to use your messages in the unencrypted channel to come after you. If your friends are picked up by a nefarious actor, you would have to know that they were–and also, you'd have to ensure that Telegram isn't keeping some sort of deletion log.
  - godelski 6y ago
    I want to repeat >> Sure, maybe this doesn't help you in a channel, but one on one? Or small groups? Most people don't run custom apps The bidirectional part is helpful in the non-public channel context. How does this help? Why does this matter? Well you can keep a public face and a private face. Private channels, group chats with friends, or one on one messages you can be more open and use this tool. But this is normal. Everyone shows a different face in public than what they show to friends (offline!). > If your friends are picked up by a nefarious actor, you would have to know that they were Sure. But they're your friends. I don't know how you interact with your friends, but usually when I'm out with them I'm physically near them and know what they are doing. Chances are pretty high I'd know within a few hours if they got arrested/abducted. > you'd have to ensure that Telegram isn't keeping some sort of deletion log. This is a different issue and FWIW that's why I don't personally use Telegram. There's no verification so no trust. But that doesn't mean that the deletion tool can be useful in certain contexts if the implementation is correct. No reason to throw the baby out with the bath water. It is about the probability of reducing self incrimination, not guaranteeing.
    - saagarjha 6y ago
      I certainly do not know what my friends are doing 24/7, perhaps not even within a day or two. And that's plenty of time for law enforcement to install a third-party client on their phone, or just read the messages. I agree that having it is better than not having it, but I would not put too much faith in it being useful against law enforcement. Perhaps retracting a mistakenly sent message, but not much more than that.
      - godelski 6y ago
        I feel like you're being needlessly dense. The threat scenario is being at a protest with your friends, not some midnight abduction. And I'll I'm arguing is that it is better to have it than not have it because there's a __chance__. When it comes down to it every aspect of security and privacy is probabilistic. Security walls aren't impenetrable, but unlikely to be penetrated in a given time-frame. If it doesn't reduce the floor on security or privacy but increases the probabilistic upper bound, why not? So my complaint to Signal is why shoot yourself in the foot by limiting this to 1 hour? (24 if you run a custom app) There's a reason big companies/government employers want root access to your phone and will wipe data if it is lost or stolen. Because it reduces the chance that company/state secrets. No one thinks it is a guarantee. But if given the choice of "revealing a secret" vs "rolling a dice to see if I reveal a secret or not" I'm going with the latter no matter the odds.

godelski 6y ago

I have been frustrated with Signal on this. I pitched that it is a good idea because of a scenario: > You're protesting with people. Cops pick them up, but not you. You can delete their messages and it is likely that you are able to do so before the police can clone your phone or copy the messages (screenshot, whatever). I got a few strange responses back: - Deleting messages doesn't mean they can't be saved (yeah... this is probabilistic privacy, not guaranteed) - My device, my data (okay?) - Some people run custom apps that save everything (how does that apply here? Funny enough, a sibling comment said something similar) - Just own up to your typos (-_____-) - Don't use Signal for communication then because you can't be guaranteed privacy (great, I'll use smoke signals with my friends to organize) To be fair to Signal, the devs did not get into the forums. To also be fair, Signal is taking the same position and is going to only allow deletion an hour after a message was sent. As much as I love Signal, it is my preferred messaging app, I think they are not in touch with the needs of people. We should look at why people are turning to Telegram when protesting. What can we do to better preserve the privacy of people protesting in HK, Belarus, America, etc? Everything is probabilistic security and privacy when it comes down to it. But what tools would help these people the most? I would argue that bidirectional deletion to reduce the chance of self incrimination is one of them. The other is group messaging, channels, and anonymous messages (so your phone number isn't visible in channels). Emojis are nice and fun for day to day use, but it is getting more and more important to push these other features (yes, I know they are extremely difficult to do and actually preserve privacy to the standard Signal currently does. I think many would be fine if it was an incremental increase in privacy with these newer features).

johnchristopher 6y ago
I was pitching the following idea to a friend of mine yesterday: - the UI should hide e2e/“reallyprivate” conversations by default - as in "not visible anywhere" (edit: unless the app is in the foreground and you are chatting of course) Unless you: - do the “add a new user/conversation" - then instead of adding mail/GUID/phone you add a whatevercanberemembered number/emoji/sentence that unlocks the private conversation you initiated long before There should be no trace in the UI that private conversations are going on. What does HN think ? Why hasn't it been done before ? Edit: there could even be notifications disguised as another app (news subscriptions, medical reminders, battery low, etc.)

shawnz 6y ago

Whatsapp also has this useful feature, and it also provides always-on E2E encryption unlike Telegram.