6 ms·

It's not surprising that every time Telegram pops up here, many comments miss the fact that Telegram has a great UX, a great feature set and also provides the k

It's not surprising that every time Telegram pops up here, many comments miss the fact that Telegram has a great UX, a great feature set and also provides the kind of privacy protestors value, i.e., not having their phone numbers flashed to every random stranger in groups or to random channel owners whose channels you've subscribed to. With Telegram you cannot even do a phone number enumeration attack (this can be changed in settings) by adding phone numbers to your contacts list to find out who's using it. And nope, Signal doesn't make the cut for the above reasons because it exposes your phone number to everyone else. WhatsApp is the same in this respect. Neither of them prevent enumeration attacks (they may slow that down a bit, but not sufficient enough to protect against state actors). Wire and Element (Matrix) are comparatively better than Telegram, Signal and WhatsApp because you don't need a phone number to sign up and they also have end to end encryption for all chats (with Element it's a bit more recent). Hopefully more people can soon ditch phone number based apps that cause them to be vulnerable because of that vector.

postmodernbrute 6y ago
Exactly - Telegram can be used for public gatherings precisely because one can stay anonymous. It's more like Discord in that respect. Wire is a bit of a mess. Client is buggy, cross-platform usage is difficult. At least that's my memory of it.
ffpip 6y ago
I love telegram. Great UI, feels natural to use it. And SO MANY features, it's hard to keep up. Unlimited storage helps too.
- maqp 6y ago
  When you realize end-to-end encryption is a necessary property of all features, you realize Telegram lacks even basic things like desktop clients, syncable chats, and group chats. Not so feature rich anymore ;)
  - deathtrader666 6y ago
    Telegram has desktop clients, syncable chats, and groups chats since ages..
  - eitland 6y ago
    E2E-encryption is really nice but not anymore necessary for most users of Telegram than for - WhatsApp before they implemented it - GMail (or any other mail service) - Matrix (by default, until recently?) - IRC - SMS - Letters in the mail For some reason this has a tendency to boil down very quickly to - E2E-encryptet === good, no further information needed - anything else === bad, no further information needed Which obviously isn't the whole truth: It is far less likely give you trouble - if you receive a stream of unencrypted postcards from Grandma on vacation - than it is if you send and receive perfectly encrypted messages to/from a criminal mastermind over a channel that leaks metadata or by default backs up your data to any mainstream cloud provider. The availability of metadata, who can access that metadata etc etc plays a role. Telegram has significant problems, as far as I know both technically and also at higher levels, but for some reason someone always have to pull the E2E: Good, anything else: Bad. That isn't useful.
    - maqp 6y ago
      "- if you receive a stream of unencrypted postcards from Grandma on vacation" That's such a bullshit excuse. Everything goes with outer layer of encryption these days, what matters is will Telegram offer to lock themselves out of the messages to which the answer is no by default. If you want to chat on desktop or create a group, the answer is no whether you like it or not. So again, some niché use case of "it's probably nothing sensitive so you might as well send it in the clear because that says you're not a dissident" is thus not even valid. There's almost always outer layer of encryption. "The availability of metadata, who can access that metadata etc etc plays a role." Indeed. All the more reason to avoid Telegram that by default stores all that metadata. "someone always have to pull the E2E: Good, anything else: Bad." No the point is we'll never even get to the debate on reducing metadata as long as we need to play whack-a-mole with shit apps like Telegram that don't E2EE by default, let alone provide any kind of metadata protection, even sealed sender like Signal does. As the author of messaging system[1] that provides both E2EE by default for everything as well as metadata protection (more than any other app out there) and advanced protections like endpoint security, I don't really like you putting me into some square of caring only about E2EE. All I can say to you is, first things first. [1] https://github.com/maqp/tfc https://github.com/maqp/tfc
smnscu 6y ago
Using Telegram is my guilty pleasure for sure. They just added video calling and it, like most of their other features, Just Works™. Just don't send your passwords or whatever to your Telegram buds and you should be alright. Funny enough, here in the UK Telegram is mostly associated with shady stuff like drug dealers.
- mohamez 6y ago
  >here in the UK Telegram is mostly associated with shady stuff like drug dealers. That's a price you surely have to pay for freedom and privacy, a knife can kill a person or cut a potato.
sneak 6y ago
I only see praise for Telegram, which is confusing, because it is unsafe snake oil. Don’t use Telegram.
- asutekku 6y ago
  It’s no more unsafe as using whatsapp or some other similar service. To be fair, if most of my relatives would not use whatsapp, i would’ve turned 100% telegram already.
  - tryptophan 6y ago
    People get super morally-puristic when it comes to chat app security for some reason. Telegram is no worse (or even might be better) than email, your banking website, facebook, your credit card, etc... It's 100% better than SMS though, which is completely unencrypted. I'd bet that for most people its an upgrade in security and privacy.
    - maqp 6y ago
      Facebook's Messenger app is TLS-encrypted (i.e. encryption happens between client and server) unless special E2EE mode with Signal protocol is enabled. Telegram is encrypted with client-server MTProto (i.e. encryption ALSO happens between client and server) unless their the special secret chat with its hand-rolled E2EE is enabled. In LTE networks SMS uses the SNOW3G[1] encryption between the cell-tower and phone. This is also equivalent to client-server encryption in that the server-side area covers the more or less TelCo side decentralized SS7 backbone where message travel more or less unencrypted. So by default with all three Telegram, Facebook, and SMS, all messages are readable by the vendor. Telegram and Facebook offer E2EE as an opt-in measure, but given that neither offers it for groups, they're not a viable option. Signal uses E2EE for everything, hence it's the recommendation by every security expert out there, nobody's recommending Telegram or Facebook. There's nothing puristic about expecting companies in 2020 to implement basic security like E2EE for everything, by default. After all, we're not talking about anything short from protecting universal human right to privacy here. [1] https://www.gsma.com/aboutus/wp-content/uploads/2014/12/snow3gspec.pdf https://www.gsma.com/aboutus/wp-content/uploads/2014/12/snow...
neop1x 6y ago
There is also less-known Briar project which is supposed to work over bluetooth as well https://briarproject.org/ https://briarproject.org/
aasasd 6y ago
> With Telegram you cannot even do a phone number enumeration attack (this can be changed in settings) by adding phone numbers to your contacts list to find out who's using it You mean how multiple companies have done on dozens of millions of accounts before Tg added that feature last year, and are openly selling that data? Like with that dump of 40 million numbers just from Iran and Russia. How often do you change your number?
maqp 6y ago
"And nope, Signal doesn't make the cut for the above reasons because it exposes your phone number to everyone else" This is being worked on. The thing is you're mixing two threat models. One is a creepy dude who will give you nightly calls if they learn your phone number. The other is a state actor who will hack the server and track you based on your IP-address if no phone number is being used otherwise: hence the enumeration attacks won't matter. You can't escape state actors looking at your metadata with Wire, Element or Signal. For that you want an Onion Service based system like Briar, Cwtch, Ricochet, or TFC. For the creepy people not having to hand out your phone number is a nicety, but it's not at all hard to block a phone number either, it works just like any other app's blacklist: just add the number and be done with it.
- dataflow 6y ago
  The "thing" is they're "mixing two threat models"? What does that mean? I feel like they have 1 threat model and the "thing" is you're trying to decompose it into a mixture of black and white....
- bobwernstein 6y ago
  phone numbers are shared in groups with tens of thousands of people. They spam, herass, hack etc. Forcing you to change your number.
  - maqp 6y ago
    Ah yes, the classic hacking someone with their phone number!
    - r3muxd 6y ago
      yes? just knowing a phone number is enough to log into a non-2fa google account if you know the pass, plus it can be easily triangulated to a real-world address
      - bobwernstein 6y ago
henriquemaia 6y ago
>Telegram has a great UX I was making this exact point today to a couple of friends. Telegram's features puts it way ahead of its competitors. While using it, I feel I'm charge and not the other way around (WhatsApp being the worst offender here). With the recent addition of video calls, and if you judged only by its feature set, it could arguably be called the best messaging app at the moment. As for countering the network effect, I do my part. I politely ask my acquaintances to message me through telegram for anything important.
hutzlibu 6y ago
The problem with telegram is, what is their buisnessmodell? There is none at the moment. Signal lives off donations. WhatsApp off the Facebook datagrabbing connection Matrix/Element from support/server renting But Telegramm has invested a lot, but received no money in return yet. So, I suppose the current plan is to get dominant and then .. ROI with who knows? I also use it right now. Creating and managing groups is easy. You can edit messages! It is fast and reliable. But I surely would not use it if I would be scared of the government.
- Shank 6y ago
  It used to be the TON Blockchain, but that got shut down. If you're not familiar, Telegram is the pet project of Pavel Durov, the founder and ex-CEO of VK, which is essentially the Russian version of Facebook. I have no idea what the future holds, but he's quite wealthy and has been really successful in the past, so I'm not fearing the future right now.
  - hutzlibu 6y ago
    I am aware. I even suspect he might have some idealism. But mark zuckerberg is also really successful and I still don't want him control my communication.
deleted 6y ago
[deleted]
miki123211 6y ago
> Telegram has a great UX, And a great bot API. It's literally one of the easiest to use APIs I've ever seen. If you need a home-made solution to control something from your phone or even get push notifications, a Telegram bot is the way to go. They also have an API which lets you make clients. That, on the other hand, is one of the worst APIs I've ever seen, but it exists, and you can't say that about most centralized and popular messaging solutions. Because of that API, there's a great client for Windows 10 called Unigram, which is much more pleasant to use than all those Electron apps. I suspect Unigram is the single reason why Telegram is so popular in the blind community, even though iOS accessibility is horrible, much worse than in most apps of this kind.
longtom 6y ago
Telegram has a weird contact syncing default option. I had two accounts with separate phone numbers, but it would nonetheless advertise newly joined Telegram users associated with the respective other account. I think people were also able to view the profile pics of both accounts(?).

postmodernbrute 6y ago

Exactly - Telegram can be used for public gatherings precisely because one can stay anonymous. It's more like Discord in that respect. Wire is a bit of a mess. Client is buggy, cross-platform usage is difficult. At least that's my memory of it.

ffpip 6y ago

I love telegram. Great UI, feels natural to use it. And SO MANY features, it's hard to keep up. Unlimited storage helps too.

maqp 6y ago
When you realize end-to-end encryption is a necessary property of all features, you realize Telegram lacks even basic things like desktop clients, syncable chats, and group chats. Not so feature rich anymore ;)
- deathtrader666 6y ago
  Telegram has desktop clients, syncable chats, and groups chats since ages..
- eitland 6y ago
  E2E-encryption is really nice but not anymore necessary for most users of Telegram than for - WhatsApp before they implemented it - GMail (or any other mail service) - Matrix (by default, until recently?) - IRC - SMS - Letters in the mail For some reason this has a tendency to boil down very quickly to - E2E-encryptet === good, no further information needed - anything else === bad, no further information needed Which obviously isn't the whole truth: It is far less likely give you trouble - if you receive a stream of unencrypted postcards from Grandma on vacation - than it is if you send and receive perfectly encrypted messages to/from a criminal mastermind over a channel that leaks metadata or by default backs up your data to any mainstream cloud provider. The availability of metadata, who can access that metadata etc etc plays a role. Telegram has significant problems, as far as I know both technically and also at higher levels, but for some reason someone always have to pull the E2E: Good, anything else: Bad. That isn't useful.
  - maqp 6y ago
    "- if you receive a stream of unencrypted postcards from Grandma on vacation" That's such a bullshit excuse. Everything goes with outer layer of encryption these days, what matters is will Telegram offer to lock themselves out of the messages to which the answer is no by default. If you want to chat on desktop or create a group, the answer is no whether you like it or not. So again, some niché use case of "it's probably nothing sensitive so you might as well send it in the clear because that says you're not a dissident" is thus not even valid. There's almost always outer layer of encryption. "The availability of metadata, who can access that metadata etc etc plays a role." Indeed. All the more reason to avoid Telegram that by default stores all that metadata. "someone always have to pull the E2E: Good, anything else: Bad." No the point is we'll never even get to the debate on reducing metadata as long as we need to play whack-a-mole with shit apps like Telegram that don't E2EE by default, let alone provide any kind of metadata protection, even sealed sender like Signal does. As the author of messaging system[1] that provides both E2EE by default for everything as well as metadata protection (more than any other app out there) and advanced protections like endpoint security, I don't really like you putting me into some square of caring only about E2EE. All I can say to you is, first things first. [1] https://github.com/maqp/tfc https://github.com/maqp/tfc

smnscu 6y ago

Using Telegram is my guilty pleasure for sure. They just added video calling and it, like most of their other features, Just Works™. Just don't send your passwords or whatever to your Telegram buds and you should be alright. Funny enough, here in the UK Telegram is mostly associated with shady stuff like drug dealers.

mohamez 6y ago
>here in the UK Telegram is mostly associated with shady stuff like drug dealers. That's a price you surely have to pay for freedom and privacy, a knife can kill a person or cut a potato.

sneak 6y ago

I only see praise for Telegram, which is confusing, because it is unsafe snake oil. Don’t use Telegram.

asutekku 6y ago
It’s no more unsafe as using whatsapp or some other similar service. To be fair, if most of my relatives would not use whatsapp, i would’ve turned 100% telegram already.
- tryptophan 6y ago
  People get super morally-puristic when it comes to chat app security for some reason. Telegram is no worse (or even might be better) than email, your banking website, facebook, your credit card, etc... It's 100% better than SMS though, which is completely unencrypted. I'd bet that for most people its an upgrade in security and privacy.
  - maqp 6y ago
    Facebook's Messenger app is TLS-encrypted (i.e. encryption happens between client and server) unless special E2EE mode with Signal protocol is enabled. Telegram is encrypted with client-server MTProto (i.e. encryption ALSO happens between client and server) unless their the special secret chat with its hand-rolled E2EE is enabled. In LTE networks SMS uses the SNOW3G[1] encryption between the cell-tower and phone. This is also equivalent to client-server encryption in that the server-side area covers the more or less TelCo side decentralized SS7 backbone where message travel more or less unencrypted. So by default with all three Telegram, Facebook, and SMS, all messages are readable by the vendor. Telegram and Facebook offer E2EE as an opt-in measure, but given that neither offers it for groups, they're not a viable option. Signal uses E2EE for everything, hence it's the recommendation by every security expert out there, nobody's recommending Telegram or Facebook. There's nothing puristic about expecting companies in 2020 to implement basic security like E2EE for everything, by default. After all, we're not talking about anything short from protecting universal human right to privacy here. [1] https://www.gsma.com/aboutus/wp-content/uploads/2014/12/snow3gspec.pdf https://www.gsma.com/aboutus/wp-content/uploads/2014/12/snow...

neop1x 6y ago

There is also less-known Briar project which is supposed to work over bluetooth as well https://briarproject.org/ https://briarproject.org/

aasasd 6y ago

> With Telegram you cannot even do a phone number enumeration attack (this can be changed in settings) by adding phone numbers to your contacts list to find out who's using it You mean how multiple companies have done on dozens of millions of accounts before Tg added that feature last year, and are openly selling that data? Like with that dump of 40 million numbers just from Iran and Russia. How often do you change your number?

maqp 6y ago

"And nope, Signal doesn't make the cut for the above reasons because it exposes your phone number to everyone else" This is being worked on. The thing is you're mixing two threat models. One is a creepy dude who will give you nightly calls if they learn your phone number. The other is a state actor who will hack the server and track you based on your IP-address if no phone number is being used otherwise: hence the enumeration attacks won't matter. You can't escape state actors looking at your metadata with Wire, Element or Signal. For that you want an Onion Service based system like Briar, Cwtch, Ricochet, or TFC. For the creepy people not having to hand out your phone number is a nicety, but it's not at all hard to block a phone number either, it works just like any other app's blacklist: just add the number and be done with it.

dataflow 6y ago
The "thing" is they're "mixing two threat models"? What does that mean? I feel like they have 1 threat model and the "thing" is you're trying to decompose it into a mixture of black and white....
bobwernstein 6y ago
phone numbers are shared in groups with tens of thousands of people. They spam, herass, hack etc. Forcing you to change your number.
- maqp 6y ago
  Ah yes, the classic hacking someone with their phone number!
  - r3muxd 6y ago
    yes? just knowing a phone number is enough to log into a non-2fa google account if you know the pass, plus it can be easily triangulated to a real-world address
    - bobwernstein 6y ago

henriquemaia 6y ago

>Telegram has a great UX I was making this exact point today to a couple of friends. Telegram's features puts it way ahead of its competitors. While using it, I feel I'm charge and not the other way around (WhatsApp being the worst offender here). With the recent addition of video calls, and if you judged only by its feature set, it could arguably be called the best messaging app at the moment. As for countering the network effect, I do my part. I politely ask my acquaintances to message me through telegram for anything important.

hutzlibu 6y ago

The problem with telegram is, what is their buisnessmodell? There is none at the moment. Signal lives off donations. WhatsApp off the Facebook datagrabbing connection Matrix/Element from support/server renting But Telegramm has invested a lot, but received no money in return yet. So, I suppose the current plan is to get dominant and then .. ROI with who knows? I also use it right now. Creating and managing groups is easy. You can edit messages! It is fast and reliable. But I surely would not use it if I would be scared of the government.

Shank 6y ago
It used to be the TON Blockchain, but that got shut down. If you're not familiar, Telegram is the pet project of Pavel Durov, the founder and ex-CEO of VK, which is essentially the Russian version of Facebook. I have no idea what the future holds, but he's quite wealthy and has been really successful in the past, so I'm not fearing the future right now.
- hutzlibu 6y ago
  I am aware. I even suspect he might have some idealism. But mark zuckerberg is also really successful and I still don't want him control my communication.

deleted 6y ago

[deleted]

miki123211 6y ago

> Telegram has a great UX, And a great bot API. It's literally one of the easiest to use APIs I've ever seen. If you need a home-made solution to control something from your phone or even get push notifications, a Telegram bot is the way to go. They also have an API which lets you make clients. That, on the other hand, is one of the worst APIs I've ever seen, but it exists, and you can't say that about most centralized and popular messaging solutions. Because of that API, there's a great client for Windows 10 called Unigram, which is much more pleasant to use than all those Electron apps. I suspect Unigram is the single reason why Telegram is so popular in the blind community, even though iOS accessibility is horrible, much worse than in most apps of this kind.

longtom 6y ago

Telegram has a weird contact syncing default option. I had two accounts with separate phone numbers, but it would nonetheless advertise newly joined Telegram users associated with the respective other account. I think people were also able to view the profile pics of both accounts(?).