4 ms·

When you realize end-to-end encryption is a necessary property of all features, you realize Telegram lacks even basic things like desktop clients, syncable chat

by maqp 6y ago

When you realize end-to-end encryption is a necessary property of all features, you realize Telegram lacks even basic things like desktop clients, syncable chats, and group chats. Not so feature rich anymore ;)

deathtrader666 6y ago
Telegram has desktop clients, syncable chats, and groups chats since ages..
eitland 6y ago
E2E-encryption is really nice but not anymore necessary for most users of Telegram than for - WhatsApp before they implemented it - GMail (or any other mail service) - Matrix (by default, until recently?) - IRC - SMS - Letters in the mail For some reason this has a tendency to boil down very quickly to - E2E-encryptet === good, no further information needed - anything else === bad, no further information needed Which obviously isn't the whole truth: It is far less likely give you trouble - if you receive a stream of unencrypted postcards from Grandma on vacation - than it is if you send and receive perfectly encrypted messages to/from a criminal mastermind over a channel that leaks metadata or by default backs up your data to any mainstream cloud provider. The availability of metadata, who can access that metadata etc etc plays a role. Telegram has significant problems, as far as I know both technically and also at higher levels, but for some reason someone always have to pull the E2E: Good, anything else: Bad. That isn't useful.
- maqp 6y ago
  "- if you receive a stream of unencrypted postcards from Grandma on vacation" That's such a bullshit excuse. Everything goes with outer layer of encryption these days, what matters is will Telegram offer to lock themselves out of the messages to which the answer is no by default. If you want to chat on desktop or create a group, the answer is no whether you like it or not. So again, some niché use case of "it's probably nothing sensitive so you might as well send it in the clear because that says you're not a dissident" is thus not even valid. There's almost always outer layer of encryption. "The availability of metadata, who can access that metadata etc etc plays a role." Indeed. All the more reason to avoid Telegram that by default stores all that metadata. "someone always have to pull the E2E: Good, anything else: Bad." No the point is we'll never even get to the debate on reducing metadata as long as we need to play whack-a-mole with shit apps like Telegram that don't E2EE by default, let alone provide any kind of metadata protection, even sealed sender like Signal does. As the author of messaging system[1] that provides both E2EE by default for everything as well as metadata protection (more than any other app out there) and advanced protections like endpoint security, I don't really like you putting me into some square of caring only about E2EE. All I can say to you is, first things first. [1] https://github.com/maqp/tfc https://github.com/maqp/tfc
- mcsoft 6y ago
  Since E2E encryption is not enabled by default in Telegram, I believe it's used by 2% of their users at most. Messages of the rest can be read by Telegram team. https://www.google.com/search?newwindow=1&q=are+telegram+chats+e2e+encrypted+by+default https://www.google.com/search?newwindow=1&q=are+telegram+cha...
  - eitland 6y ago
    > Since E2E encryption is not enabled by default in Telegram, I believe it's used by 2% of their users at most. You are probably answering another post here. I don't think it is intentional. > Messages of the rest can be read by Telegram team. Well, there are a number of ways to prevent that from happening easily. I cannot verify this, but Telegram said years ago that they solved certain problems by routing keys and messages through different datacenters in different jurisdictions. That said: the big question is if their solutions work and if it works that way? I don't know, they seem remarkable competent at certain aspects of what they do and other times I feel they suffer from the same thing that Elon Musk sometimes suffer from where they publicly state things that sound immediately unreasonable. But that would be meaningful criticism so probably off topic in a Telegram bashing contest ;-)
    - maqp 6y ago
      "I cannot verify this, but Telegram said years ago that they solved certain problems by routing keys and messages through different datacenters in different jurisdictions." Firstly, there is no proof of this happening. I've been looking for the documentation and/or source code for this for more than five years now, and it's never been published. Secondly, even IF it was happening, the server that strips the in-transit encryption has access to the plaintext, and can copy the message to anywhere it damn pleases. It can write it to "plaintext-messages.txt" for all it cares, that's like two lines of Python in the backend. Also, the servers creating database entries must by definition have the full database encryption key in its RAM, from where privileged processes can exfiltrate it (computer organization 101). The thing is, there isn't technology out there that allows Telegram to do what it claims as securely as it claims. If they are indeed innovating on this, why aren't they publishing their research and proving their worth? "they seem remarkable competent at certain aspects of what they do" Yeah, you can be great at UX design and shitty at cryptography. That's perfectly fine. The fact they won't spend money to hire competent cryptographers is the shitty part. I don't know if it's this Russian pride wrt. Nikolai being an award winning mathematician, or if they don't really give a fuck and think damage control can mend the damage that resulted from nepotism. Well, the first time they get hacked properly shows how shit the architecture was. We can only hope people will then ask "ok where the fuck did we go wrong, again, can we switch to something that fixed this once and for all", and that by then, Signal is usable enough for their needs.
jcelerier 6y ago
> you realize Telegram lacks even basic things like desktop clients the desktop client of telegram is the main reason to use it over the competition for me. something that does not lag when you type text or resize its window, opens in a quarter of second, etc etc
miki123211 6y ago
Not official, but Unigram for Windows 10 is the way to go for me. It has everything it should have and is not Electron. The best app of this kind there is at the moment. I'm not affiliated with Unigram in any way, just a happy user.
- maqp 6y ago
  It's the vendor that should be releasing the clients with support for it. The fact it's a third party is both a problem and proof of huge internal problem.
- fuzxi 6y ago
  By the way, the official client doesn't use Electron either - it uses qt.

by maqp 6y ago

deathtrader666 6y ago

Telegram has desktop clients, syncable chats, and groups chats since ages..

eitland 6y ago

E2E-encryption is really nice but not anymore necessary for most users of Telegram than for - WhatsApp before they implemented it - GMail (or any other mail service) - Matrix (by default, until recently?) - IRC - SMS - Letters in the mail For some reason this has a tendency to boil down very quickly to - E2E-encryptet === good, no further information needed - anything else === bad, no further information needed Which obviously isn't the whole truth: It is far less likely give you trouble - if you receive a stream of unencrypted postcards from Grandma on vacation - than it is if you send and receive perfectly encrypted messages to/from a criminal mastermind over a channel that leaks metadata or by default backs up your data to any mainstream cloud provider. The availability of metadata, who can access that metadata etc etc plays a role. Telegram has significant problems, as far as I know both technically and also at higher levels, but for some reason someone always have to pull the E2E: Good, anything else: Bad. That isn't useful.

maqp 6y ago
"- if you receive a stream of unencrypted postcards from Grandma on vacation" That's such a bullshit excuse. Everything goes with outer layer of encryption these days, what matters is will Telegram offer to lock themselves out of the messages to which the answer is no by default. If you want to chat on desktop or create a group, the answer is no whether you like it or not. So again, some niché use case of "it's probably nothing sensitive so you might as well send it in the clear because that says you're not a dissident" is thus not even valid. There's almost always outer layer of encryption. "The availability of metadata, who can access that metadata etc etc plays a role." Indeed. All the more reason to avoid Telegram that by default stores all that metadata. "someone always have to pull the E2E: Good, anything else: Bad." No the point is we'll never even get to the debate on reducing metadata as long as we need to play whack-a-mole with shit apps like Telegram that don't E2EE by default, let alone provide any kind of metadata protection, even sealed sender like Signal does. As the author of messaging system[1] that provides both E2EE by default for everything as well as metadata protection (more than any other app out there) and advanced protections like endpoint security, I don't really like you putting me into some square of caring only about E2EE. All I can say to you is, first things first. [1] https://github.com/maqp/tfc https://github.com/maqp/tfc
mcsoft 6y ago
Since E2E encryption is not enabled by default in Telegram, I believe it's used by 2% of their users at most. Messages of the rest can be read by Telegram team. https://www.google.com/search?newwindow=1&q=are+telegram+chats+e2e+encrypted+by+default https://www.google.com/search?newwindow=1&q=are+telegram+cha...
- eitland 6y ago
  > Since E2E encryption is not enabled by default in Telegram, I believe it's used by 2% of their users at most. You are probably answering another post here. I don't think it is intentional. > Messages of the rest can be read by Telegram team. Well, there are a number of ways to prevent that from happening easily. I cannot verify this, but Telegram said years ago that they solved certain problems by routing keys and messages through different datacenters in different jurisdictions. That said: the big question is if their solutions work and if it works that way? I don't know, they seem remarkable competent at certain aspects of what they do and other times I feel they suffer from the same thing that Elon Musk sometimes suffer from where they publicly state things that sound immediately unreasonable. But that would be meaningful criticism so probably off topic in a Telegram bashing contest ;-)
  - maqp 6y ago
    "I cannot verify this, but Telegram said years ago that they solved certain problems by routing keys and messages through different datacenters in different jurisdictions." Firstly, there is no proof of this happening. I've been looking for the documentation and/or source code for this for more than five years now, and it's never been published. Secondly, even IF it was happening, the server that strips the in-transit encryption has access to the plaintext, and can copy the message to anywhere it damn pleases. It can write it to "plaintext-messages.txt" for all it cares, that's like two lines of Python in the backend. Also, the servers creating database entries must by definition have the full database encryption key in its RAM, from where privileged processes can exfiltrate it (computer organization 101). The thing is, there isn't technology out there that allows Telegram to do what it claims as securely as it claims. If they are indeed innovating on this, why aren't they publishing their research and proving their worth? "they seem remarkable competent at certain aspects of what they do" Yeah, you can be great at UX design and shitty at cryptography. That's perfectly fine. The fact they won't spend money to hire competent cryptographers is the shitty part. I don't know if it's this Russian pride wrt. Nikolai being an award winning mathematician, or if they don't really give a fuck and think damage control can mend the damage that resulted from nepotism. Well, the first time they get hacked properly shows how shit the architecture was. We can only hope people will then ask "ok where the fuck did we go wrong, again, can we switch to something that fixed this once and for all", and that by then, Signal is usable enough for their needs.

jcelerier 6y ago

> you realize Telegram lacks even basic things like desktop clients the desktop client of telegram is the main reason to use it over the competition for me. something that does not lag when you type text or resize its window, opens in a quarter of second, etc etc

miki123211 6y ago

Not official, but Unigram for Windows 10 is the way to go for me. It has everything it should have and is not Electron. The best app of this kind there is at the moment. I'm not affiliated with Unigram in any way, just a happy user.

maqp 6y ago
It's the vendor that should be releasing the clients with support for it. The fact it's a third party is both a problem and proof of huge internal problem.
fuzxi 6y ago
By the way, the official client doesn't use Electron either - it uses qt.