5 ms·

I went in hard with email security a year or so ago. In the end I decided it was a broken system if security is the goal. I signed up for Hey and have really be

I went in hard with email security a year or so ago. In the end I decided it was a broken system if security is the goal. I signed up for Hey and have really been enjoying it. I keep any secure comms on more secure platforms like Signal or Telegram.

icelancer 6y ago
Yeah this is what I settled on as well. I still use GMail and PGP for those very few who are willing to go the extra route (like 2 people I know), but use it unencrypted 99.9999% of the time, and secure comms go out over Signal.
- triyambakam 6y ago
  But PGP doesn't offer forward encryption, does it?
soziawa 6y ago
Telegram shouldn't be considered secure due to the lack of e2e encryption by default.
- theshrike79 6y ago
  Because 99% of people will choose the option with better UX instead of E2E. I can grab any device (laptop, phone, tablet) and continue my group chats in Telegram. E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson.
  - dchest 6y ago
    Nope, there are plenty of chats with e2ee and all the conveniences you’re mentioned.
    - dgellow 6y ago
      Do you have examples? A chat application that has E2E and also let you carry your conversations between devices, that doesn't require you to pass through your mobile the way WhatsApp do it?
      - AnonHP 6y ago
        Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats. Even Signal Desktop does not require the communication to pass through the phone (or even to have the phone around after setup). WhatsApp is the odd one in this respect.
        dgellow 6y ago
        How does Wire do it? Regarding Signal, they say this on their website: > Signal Desktop is a Chrome app which links with your phone, so all incoming and outgoing messages are displayed consistently on all your devices. https://signal.org/blog/signal-desktop/ https://signal.org/blog/signal-desktop/ That seems similar to what WhatsApp does, but I haven’t tried myself. Do you have more details on how that would work without passing by the mobile app?
        int_19h 6y ago
        It links to your phone to authenticate you. But from there, all messages are sent and received directly from the servers to all clients. So if your phone is off, but your desktop is on, the desktop client still receives them. The catch is that if your desktop is off, it won't be able to "catch up" later on any messages that it missed. Although I don't see why that's impossible to implement in principle.
      - WGH_ 6y ago
        Matrix as well. https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
  - AnonHP 6y ago
    > E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson. Not necessarily. It is hard, but Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats.
- t0astbread 6y ago
  Depends on if you can talk your contacts into using it. What I'm more worried about (as a Telegram user) is the lack of metadata protection (contacts stored on the server for example).
- dgellow 6y ago
  That's nonsense, security isn't only about E2E. Telegram is encrypted between clients and their servers, and are stored encrypted in their cloud services (at least if we trust what they say), a defaults that trade some level of privacy/security in exchange of a better UX, but you can decide to do the opposite trade by creating E2E discussions. How does that make their system not secure?

icelancer 6y ago

Yeah this is what I settled on as well. I still use GMail and PGP for those very few who are willing to go the extra route (like 2 people I know), but use it unencrypted 99.9999% of the time, and secure comms go out over Signal.

triyambakam 6y ago
But PGP doesn't offer forward encryption, does it?

soziawa 6y ago

Telegram shouldn't be considered secure due to the lack of e2e encryption by default.

theshrike79 6y ago
Because 99% of people will choose the option with better UX instead of E2E. I can grab any device (laptop, phone, tablet) and continue my group chats in Telegram. E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson.
- dchest 6y ago
  Nope, there are plenty of chats with e2ee and all the conveniences you’re mentioned.
  - dgellow 6y ago
    Do you have examples? A chat application that has E2E and also let you carry your conversations between devices, that doesn't require you to pass through your mobile the way WhatsApp do it?
    - AnonHP 6y ago
      Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats. Even Signal Desktop does not require the communication to pass through the phone (or even to have the phone around after setup). WhatsApp is the odd one in this respect.
      - dgellow 6y ago
        How does Wire do it? Regarding Signal, they say this on their website: > Signal Desktop is a Chrome app which links with your phone, so all incoming and outgoing messages are displayed consistently on all your devices. https://signal.org/blog/signal-desktop/ https://signal.org/blog/signal-desktop/ That seems similar to what WhatsApp does, but I haven’t tried myself. Do you have more details on how that would work without passing by the mobile app?
        int_19h 6y ago
        It links to your phone to authenticate you. But from there, all messages are sent and received directly from the servers to all clients. So if your phone is off, but your desktop is on, the desktop client still receives them. The catch is that if your desktop is off, it won't be able to "catch up" later on any messages that it missed. Although I don't see why that's impossible to implement in principle.
    - WGH_ 6y ago
      Matrix as well. https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
- AnonHP 6y ago
  > E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson. Not necessarily. It is hard, but Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats.
t0astbread 6y ago
Depends on if you can talk your contacts into using it. What I'm more worried about (as a Telegram user) is the lack of metadata protection (contacts stored on the server for example).
dgellow 6y ago
That's nonsense, security isn't only about E2E. Telegram is encrypted between clients and their servers, and are stored encrypted in their cloud services (at least if we trust what they say), a defaults that trade some level of privacy/security in exchange of a better UX, but you can decide to do the opposite trade by creating E2E discussions. How does that make their system not secure?