4 ms·

Telegram shouldn't be considered secure due to the lack of e2e encryption by default.

theshrike79 6y ago
Because 99% of people will choose the option with better UX instead of E2E. I can grab any device (laptop, phone, tablet) and continue my group chats in Telegram. E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson.
- dchest 6y ago
  Nope, there are plenty of chats with e2ee and all the conveniences you’re mentioned.
  - dgellow 6y ago
    Do you have examples? A chat application that has E2E and also let you carry your conversations between devices, that doesn't require you to pass through your mobile the way WhatsApp do it?
    - AnonHP 6y ago
      Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats. Even Signal Desktop does not require the communication to pass through the phone (or even to have the phone around after setup). WhatsApp is the odd one in this respect.
      - dgellow 6y ago
        How does Wire do it? Regarding Signal, they say this on their website: > Signal Desktop is a Chrome app which links with your phone, so all incoming and outgoing messages are displayed consistently on all your devices. https://signal.org/blog/signal-desktop/ https://signal.org/blog/signal-desktop/ That seems similar to what WhatsApp does, but I haven’t tried myself. Do you have more details on how that would work without passing by the mobile app?
        int_19h 6y ago
        It links to your phone to authenticate you. But from there, all messages are sent and received directly from the servers to all clients. So if your phone is off, but your desktop is on, the desktop client still receives them. The catch is that if your desktop is off, it won't be able to "catch up" later on any messages that it missed. Although I don't see why that's impossible to implement in principle.
    - WGH_ 6y ago
      Matrix as well. https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
  - theshrike79 6y ago
    I would like an example of even one of these, please? Especially how they handle E2E encryption between multiple devices owned by the same user, without using one device as proxy.
    - dchest 6y ago
      Wire, Viber, iMessage, Keybase, Signal. Here’s how Wire works https://wire-docs.wire.com/download/Wire+Security+Whitepaper.pdf https://wire-docs.wire.com/download/Wire+Security+Whitepaper... Here’s Signal’s multi device protocol https://signal.org/docs/specifications/sesame/ https://signal.org/docs/specifications/sesame/ Here’s Viber’s security white paper https://www.viber.com/app/uploads/Viber-Encryption-Overview.pdf https://www.viber.com/app/uploads/Viber-Encryption-Overview....
- AnonHP 6y ago
  > E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson. Not necessarily. It is hard, but Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats.
t0astbread 6y ago
Depends on if you can talk your contacts into using it. What I'm more worried about (as a Telegram user) is the lack of metadata protection (contacts stored on the server for example).
dgellow 6y ago
That's nonsense, security isn't only about E2E. Telegram is encrypted between clients and their servers, and are stored encrypted in their cloud services (at least if we trust what they say), a defaults that trade some level of privacy/security in exchange of a better UX, but you can decide to do the opposite trade by creating E2E discussions. How does that make their system not secure?

Because 99% of people will choose the option with better UX instead of E2E. I can grab any device (laptop, phone, tablet) and continue my group chats in Telegram. E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson.

dchest 6y ago
Nope, there are plenty of chats with e2ee and all the conveniences you’re mentioned.
- dgellow 6y ago
  Do you have examples? A chat application that has E2E and also let you carry your conversations between devices, that doesn't require you to pass through your mobile the way WhatsApp do it?
  - AnonHP 6y ago
    Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats. Even Signal Desktop does not require the communication to pass through the phone (or even to have the phone around after setup). WhatsApp is the odd one in this respect.
    - dgellow 6y ago
      How does Wire do it? Regarding Signal, they say this on their website: > Signal Desktop is a Chrome app which links with your phone, so all incoming and outgoing messages are displayed consistently on all your devices. https://signal.org/blog/signal-desktop/ https://signal.org/blog/signal-desktop/ That seems similar to what WhatsApp does, but I haven’t tried myself. Do you have more details on how that would work without passing by the mobile app?
      - int_19h 6y ago
        It links to your phone to authenticate you. But from there, all messages are sent and received directly from the servers to all clients. So if your phone is off, but your desktop is on, the desktop client still receives them. The catch is that if your desktop is off, it won't be able to "catch up" later on any messages that it missed. Although I don't see why that's impossible to implement in principle.
  - WGH_ 6y ago
    Matrix as well. https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
- theshrike79 6y ago
  I would like an example of even one of these, please? Especially how they handle E2E encryption between multiple devices owned by the same user, without using one device as proxy.
  - dchest 6y ago
    Wire, Viber, iMessage, Keybase, Signal. Here’s how Wire works https://wire-docs.wire.com/download/Wire+Security+Whitepaper.pdf https://wire-docs.wire.com/download/Wire+Security+Whitepaper... Here’s Signal’s multi device protocol https://signal.org/docs/specifications/sesame/ https://signal.org/docs/specifications/sesame/ Here’s Viber’s security white paper https://www.viber.com/app/uploads/Viber-Encryption-Overview.pdf https://www.viber.com/app/uploads/Viber-Encryption-Overview....
AnonHP 6y ago
> E2E would require me to use only one device for that specific chat, which is makes it really hard to explain to a layperson. Not necessarily. It is hard, but Wire (wire.com) has done it. You can install Wire on multiple devices and have the chats sync up. Every chat is E2E encrypted, one-to-one or group chats.

t0astbread 6y ago

Depends on if you can talk your contacts into using it. What I'm more worried about (as a Telegram user) is the lack of metadata protection (contacts stored on the server for example).

dgellow 6y ago

That's nonsense, security isn't only about E2E. Telegram is encrypted between clients and their servers, and are stored encrypted in their cloud services (at least if we trust what they say), a defaults that trade some level of privacy/security in exchange of a better UX, but you can decide to do the opposite trade by creating E2E discussions. How does that make their system not secure?