5 ms·

Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know Whats

Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know WhatsApp is insecure while people sometimes act like Telegram is a secure platform.

Hnrobert42 6y ago
I’ve heard other folks say WhatsApp is insecure. Do you (or anyone else) have specific examples or concerns?
- deleted 6y ago
  [deleted]
- marta_morena_9 6y ago
  Like... Facebook can read all your messages? The encryption only protects you from entities that are not Facebook. With that out of the door, it's not really worth it to even consider other angles of attack, since you now depend on the goodwill of a billion dollar company whose sole purpose and reason for existence is to extract and monetize your data. WhatsApp is a nice chat tool, but it's nothing you should ever use for secure communication. Sending a letter via mail is more safe.
  - srockets 6y ago
    If they can, then either Facebook boldly lied about implementing end-to-end encryption[0], or found significant attack against the Signal protocol, which is considered quite safe. They do have access to the metadata, i.e. whom you messaged and when. -- [0] https://techcrunch.com/2016/04/05/whatsapp-completes-end-to-end-encryption-rollout/ https://techcrunch.com/2016/04/05/whatsapp-completes-end-to-...
  - kolmogorov 6y ago
    that's incorrect. WhatsApp is end to end encrypted using the signal technology as confirmed by moxie. are you suggesting Facebook tricked the signal team into believing that WhatsApp is using end to end encryption when it isn't? a source: https://signal.org/blog/there-is-no-whatsapp-backdoor/ https://signal.org/blog/there-is-no-whatsapp-backdoor/
    - meowface 6y ago
      Honest question, then: outside of things like ethical concerns about supporting Facebook, and some missing features like enabling a passphrase to open the app, why should anyone use Signal over WhatsApp? Given that WhatsApp has a better UI/UX and that the people you want to talk to are much more likely to have it, and it supports some things that Signal is known for like disappearing messages (though limited to 7 day expiry). I love Signal and all the work Moxie and his team have put into it and the protocol, so this isn't a diss to them, but just wondering what the disadvantages would be for someone just looking for an E2EE communication app. One difference I suppose would be that Facebook would have all the message metadata; just not the contents.
  - viraptor 6y ago
    > Facebook can read all your messages? Whatsapp still does E2E encryption. (Same as Signal) Facebook can't read your messages. (There's still the scenario of you getting a special version of the app with that functionality disabled of course) You can also enable notification for changed signatures, which I do see changing as people replace their phones.
- est31 6y ago
  WhatsApp lets you upload your chat history to either icloud or google's cloud offerings. Those backups are accessible to Apple/Google. Many people have enabled it, so if you are in any decently sized group chat you can basically assume it's available to Apple/Google, the people who hack them, and whomever they have data sharing contracts with. Personally I use Telegram because they don't mind non-official clients like the FOSS builds. Whatsapp on the other hand is known to ban non-official clients. API access isn't available either unless you are a big corporate user, at which point you need a facebook ads account and cooperate with some API reseller... no joke lol.
- j-james 6y ago
  Out of curiosity, how can end-to-end encryption be verified when both the clients and the servers are closed-source?
  - Hnrobert42 6y ago
    How can you know it’s not E2EE? The absence of evidence is not the evidence of absence, or something like that. I agree that closed source is harder to verify, but that’s not the same as insecure.
    - anoncake 6y ago
      If you can't verify your messages are E2EE, you have to trust the vendor. But if you trust the vendor, you don't need E2EE to begin with.
      - Hnrobert42 6y ago
        There are other threat actors than the vendor looking to compromise the confidentiality of your message.
        anoncake 6y ago
        Those actors don't have the vendor's encryption keys.
- deleted 6y ago
  [deleted]
wruza 6y ago
Which dark patterns exactly? I didn’t know that the described functionality even exists, and it is off on my phone. TG is one of the apps that implements 0 dark patterns, imo. By comparison, whatsapp regularily tries to cloud-ize me by making a backup and re-enter my personal data. I just tap “never”, “done” once a month, but it is annoying af when it happens at the incoming call. It also forced users to enter a status (but there was a bug that allowed to enter empty one). And if you have a sim-less device, it is such pita to install it there. No updates will be available, ofc.
sysashi 6y ago
Do you mind providing examples of "anti features and dark patterns"? Just curious
- KingMachiavelli 6y ago
  I would really prefer any location sharing feature to be something that ran on top of the communication platform rather than be a feature baked into the app. Create a generic information syncing mechanism for groups and let clients build features like location sharing on top of that. Location sharing seems so niche that bundling it into the client encourages poor opsec/privacy behavior. As I have heard, Telegram is unencrypted by default. Both WhatsApp and Telegram are poor at making this 100% clear 100% of the time despite privacy being a major purpose of the apps. I'll admit I really haven't used telegram much but WhatsApp encourages backing up chats to cloud storage. WhatsApp also only provides a single alert that a contact's security code has changed. It also doesn't encourage verifying the security code on the initial contact. i.e if someone out of the blue contacts you on WhatsApp the only security is the phone number.
nnx 6y ago
This is a common wrong understanding. WhatsApp is end-to-end encrypted by default (using same protocol as Signal) and there’s no way to disable encryption. On the other hand Telegram chats are by default unencrypted ... you have to specifically start a “Secret Chat” to benefit from end-to-end encryption.
- lynndotpy 6y ago
  Correction here, Telegram is using transport encryption, while Signal and WhatsApp use end-to-end encryption.
  - 7v3x3n3sem9vv 6y ago
    Addendum: Signal uses end-to-end encryption AND transport encryption.
- KingMachiavelli 6y ago
  Hmm, that's pretty interesting. Especially since even Matrix public channels (not sure if only by default or required but it seems like all public groups are plain text) are unencrypted.
Andrew_nenakhov 6y ago
The rich irony here is that Telegram, in fact, way less secure than WhatsApp, yet, it's users (wrongly) perceive it to be magically more secure. The reason why WhatsApp is more secure is simple: it uses e2ee for all chats, and consequently has issues with multudevice usage and chats syncing, while Telegram just stores all chats in its servers, sans so-called "Secure chats". (I'm yet to see one person who is using them to contact me)
- circularfoyers 6y ago
  I believe why Telegram is considered more secure is the source code for it's clients are open source. Which means it's possible to ascertain what the app is and isn't sending. You're not able to confidently verify that WhatsApp isn't doing more that it claims including verifying it's E2EE implementation.
  - Andrew_nenakhov 6y ago
    Not really. It's just marketing push that 'Telegram is the most secure messenger' that somehow does the job, and the unwitting public is happy to accept it as a fact. As of source code... do you really need a source code if you can login with just your username/password and instantly see all your chats? For anyone who has some remote understanding of the matter it clearly tells that chat history is stored on servers without meaningful encryption and that server owner can access all chat history at will.
- wruza 6y ago
  My entire company and tg-part of a friend circle uses them when needed. E.g. to discuss issues that contain private/financial details or something personal that is undesirable to leak to "third parties who ruin parties". Otoh, I wouldn't mind if my mile-long chat with IT buddy went entirely public, because we mostly discuss Web-tech, BTC and other sick jokes there. Personally I'd never bother to start a secret chat with a person that I don't trust enough anyway. Neither do I trust an e2e messenger that my country didn't even bother to "pucker" legally. >users (wrongly) perceive it to be magically more secure This is claimed often, but I'm yet to see these users. Do they really believe that, is it just tg opponent's agenda that became popular, or both?

Hnrobert42 6y ago

I’ve heard other folks say WhatsApp is insecure. Do you (or anyone else) have specific examples or concerns?

deleted 6y ago
[deleted]
marta_morena_9 6y ago
Like... Facebook can read all your messages? The encryption only protects you from entities that are not Facebook. With that out of the door, it's not really worth it to even consider other angles of attack, since you now depend on the goodwill of a billion dollar company whose sole purpose and reason for existence is to extract and monetize your data. WhatsApp is a nice chat tool, but it's nothing you should ever use for secure communication. Sending a letter via mail is more safe.
- srockets 6y ago
  If they can, then either Facebook boldly lied about implementing end-to-end encryption[0], or found significant attack against the Signal protocol, which is considered quite safe. They do have access to the metadata, i.e. whom you messaged and when. -- [0] https://techcrunch.com/2016/04/05/whatsapp-completes-end-to-end-encryption-rollout/ https://techcrunch.com/2016/04/05/whatsapp-completes-end-to-...
- kolmogorov 6y ago
  that's incorrect. WhatsApp is end to end encrypted using the signal technology as confirmed by moxie. are you suggesting Facebook tricked the signal team into believing that WhatsApp is using end to end encryption when it isn't? a source: https://signal.org/blog/there-is-no-whatsapp-backdoor/ https://signal.org/blog/there-is-no-whatsapp-backdoor/
  - meowface 6y ago
    Honest question, then: outside of things like ethical concerns about supporting Facebook, and some missing features like enabling a passphrase to open the app, why should anyone use Signal over WhatsApp? Given that WhatsApp has a better UI/UX and that the people you want to talk to are much more likely to have it, and it supports some things that Signal is known for like disappearing messages (though limited to 7 day expiry). I love Signal and all the work Moxie and his team have put into it and the protocol, so this isn't a diss to them, but just wondering what the disadvantages would be for someone just looking for an E2EE communication app. One difference I suppose would be that Facebook would have all the message metadata; just not the contents.
- viraptor 6y ago
  > Facebook can read all your messages? Whatsapp still does E2E encryption. (Same as Signal) Facebook can't read your messages. (There's still the scenario of you getting a special version of the app with that functionality disabled of course) You can also enable notification for changed signatures, which I do see changing as people replace their phones.
est31 6y ago
WhatsApp lets you upload your chat history to either icloud or google's cloud offerings. Those backups are accessible to Apple/Google. Many people have enabled it, so if you are in any decently sized group chat you can basically assume it's available to Apple/Google, the people who hack them, and whomever they have data sharing contracts with. Personally I use Telegram because they don't mind non-official clients like the FOSS builds. Whatsapp on the other hand is known to ban non-official clients. API access isn't available either unless you are a big corporate user, at which point you need a facebook ads account and cooperate with some API reseller... no joke lol.
j-james 6y ago
Out of curiosity, how can end-to-end encryption be verified when both the clients and the servers are closed-source?
- Hnrobert42 6y ago
  How can you know it’s not E2EE? The absence of evidence is not the evidence of absence, or something like that. I agree that closed source is harder to verify, but that’s not the same as insecure.
  - anoncake 6y ago
    If you can't verify your messages are E2EE, you have to trust the vendor. But if you trust the vendor, you don't need E2EE to begin with.
    - Hnrobert42 6y ago
      There are other threat actors than the vendor looking to compromise the confidentiality of your message.
      - anoncake 6y ago
        Those actors don't have the vendor's encryption keys.
deleted 6y ago
[deleted]

wruza 6y ago

Which dark patterns exactly? I didn’t know that the described functionality even exists, and it is off on my phone. TG is one of the apps that implements 0 dark patterns, imo. By comparison, whatsapp regularily tries to cloud-ize me by making a backup and re-enter my personal data. I just tap “never”, “done” once a month, but it is annoying af when it happens at the incoming call. It also forced users to enter a status (but there was a bug that allowed to enter empty one). And if you have a sim-less device, it is such pita to install it there. No updates will be available, ofc.

sysashi 6y ago

Do you mind providing examples of "anti features and dark patterns"? Just curious

KingMachiavelli 6y ago
I would really prefer any location sharing feature to be something that ran on top of the communication platform rather than be a feature baked into the app. Create a generic information syncing mechanism for groups and let clients build features like location sharing on top of that. Location sharing seems so niche that bundling it into the client encourages poor opsec/privacy behavior. As I have heard, Telegram is unencrypted by default. Both WhatsApp and Telegram are poor at making this 100% clear 100% of the time despite privacy being a major purpose of the apps. I'll admit I really haven't used telegram much but WhatsApp encourages backing up chats to cloud storage. WhatsApp also only provides a single alert that a contact's security code has changed. It also doesn't encourage verifying the security code on the initial contact. i.e if someone out of the blue contacts you on WhatsApp the only security is the phone number.

nnx 6y ago

This is a common wrong understanding. WhatsApp is end-to-end encrypted by default (using same protocol as Signal) and there’s no way to disable encryption. On the other hand Telegram chats are by default unencrypted ... you have to specifically start a “Secret Chat” to benefit from end-to-end encryption.

lynndotpy 6y ago
Correction here, Telegram is using transport encryption, while Signal and WhatsApp use end-to-end encryption.
- 7v3x3n3sem9vv 6y ago
  Addendum: Signal uses end-to-end encryption AND transport encryption.
KingMachiavelli 6y ago
Hmm, that's pretty interesting. Especially since even Matrix public channels (not sure if only by default or required but it seems like all public groups are plain text) are unencrypted.

Andrew_nenakhov 6y ago

The rich irony here is that Telegram, in fact, way less secure than WhatsApp, yet, it's users (wrongly) perceive it to be magically more secure. The reason why WhatsApp is more secure is simple: it uses e2ee for all chats, and consequently has issues with multudevice usage and chats syncing, while Telegram just stores all chats in its servers, sans so-called "Secure chats". (I'm yet to see one person who is using them to contact me)

circularfoyers 6y ago
I believe why Telegram is considered more secure is the source code for it's clients are open source. Which means it's possible to ascertain what the app is and isn't sending. You're not able to confidently verify that WhatsApp isn't doing more that it claims including verifying it's E2EE implementation.
- Andrew_nenakhov 6y ago
  Not really. It's just marketing push that 'Telegram is the most secure messenger' that somehow does the job, and the unwitting public is happy to accept it as a fact. As of source code... do you really need a source code if you can login with just your username/password and instantly see all your chats? For anyone who has some remote understanding of the matter it clearly tells that chat history is stored on servers without meaningful encryption and that server owner can access all chat history at will.
wruza 6y ago
My entire company and tg-part of a friend circle uses them when needed. E.g. to discuss issues that contain private/financial details or something personal that is undesirable to leak to "third parties who ruin parties". Otoh, I wouldn't mind if my mile-long chat with IT buddy went entirely public, because we mostly discuss Web-tech, BTC and other sick jokes there. Personally I'd never bother to start a secret chat with a person that I don't trust enough anyway. Neither do I trust an e2e messenger that my country didn't even bother to "pucker" legally. >users (wrongly) perceive it to be magically more secure This is claimed often, but I'm yet to see these users. Do they really believe that, is it just tg opponent's agenda that became popular, or both?