6 ms·

Telegram is a downgrade in terms of both security and privacy. Just leaving the comment for people who consider it. It's an excellent platform and a joy to use

Telegram is a downgrade in terms of both security and privacy. Just leaving the comment for people who consider it. It's an excellent platform and a joy to use but I personally refuse to use it.

artemonster 6y ago
how? I thought they where the first ones to implement e2e encryption?
- ivan_gammel 6y ago
  It is not default option there. End users need to always remember that they need to use „Secret chats“
- deleted 6y ago
  [deleted]
- arghwhat 6y ago
  - Weird hand-rolled crypto protocol of questionable quality (MTProto). Probably fine in practice, but leaves a bad taste in your mouth, and their marketing to prove it made it worse. It has been through a few revisions since initial scrutiny. - Only Secret Chats are E2EE. Normal use is just subject to transport encryption. However, this is true for any platform with server-side chat history.
  - piyushpr134 6y ago
    "leaves a bad taste in your mouth" - May be you should not try to eat a protocol ?
    - arghwhat 6y ago
      I'm unsure if you're unfamiliar with this phrasing or are simply trolling. If the latter, well played.
- guitarlimeo 6y ago
  Their e2e encryption only applies to 1-to-1 communication in the form of Secret Chats, which can be opened from a menu multiple clicks away. Default chats and group chats are not e2e encrypted and contents are fully visible to Telegram. This however enables lot of the features Telegram has that Whatsapp/Signal do not (seamless use with multiple clients, powerful search, history is retained after switching phones etc..)
- unixhero 6y ago
  They lied. Or are technically incompetent. Or both.
damidekronik 6y ago
Downgrade in terms of privacy from WhatsApp? Some explanation is needed for such a bold statement.
- arghwhat 6y ago
  Much worse protocol, but much better company.
  - levosmetalo 6y ago
    ... but still a company that you have to "trust". I'd rather have a protocol that will allow me to not trust anyone and still be secure/private by default.
    - arghwhat 6y ago
      Then use neither. No protocol allows you to not trust the implementor, and WhatsApp has shown signs of accessing keys.
- minitech 6y ago
  I think they’re referring to the encryption. Group chats can’t be encrypted end-to-end, direct messages aren’t by default, and the direct messages that are encrypted (”secret chats”) aren’t available on the desktop client.
- approxim8ion 6y ago
  I'm referring to two things(although really just one) here - WhatsApp claims to store messages only as long as they are undelivered, after which they are purged from their servers. Even if they are retained, they are e2e encrypted. Telegram on the other hand, from what I can see, store all messages in plaintext or in an encrypted-at-rest form where they control and have access to the keys. It comes down to whether I trust them, and I have no reason to. - Tying back into the encryption point, in the event of a breach or an MITM, whoever intercepts or accesses WhatsApp messages will get encrypted dumps, while my Telegram messages are pretty much going to be in plaintext.
tlarkworthy 6y ago
If it's good enough for organised criminals and to anger various governments, it's good enough for me
- lrvick 6y ago
  Don't forget Apple pressured Telegram to remove rooms or be banned. This type of pressure on centralized systems is exactly why it is unethical as technologists to suggest people centralize the internet. When you choose to send friends to centralized systems you are voting for the internet to have all the problems and advantages of dictatorships. When you support open decentralized protocols you get the problems and advantages of a democracy. Dictatorships can move fast and make sweeping changes. Look at China. Signal, Telegram, WhatsApp, iMessage are all examples of centralized walled gardens, aka dictatorships. They are all doomed to be co-opted into doing something you don't like at some point and you will have no recourse. Meanwhile we have decentralized systems like like HTTP, SMTP, and Matrix. Yes they move slower, are more fragmented, need long periods of carefully discussed and rolled out protocol changes and many implementations and servers to all agree on those to function. Decentralized control is messy, and good UX takes longer to materialize, but that is how the internet was built, and how we kept it from being controlled by a single ISP/Browser like AOL. If you want a modern e2e chat protocol that lets you use any client, server, operating system, or architecture you want and take your social graph with you when you change your mind on any of those things, where no one single entity can change the rules of the network for profit or other reasons... you are looking for Matrix.
  - theshrike79 6y ago
    > Don't forget Apple pressured Telegram to remove rooms or be banned. Apple pressured Telegram to remove specific posts. There was no way to stop spamming the posts, so they removed the whole channel because it was a lot easier.
- amitport 6y ago
  It's not really "good enough" for them. Some criminals seem to use it but it's just a matter of reputation. It doesn't offer any extra privacy over whatsapp.
nervousDev 6y ago
> Telegram is a downgrade in terms of both security and privacy Care to elaborate? Haven't heard/read anything that points in that direction. Except for the "nearby people" feature but that its up to you to enable.
- erinnh 6y ago
  Some people are annoyed that the end-to-end encryption isnt on by default. You have to enable it yourself if you want to use it. I agree its a downgrade in security. But I dont agree with it being a downgrade in privacy.
  - viraptor 6y ago
    By default anyone at telegram can read your messages. By default, nobody at Facebook can read your WhatsApp messages. Telegram is a privacy downgrade here.
    - erinnh 6y ago
      Can/Will is a difference. Especially when Facebook will definitely be using all the information it can get to sell profiles of me to others. Another point is to compartmentalize information shared. Id rather share my whole profile in parts to 100 different companies who all arent allowed to share it with each other, than all of it to one company.
    - lrvick 6y ago
      Facebook could push an update tomorrow that subtly modifies the RNG in a very difficult to detect way that allows them to easily brute force all messages. No published source code or alternative implementations so it may take months of RE to notice if it is ever noticed at all. If only a single party with no accountability controls your encryption keys with binaries they compiled from code they wrote that no one else can practically review with an undocumented protocol they can silently change or backdoor at any time, it is not end to end encryption. It is marketing. I hate and refuse to use Telegram like all centralized chat services and feel it is hostile to freedom, privacy, and security but unlike Signal, WhatsApp, iMessage and others Telegram at -least- lets independent third parties like F-droid compile and distribute binaries offering accountability for their E2E claims.
kome 6y ago
It's strange, because I would say Telegram is an upgrade both security and privacy. a. It doesn't require a cellphone always on (most important point for me) b. It's not run by Facebook, or any other FAANG c. It's not based in the USA d. It has a great UX.

Telegram is a downgrade in terms of both security and privacy. Just leaving the comment for people who consider it. It's an excellent platform and a joy to use but I personally refuse to use it.

artemonster 6y ago

how? I thought they where the first ones to implement e2e encryption?

ivan_gammel 6y ago
It is not default option there. End users need to always remember that they need to use „Secret chats“
deleted 6y ago
[deleted]
arghwhat 6y ago
- Weird hand-rolled crypto protocol of questionable quality (MTProto). Probably fine in practice, but leaves a bad taste in your mouth, and their marketing to prove it made it worse. It has been through a few revisions since initial scrutiny. - Only Secret Chats are E2EE. Normal use is just subject to transport encryption. However, this is true for any platform with server-side chat history.
- piyushpr134 6y ago
  "leaves a bad taste in your mouth" - May be you should not try to eat a protocol ?
  - arghwhat 6y ago
    I'm unsure if you're unfamiliar with this phrasing or are simply trolling. If the latter, well played.
guitarlimeo 6y ago
Their e2e encryption only applies to 1-to-1 communication in the form of Secret Chats, which can be opened from a menu multiple clicks away. Default chats and group chats are not e2e encrypted and contents are fully visible to Telegram. This however enables lot of the features Telegram has that Whatsapp/Signal do not (seamless use with multiple clients, powerful search, history is retained after switching phones etc..)
unixhero 6y ago
They lied. Or are technically incompetent. Or both.

damidekronik 6y ago

Downgrade in terms of privacy from WhatsApp? Some explanation is needed for such a bold statement.

arghwhat 6y ago
Much worse protocol, but much better company.
- levosmetalo 6y ago
  ... but still a company that you have to "trust". I'd rather have a protocol that will allow me to not trust anyone and still be secure/private by default.
  - arghwhat 6y ago
    Then use neither. No protocol allows you to not trust the implementor, and WhatsApp has shown signs of accessing keys.
minitech 6y ago
I think they’re referring to the encryption. Group chats can’t be encrypted end-to-end, direct messages aren’t by default, and the direct messages that are encrypted (”secret chats”) aren’t available on the desktop client.
approxim8ion 6y ago
I'm referring to two things(although really just one) here - WhatsApp claims to store messages only as long as they are undelivered, after which they are purged from their servers. Even if they are retained, they are e2e encrypted. Telegram on the other hand, from what I can see, store all messages in plaintext or in an encrypted-at-rest form where they control and have access to the keys. It comes down to whether I trust them, and I have no reason to. - Tying back into the encryption point, in the event of a breach or an MITM, whoever intercepts or accesses WhatsApp messages will get encrypted dumps, while my Telegram messages are pretty much going to be in plaintext.

tlarkworthy 6y ago

If it's good enough for organised criminals and to anger various governments, it's good enough for me

lrvick 6y ago
Don't forget Apple pressured Telegram to remove rooms or be banned. This type of pressure on centralized systems is exactly why it is unethical as technologists to suggest people centralize the internet. When you choose to send friends to centralized systems you are voting for the internet to have all the problems and advantages of dictatorships. When you support open decentralized protocols you get the problems and advantages of a democracy. Dictatorships can move fast and make sweeping changes. Look at China. Signal, Telegram, WhatsApp, iMessage are all examples of centralized walled gardens, aka dictatorships. They are all doomed to be co-opted into doing something you don't like at some point and you will have no recourse. Meanwhile we have decentralized systems like like HTTP, SMTP, and Matrix. Yes they move slower, are more fragmented, need long periods of carefully discussed and rolled out protocol changes and many implementations and servers to all agree on those to function. Decentralized control is messy, and good UX takes longer to materialize, but that is how the internet was built, and how we kept it from being controlled by a single ISP/Browser like AOL. If you want a modern e2e chat protocol that lets you use any client, server, operating system, or architecture you want and take your social graph with you when you change your mind on any of those things, where no one single entity can change the rules of the network for profit or other reasons... you are looking for Matrix.
- theshrike79 6y ago
  > Don't forget Apple pressured Telegram to remove rooms or be banned. Apple pressured Telegram to remove specific posts. There was no way to stop spamming the posts, so they removed the whole channel because it was a lot easier.
amitport 6y ago
It's not really "good enough" for them. Some criminals seem to use it but it's just a matter of reputation. It doesn't offer any extra privacy over whatsapp.

nervousDev 6y ago

> Telegram is a downgrade in terms of both security and privacy Care to elaborate? Haven't heard/read anything that points in that direction. Except for the "nearby people" feature but that its up to you to enable.

erinnh 6y ago
Some people are annoyed that the end-to-end encryption isnt on by default. You have to enable it yourself if you want to use it. I agree its a downgrade in security. But I dont agree with it being a downgrade in privacy.
- viraptor 6y ago
  By default anyone at telegram can read your messages. By default, nobody at Facebook can read your WhatsApp messages. Telegram is a privacy downgrade here.
  - erinnh 6y ago
    Can/Will is a difference. Especially when Facebook will definitely be using all the information it can get to sell profiles of me to others. Another point is to compartmentalize information shared. Id rather share my whole profile in parts to 100 different companies who all arent allowed to share it with each other, than all of it to one company.
  - lrvick 6y ago
    Facebook could push an update tomorrow that subtly modifies the RNG in a very difficult to detect way that allows them to easily brute force all messages. No published source code or alternative implementations so it may take months of RE to notice if it is ever noticed at all. If only a single party with no accountability controls your encryption keys with binaries they compiled from code they wrote that no one else can practically review with an undocumented protocol they can silently change or backdoor at any time, it is not end to end encryption. It is marketing. I hate and refuse to use Telegram like all centralized chat services and feel it is hostile to freedom, privacy, and security but unlike Signal, WhatsApp, iMessage and others Telegram at -least- lets independent third parties like F-droid compile and distribute binaries offering accountability for their E2E claims.

kome 6y ago

It's strange, because I would say Telegram is an upgrade both security and privacy. a. It doesn't require a cellphone always on (most important point for me) b. It's not run by Facebook, or any other FAANG c. It's not based in the USA d. It has a great UX.