5 ms·

Downgrade in terms of privacy from WhatsApp? Some explanation is needed for such a bold statement.

by damidekronik 6y ago

arghwhat 6y ago
Much worse protocol, but much better company.
- levosmetalo 6y ago
  ... but still a company that you have to "trust". I'd rather have a protocol that will allow me to not trust anyone and still be secure/private by default.
  - arghwhat 6y ago
    Then use neither. No protocol allows you to not trust the implementor, and WhatsApp has shown signs of accessing keys.
minitech 6y ago
I think they’re referring to the encryption. Group chats can’t be encrypted end-to-end, direct messages aren’t by default, and the direct messages that are encrypted (”secret chats”) aren’t available on the desktop client.
approxim8ion 6y ago
I'm referring to two things(although really just one) here - WhatsApp claims to store messages only as long as they are undelivered, after which they are purged from their servers. Even if they are retained, they are e2e encrypted. Telegram on the other hand, from what I can see, store all messages in plaintext or in an encrypted-at-rest form where they control and have access to the keys. It comes down to whether I trust them, and I have no reason to. - Tying back into the encryption point, in the event of a breach or an MITM, whoever intercepts or accesses WhatsApp messages will get encrypted dumps, while my Telegram messages are pretty much going to be in plaintext.
- approxim8ion 6y ago
  Also adding to this, there is certainly more nuance to it and WhatsApp is certainly far from perfect in that you still trust them to implement E2EE correctly without incompetence or malice, and then there's the whole other issue of their cloud backups being entirely unencrypted by design. Thankfully the latter can be turned off for now.
- fsflover 6y ago
  > they are e2e encrypted Only if you trust Facebook with their proprietary software. And on Telegram you can easily export your history at any time and delete from the servers.
  - approxim8ion 6y ago
    Covered your first point in my other comment here: https://news.ycombinator.com/item?id=25670543 https://news.ycombinator.com/item?id=25670543. Not copy-pasting because I don't want to come off as spammy. Isn't MTProto proprietary as well? Also, the option to delete on a periodic basis is not an alternative to not having things stored in the first place. That said, there is no way you can verify that copies are not retained on the servers in either case (WhatsApp or Telegram) so there's not much to argue there.
    - fsflover 6y ago
      > Isn't MTProto proprietary as well? Clients are open-source, so you can see the code for e2e encryption. > That said, there is no way you can verify that copies are not retained on the servers in either case (WhatsApp or Telegram) so there's not much to argue there. This is exactly true, so I actually prefer Matrix.
      - approxim8ion 6y ago
        > Clients are open-source, so you can see the code for e2e encryption. Cool. Unfortunately the cases where it's applicable are too limited for my liking. > Matrix. Matrix is great, I just wish I had more luck onboarding my network onto it. I really enjoy using Element.
thekyle 6y ago
IMO Telegram is more similar to Facebook Messenger than WhatsApp from a security and privacy standpoint. Both do not use end-to-end encryption by default (but both have a separate end-to-end encrypted private chat mode).

Downgrade in terms of privacy from WhatsApp? Some explanation is needed for such a bold statement.

arghwhat 6y ago

Much worse protocol, but much better company.

levosmetalo 6y ago
... but still a company that you have to "trust". I'd rather have a protocol that will allow me to not trust anyone and still be secure/private by default.
- arghwhat 6y ago
  Then use neither. No protocol allows you to not trust the implementor, and WhatsApp has shown signs of accessing keys.

minitech 6y ago

I think they’re referring to the encryption. Group chats can’t be encrypted end-to-end, direct messages aren’t by default, and the direct messages that are encrypted (”secret chats”) aren’t available on the desktop client.

approxim8ion 6y ago

I'm referring to two things(although really just one) here - WhatsApp claims to store messages only as long as they are undelivered, after which they are purged from their servers. Even if they are retained, they are e2e encrypted. Telegram on the other hand, from what I can see, store all messages in plaintext or in an encrypted-at-rest form where they control and have access to the keys. It comes down to whether I trust them, and I have no reason to. - Tying back into the encryption point, in the event of a breach or an MITM, whoever intercepts or accesses WhatsApp messages will get encrypted dumps, while my Telegram messages are pretty much going to be in plaintext.

approxim8ion 6y ago
Also adding to this, there is certainly more nuance to it and WhatsApp is certainly far from perfect in that you still trust them to implement E2EE correctly without incompetence or malice, and then there's the whole other issue of their cloud backups being entirely unencrypted by design. Thankfully the latter can be turned off for now.
fsflover 6y ago
> they are e2e encrypted Only if you trust Facebook with their proprietary software. And on Telegram you can easily export your history at any time and delete from the servers.
- approxim8ion 6y ago
  Covered your first point in my other comment here: https://news.ycombinator.com/item?id=25670543 https://news.ycombinator.com/item?id=25670543. Not copy-pasting because I don't want to come off as spammy. Isn't MTProto proprietary as well? Also, the option to delete on a periodic basis is not an alternative to not having things stored in the first place. That said, there is no way you can verify that copies are not retained on the servers in either case (WhatsApp or Telegram) so there's not much to argue there.
  - fsflover 6y ago
    > Isn't MTProto proprietary as well? Clients are open-source, so you can see the code for e2e encryption. > That said, there is no way you can verify that copies are not retained on the servers in either case (WhatsApp or Telegram) so there's not much to argue there. This is exactly true, so I actually prefer Matrix.
    - approxim8ion 6y ago
      > Clients are open-source, so you can see the code for e2e encryption. Cool. Unfortunately the cases where it's applicable are too limited for my liking. > Matrix. Matrix is great, I just wish I had more luck onboarding my network onto it. I really enjoy using Element.

thekyle 6y ago

IMO Telegram is more similar to Facebook Messenger than WhatsApp from a security and privacy standpoint. Both do not use end-to-end encryption by default (but both have a separate end-to-end encrypted private chat mode).