13 ms·

As a reminder, Telegram groups are not encrypted at all, and 1:1 chats are not encrypted by default, so while WhatsApp might see your contacts, Telegram can see

As a reminder, Telegram groups are not encrypted at all, and 1:1 chats are not encrypted by default, so while WhatsApp might see your contacts, Telegram can see most of your messages.

ignoramous 6y ago
Not just see messages, but show you ads as well: https://news.ycombinator.com/item?id=25520200 https://news.ycombinator.com/item?id=25520200 Telegram's a down-right bad IM experience compared to WhatsApp despite Facebook's forced integration: You see ads and the chats aren't encrypted.
- stjo 6y ago
  Not true at all - you have no ads looking at your screen, neither chatting privately. Group/channel owners may choose to add ads, but you can always run your own client made to ignore them - telegram is open source.
  - ignoramous 6y ago
    Not showing you ads in 1:1 chat or in groups the maintainer has chose not to enable them in is different from, "I have your data ready to go for targeted advertisement". This is essentially the Google model. Your search queries and browsing history (and Android and Chrome) are essential to targeted ads shown on every website "the webmasters choose to enable them on".
    - ffpip 6y ago
      > This is essentially the Google model. What? Google uses all your info for creepy personalized ads. Telegram is showing the same ads to everyone in a channel. And it isn't in 1:1 chats cuz they're supposed to be non-intrusive and gives a feeling of privacy. Who is the 'maintainer'? Telegram is the only entity here.
      - ignoramous 6y ago
        The data is still on Telegram's servers, unencrypted. They may be doing ads in a channel/group, but I don't think for one second that's where they're going to stop now that they've entered that rabbit hole. By the time you'd realise, it'd be too late, since they've got your data on their servers, unencrypted. This is strictly worse than WhatsApp. https://gizmodo.com/the-dangers-of-techs-privacy-promises-1826236005 https://gizmodo.com/the-dangers-of-techs-privacy-promises-18...
        ffpip 6y ago
        > This is strictly worse than WhatsApp. How? Google has all the whatsapp chats via the drive backups which 98% of users enable. fake E2EE Telegram has an open API, alternative clients and free cloud storage. They explain very well why they didn't want to give misleading e2ee claims like whatsapp https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... It is open source.
- skrowl 6y ago
  This is false. No proposed ads in 1:1 or any size group chats, only large channels (which are like RSS feeds, you can join but not post). In addition 100% of Telegram traffic is encrypted over the wire (like this website, your bank, etc). The only difference with secret chats is that they're end to end encrypted. Signal is a very bad user experience if you use several devices (phone, tablet, home computer, work computer). Continuing a chat on a different device doesn't work nearly as well as on Telegram where it's flawless.
  - deepstack 6y ago
    Telegram NON Secrete Chat are not E2E.
    - ffpip 6y ago
      You just said the exact same thing as your parent comment in fewer words.
- scaladev 6y ago
  >bad IM experience compared to WhatsApp I'd say forcing me to type on a shitty tiny on-screen keyboard (or use a _browser_ while still keeping the network on my phone running) is such a terrible experience that literally everything else wins in comparison to this.
  - ignoramous 6y ago
    > ...literally everything else wins in comparison to this. I think you do realise that WhatsApp uses E2E and there's no way to do it any more securely unless the messages always go through your phone; and so, I believe you have already made a choice to use insecure services because "convenience", but in the context of current discussion (privacy and security), WhatsApp comes out superior despite Facebook's involvement. And that's saying something.
ryanlol 6y ago
Let’s not forget that Telegram backdoored their encrypted chat implementation and got caught.
- ffpip 6y ago
  Link.
  - coolspot 6y ago
    Best I can find with keywords “telegram” and “backdoor” is this article: https://socialbarrel.com/telegram-founder-makes-shocking-backdoor-claim-about-whatsapp/123202/ https://socialbarrel.com/telegram-founder-makes-shocking-bac... Which discusses how Telegram was banned in many countries for refusing cooperation while WhatsApp suspiciously was never banned, which could mean that WhatsApp gives governments everything they demand.
    - beagle3 6y ago
      I suspect the Google/Facebook deal for "free backup of WhatsApp chats on your Google account" is exactly that. WhatsApp had perfectly usable encrypted backup - which took up space on your Google backup. And then, all of a sudden, it wasn't encrypted and didn't take up space. But you don't have access to it yourself - only Google does (and WhatsApp if it is recovering). This is a perfect way to provide all the data to various governments for 99.9% of users, without killing the E2E encryption.
      - coolspot 6y ago
        Same situation with the iCloud backup on Apple iOS, AFAIK. WhatsApp backup in iCloud is not encrypted.
        beagle3 6y ago
        Is it user accessible at least? The Android backup is not.
s_dev 6y ago
As a reminder encrypted messages aren't easily searchable -- this is a simple trade off and not some dark pattern default. Many Telegram users are away of it's quirks and how it operates differently to other IMs. Any tool will do damage in the hands of a bad workman. A good way to infer Telegram is reliable is how many despotic tyrants and corrupt countries ban it.
- clankyclanker 6y ago
  > As a reminder encrypted messages aren't easily searchable That's false. Encrypted messages aren't searchable by third-parties. End-to-end encrypted messages are searchable by only the communicating parties regardless of where they're stored. There's also the issue of mirroring by third-parties, but then we're talking about data in transit versus at rest, your backup methods, and so forth. (And I don't have time to get into that this morning.)
  - aaomidi 6y ago
    Building and maintaining a super fast searching index on a phone is not an easy task or even doable. Telegram is used a lot in developing countries which are using phones made 3-7 years ago. Or phones that are made recently but with old chips and tech. Maintaining a search index across literally millions or billions (some groups are really really big) messages isn't something your phone can reasonably do. I do wish telegram was e2ee for IMs, but for groups and super groups and channels I don't particularly care.
    - Nitramp 6y ago
      Assuming a message is 200 bytes or so, searching millions of messages is trivially doable on your phone (200 MB full text index). Billions is pushing it a bit, but you can work around on the app level (e.g. only index the last month in high traffic groups).
      - aaomidi 6y ago
        How do you handle message history? Do you download every single old message to your device? Who hosts these messages? How are the backups handled?
eitland 6y ago
> As a reminder, Telegram groups are not encrypted at all, and 1:1 chats are not encrypted by default This isn't just misleading but actually plain wrong. Unless you want to tell my your internet banking is unencrypted too ;-) Edit: as seen downthread there a number of ways to make this more or less correct, but as it stand, and particularly with the "at all" at the end of one of the claims it is just plain wrong. > Telegram can see most of your messages. This part is technically correct however. Telegram says they taken steps to prevent rouge admins from seing it and to prevent themselves from being able to produce copies for governments, however there's no way for us to know if it was true then, if it is true now, if it is true in the future or at any point in between so worthless if you don't trust them. If this is a problem for you generally I recommend stop using email, stop sending letters etc and rely only on Signal or Matrix. For many of us however this is acceptable: we send letters or even post cards fully unencrypted fully aware that they might be read. We send mails fully aware that it can be read at any server from we send it to the one the recipient download it from. But for some reason the same level of security is deeply problematic when Telegram is mentioned.
- nebulous1 6y ago
  Although they're client/server encrypted, I think contextually it was obvious that the person was talking about end-to-end encryption. "Encrypted chat" means end-to-end encrypted, if it's used to mean client/server encrypted then that's misleading.
  - eitland 6y ago
    Encryped chat might mean E2E-encrypted yes, but even then why not add those four extra letters "E2E-" and make it obvious? Besides, here is what I replied to: > As a reminder, Telegram groups are not encrypted at all[...] (emphasis mine) This is very possible to misunderstand for someone who isn't aware and the result might easily be that they stay in their abusive relationship with WhatsApp because of such FUD. As can probably be seen from my comment history I'm no stranger to criticizing Telegram but we should stick to the facts. Facts matter.
    - 6y ago
jorvi 6y ago
Reminder: they both are encrypted, just not E2E. Telegram is not blasting your plaintext messages into the ether and then into their database.
gcblkjaidfj 6y ago
Whatsapp group messages are also not encrypted. I mean, it is, but with the server keys.
- graposaymaname 6y ago
  I don’t think so. It doesn’t use the double ratchet algorithm used in DMs but still the participants of the group formulate a secret key for the group and share this key with every participant using the more secure protocol. The key cannot be read by the server as it is shared using conventional E2EE. Refer this video from computerphile for more details. Start watching from 5:24. https://youtu.be/Q0_lcKrUdWg https://youtu.be/Q0_lcKrUdWg
- LurkersWillLurk 6y ago
  This isn't true at all. It uses Signal Protocol and is end-to-end encrypted.
  - dancemethis 6y ago
    It is proprietary, so there is no proof they didn't tamper with the code to appear to be working on clients. And chances are against the fragile link in the chain - the user.

As a reminder, Telegram groups are not encrypted at all, and 1:1 chats are not encrypted by default, so while WhatsApp might see your contacts, Telegram can see most of your messages.

ignoramous 6y ago

Not just see messages, but show you ads as well: https://news.ycombinator.com/item?id=25520200 https://news.ycombinator.com/item?id=25520200 Telegram's a down-right bad IM experience compared to WhatsApp despite Facebook's forced integration: You see ads and the chats aren't encrypted.

stjo 6y ago
Not true at all - you have no ads looking at your screen, neither chatting privately. Group/channel owners may choose to add ads, but you can always run your own client made to ignore them - telegram is open source.
- ignoramous 6y ago
  Not showing you ads in 1:1 chat or in groups the maintainer has chose not to enable them in is different from, "I have your data ready to go for targeted advertisement". This is essentially the Google model. Your search queries and browsing history (and Android and Chrome) are essential to targeted ads shown on every website "the webmasters choose to enable them on".
  - ffpip 6y ago
    > This is essentially the Google model. What? Google uses all your info for creepy personalized ads. Telegram is showing the same ads to everyone in a channel. And it isn't in 1:1 chats cuz they're supposed to be non-intrusive and gives a feeling of privacy. Who is the 'maintainer'? Telegram is the only entity here.
    - ignoramous 6y ago
      The data is still on Telegram's servers, unencrypted. They may be doing ads in a channel/group, but I don't think for one second that's where they're going to stop now that they've entered that rabbit hole. By the time you'd realise, it'd be too late, since they've got your data on their servers, unencrypted. This is strictly worse than WhatsApp. https://gizmodo.com/the-dangers-of-techs-privacy-promises-1826236005 https://gizmodo.com/the-dangers-of-techs-privacy-promises-18...
      - ffpip 6y ago
        > This is strictly worse than WhatsApp. How? Google has all the whatsapp chats via the drive backups which 98% of users enable. fake E2EE Telegram has an open API, alternative clients and free cloud storage. They explain very well why they didn't want to give misleading e2ee claims like whatsapp https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... It is open source.
skrowl 6y ago
This is false. No proposed ads in 1:1 or any size group chats, only large channels (which are like RSS feeds, you can join but not post). In addition 100% of Telegram traffic is encrypted over the wire (like this website, your bank, etc). The only difference with secret chats is that they're end to end encrypted. Signal is a very bad user experience if you use several devices (phone, tablet, home computer, work computer). Continuing a chat on a different device doesn't work nearly as well as on Telegram where it's flawless.
- deepstack 6y ago
  Telegram NON Secrete Chat are not E2E.
  - ffpip 6y ago
    You just said the exact same thing as your parent comment in fewer words.
scaladev 6y ago
>bad IM experience compared to WhatsApp I'd say forcing me to type on a shitty tiny on-screen keyboard (or use a _browser_ while still keeping the network on my phone running) is such a terrible experience that literally everything else wins in comparison to this.
- ignoramous 6y ago
  > ...literally everything else wins in comparison to this. I think you do realise that WhatsApp uses E2E and there's no way to do it any more securely unless the messages always go through your phone; and so, I believe you have already made a choice to use insecure services because "convenience", but in the context of current discussion (privacy and security), WhatsApp comes out superior despite Facebook's involvement. And that's saying something.

ryanlol 6y ago

Let’s not forget that Telegram backdoored their encrypted chat implementation and got caught.

ffpip 6y ago
Link.
- coolspot 6y ago
  Best I can find with keywords “telegram” and “backdoor” is this article: https://socialbarrel.com/telegram-founder-makes-shocking-backdoor-claim-about-whatsapp/123202/ https://socialbarrel.com/telegram-founder-makes-shocking-bac... Which discusses how Telegram was banned in many countries for refusing cooperation while WhatsApp suspiciously was never banned, which could mean that WhatsApp gives governments everything they demand.
  - beagle3 6y ago
    I suspect the Google/Facebook deal for "free backup of WhatsApp chats on your Google account" is exactly that. WhatsApp had perfectly usable encrypted backup - which took up space on your Google backup. And then, all of a sudden, it wasn't encrypted and didn't take up space. But you don't have access to it yourself - only Google does (and WhatsApp if it is recovering). This is a perfect way to provide all the data to various governments for 99.9% of users, without killing the E2E encryption.
    - coolspot 6y ago
      Same situation with the iCloud backup on Apple iOS, AFAIK. WhatsApp backup in iCloud is not encrypted.
      - beagle3 6y ago
        Is it user accessible at least? The Android backup is not.

s_dev 6y ago

As a reminder encrypted messages aren't easily searchable -- this is a simple trade off and not some dark pattern default. Many Telegram users are away of it's quirks and how it operates differently to other IMs. Any tool will do damage in the hands of a bad workman. A good way to infer Telegram is reliable is how many despotic tyrants and corrupt countries ban it.

clankyclanker 6y ago
> As a reminder encrypted messages aren't easily searchable That's false. Encrypted messages aren't searchable by third-parties. End-to-end encrypted messages are searchable by only the communicating parties regardless of where they're stored. There's also the issue of mirroring by third-parties, but then we're talking about data in transit versus at rest, your backup methods, and so forth. (And I don't have time to get into that this morning.)
- aaomidi 6y ago
  Building and maintaining a super fast searching index on a phone is not an easy task or even doable. Telegram is used a lot in developing countries which are using phones made 3-7 years ago. Or phones that are made recently but with old chips and tech. Maintaining a search index across literally millions or billions (some groups are really really big) messages isn't something your phone can reasonably do. I do wish telegram was e2ee for IMs, but for groups and super groups and channels I don't particularly care.
  - Nitramp 6y ago
    Assuming a message is 200 bytes or so, searching millions of messages is trivially doable on your phone (200 MB full text index). Billions is pushing it a bit, but you can work around on the app level (e.g. only index the last month in high traffic groups).
    - aaomidi 6y ago
      How do you handle message history? Do you download every single old message to your device? Who hosts these messages? How are the backups handled?

eitland 6y ago

> As a reminder, Telegram groups are not encrypted at all, and 1:1 chats are not encrypted by default This isn't just misleading but actually plain wrong. Unless you want to tell my your internet banking is unencrypted too ;-) Edit: as seen downthread there a number of ways to make this more or less correct, but as it stand, and particularly with the "at all" at the end of one of the claims it is just plain wrong. > Telegram can see most of your messages. This part is technically correct however. Telegram says they taken steps to prevent rouge admins from seing it and to prevent themselves from being able to produce copies for governments, however there's no way for us to know if it was true then, if it is true now, if it is true in the future or at any point in between so worthless if you don't trust them. If this is a problem for you generally I recommend stop using email, stop sending letters etc and rely only on Signal or Matrix. For many of us however this is acceptable: we send letters or even post cards fully unencrypted fully aware that they might be read. We send mails fully aware that it can be read at any server from we send it to the one the recipient download it from. But for some reason the same level of security is deeply problematic when Telegram is mentioned.

nebulous1 6y ago
Although they're client/server encrypted, I think contextually it was obvious that the person was talking about end-to-end encryption. "Encrypted chat" means end-to-end encrypted, if it's used to mean client/server encrypted then that's misleading.
- eitland 6y ago
  Encryped chat might mean E2E-encrypted yes, but even then why not add those four extra letters "E2E-" and make it obvious? Besides, here is what I replied to: > As a reminder, Telegram groups are not encrypted at all[...] (emphasis mine) This is very possible to misunderstand for someone who isn't aware and the result might easily be that they stay in their abusive relationship with WhatsApp because of such FUD. As can probably be seen from my comment history I'm no stranger to criticizing Telegram but we should stick to the facts. Facts matter.
  - 6y ago

jorvi 6y ago

Reminder: they both are encrypted, just not E2E. Telegram is not blasting your plaintext messages into the ether and then into their database.

gcblkjaidfj 6y ago

Whatsapp group messages are also not encrypted. I mean, it is, but with the server keys.

graposaymaname 6y ago
I don’t think so. It doesn’t use the double ratchet algorithm used in DMs but still the participants of the group formulate a secret key for the group and share this key with every participant using the more secure protocol. The key cannot be read by the server as it is shared using conventional E2EE. Refer this video from computerphile for more details. Start watching from 5:24. https://youtu.be/Q0_lcKrUdWg https://youtu.be/Q0_lcKrUdWg
LurkersWillLurk 6y ago
This isn't true at all. It uses Signal Protocol and is end-to-end encrypted.
- dancemethis 6y ago
  It is proprietary, so there is no proof they didn't tamper with the code to appear to be working on clients. And chances are against the fragile link in the chain - the user.