5 ms·

It feels like Telegram's security posture might end up being quite dangerous for less technical users. Given that it is marketed so strongly as "secure", it's n

It feels like Telegram's security posture might end up being quite dangerous for less technical users. Given that it is marketed so strongly as "secure", it's not necessarily obvious that chats aren't E2E-encrypted and it takes several taps through the UI to even find the option for secret chats. I wonder how many users just don't discover secret chats at all.

apples_oranges 6y ago
It reminds me of Teslas "autopilot". Different people may have a different understanding what a word means. The outcome can be catastrophic. Clear definitions must be provided. As in: What do we exactly mean when we say "secure"? In the case of messengers: First the user must have an understanding of the problem. This is not realistic for 99.8% of users.
johnchristopher 6y ago
Worse than that, me and the techies among my Telegram contacts don't even bother with Telegram secret chats because there's too much friction compared to Telegram default mode. edit: Moreover only Telegram on mobile has access to those chats (and no search). Which likely is one of the reasons why secret message hasn't become the default for us.
- jlokier 6y ago
  I like Telegram, but it would be much nicer if secret chats could be synchronised between devices. The distinction isn't just "mobile". Each mobile device a person uses has a separate secret chat, not synchronised with their other devices. There's someone I talk with on Telegram where we have two secret chats open all the time, one for their iPhone and one for their iPad. Both channels are connected to my phone. I have to guess which chat to write in for the other person to notice that I'm writing to them... That's because when using their iPad they often don't have the iPhone nearby (no need for most purposes). It's lucky I don't have two mobile devices too, as then we would have four secret chats. When I'm at my computer, we can only use the non-secret Telegram chat, which has a nice GUI but unlike my phone cannot connect to either of the secret chats. This isn't really a problem because we use the non-secret chat for most topics anyway, because of the search and synchronisation. (Aside, the ability for the other party to delete old messages in Telegram is not very cool imho. I know someone who fell out with a friend and their friend deleted their entire multi-year conversation history, which was heartbreaking. Once you have a long history of messages with someone I think it should be part of your personal archive to look back on. It feels permanent until that point, so it's a surprise to find it can all disappear.)
  - antihero 6y ago
    You'd have to change the model. Signal and WhatsApp can sync the private E2E chats because the web frontend is talking (securely) directly to the app instance and communicating through that. With Telegram you do not need an app or anything, you can just use the desktop client.
    - bennofs 6y ago
      Signal Desktop doesn't require the phone, so no, it doesn't work that way.
      - jsrjenkins 6y ago
        Yes, the phone has to be connected to the internet for it to work. It says so in the documentation, and on the very first page "To use the Signal desktop app, Signal must first be installed on your phone."
        ColinWright 6y ago
        You have confused me. The statement you quote seems to say that Signal must be install on the phone in order to get Signal working on the desktop. That does not, to me, imply that Signal must be up and running on your phone while you use Signal on the desktop. Suppose I install and configure Signal/Phone, then install and configure Signal/Desktop, then turn off the phone. Will Signal/Desktop still work while the phone is turned off? * If yes, then what you say appears to be wrong. * If no, then that's genuinely astonishing to me, and I've learning something.
        ymolodtsov 6y ago
        It'd stop. That's why Signal for desktop constantly asks to relink the connection.
        decrypt 6y ago

apples_oranges 6y ago

It reminds me of Teslas "autopilot". Different people may have a different understanding what a word means. The outcome can be catastrophic. Clear definitions must be provided. As in: What do we exactly mean when we say "secure"? In the case of messengers: First the user must have an understanding of the problem. This is not realistic for 99.8% of users.

johnchristopher 6y ago

Worse than that, me and the techies among my Telegram contacts don't even bother with Telegram secret chats because there's too much friction compared to Telegram default mode. edit: Moreover only Telegram on mobile has access to those chats (and no search). Which likely is one of the reasons why secret message hasn't become the default for us.

jlokier 6y ago
I like Telegram, but it would be much nicer if secret chats could be synchronised between devices. The distinction isn't just "mobile". Each mobile device a person uses has a separate secret chat, not synchronised with their other devices. There's someone I talk with on Telegram where we have two secret chats open all the time, one for their iPhone and one for their iPad. Both channels are connected to my phone. I have to guess which chat to write in for the other person to notice that I'm writing to them... That's because when using their iPad they often don't have the iPhone nearby (no need for most purposes). It's lucky I don't have two mobile devices too, as then we would have four secret chats. When I'm at my computer, we can only use the non-secret Telegram chat, which has a nice GUI but unlike my phone cannot connect to either of the secret chats. This isn't really a problem because we use the non-secret chat for most topics anyway, because of the search and synchronisation. (Aside, the ability for the other party to delete old messages in Telegram is not very cool imho. I know someone who fell out with a friend and their friend deleted their entire multi-year conversation history, which was heartbreaking. Once you have a long history of messages with someone I think it should be part of your personal archive to look back on. It feels permanent until that point, so it's a surprise to find it can all disappear.)
- antihero 6y ago
  You'd have to change the model. Signal and WhatsApp can sync the private E2E chats because the web frontend is talking (securely) directly to the app instance and communicating through that. With Telegram you do not need an app or anything, you can just use the desktop client.
  - bennofs 6y ago
    Signal Desktop doesn't require the phone, so no, it doesn't work that way.
    - jsrjenkins 6y ago
      Yes, the phone has to be connected to the internet for it to work. It says so in the documentation, and on the very first page "To use the Signal desktop app, Signal must first be installed on your phone."
      - ColinWright 6y ago
        You have confused me. The statement you quote seems to say that Signal must be install on the phone in order to get Signal working on the desktop. That does not, to me, imply that Signal must be up and running on your phone while you use Signal on the desktop. Suppose I install and configure Signal/Phone, then install and configure Signal/Desktop, then turn off the phone. Will Signal/Desktop still work while the phone is turned off? * If yes, then what you say appears to be wrong. * If no, then that's genuinely astonishing to me, and I've learning something.
        ymolodtsov 6y ago
        It'd stop. That's why Signal for desktop constantly asks to relink the connection.
        decrypt 6y ago