10 ms·
Security professionals often warn against Telegram
- s_dev 6y ago>Because the chat app doesn't encrypt conversations by default—or at all for group chats—security professionals often warn against it. Everytime this story comes up it just complains about the default setting. Terribly reasearched articled. It offeres no insight to HNers compared to previous discussion. A bad workman blames his tools. Defaults are powerful -- I will concede. Not understanding defaults counts as not understanding your tool. I don't even believe WhatsApp is E2E but I've no evidence to proove that -- I'm just that skeptical of FB. I believe FB are reading WA messages but again -- nothing to base that on other than FB being heavily incentived to do so.
- goatinaboat 6y agoTerribly reasearched article It’s not an article, it’s a hit piece. Established publication protecting established vendor. Classic Wired.
- s_dev 6y agoYou reckon this is PR paid for by FB and expressed in the media via Wired?
- stelonix 6y agoAlthough I'm not the original commenter, direct cash payment isn't the only incentive for established media to protect established product. Let's not forget they're apps from different, rival countries.
- JetSpiegel 6y agoWhy would they interview only other Facebook-adjacent people? It's even disclosed on TFA.
- tw04 6y agoThe journalist is just wrong. Security professionals don't warn against it because it doesn't encrypt by default, they warn against it because Telegram wrote their own encryption protocol and they haven't allowed an outside audit. Basically "trust us we know what we're doing. If something has changed feel free to correct me, but as far as I know MTProto is still all in-house closed source code and hasn't ever been audited. https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf
- akvadrako 6y agoThere was some analysis done recently, though not being a crypto expert I don't know how relevant it is: https://news.ycombinator.com/item?id=25722076#25724978 https://news.ycombinator.com/item?id=25722076#25724978 One note: Telegram doesn't need to "allow" experts to audit their code - E2E is all in the clients which have source available. I don't think it's had enough scrutiny to be trustworthy though.
- lozf 6y ago> E2E is all in the clients But only mobile clients, no E2E on the desktop or for groups sadly.
- nguyenkien 6y agoMac client has it. The one written with swift. In Windows you have Unigram (unofficial, but opensource)
- lozf 6y agoInteresting thanks. Maybe it'll get to Linux one day then. Not that I'm too fussed, I use telegram for larger groups mostly, and secure chats on Signal.
- s_dev 6y agoI'm aware "roll your own crypto" is bad practice but MTProto is open to being inspected: https://core.telegram.org/mtproto https://core.telegram.org/mtproto https://github.com/tdlib/td/tree/80c35676a2eb1e9b71db355ee217bba79fbdce31/td/mtproto https://github.com/tdlib/td/tree/80c35676a2eb1e9b71db355ee21...
- trackofalljades 6y agoI don't even know what Telegram does, but if I have Signal and iMessage I'm not sure what anything can offer me that I'm missing...
- goatinaboat 6y agoI'm not sure what anything can offer me that I'm missing... Very large groups, if that’s your thing.
- client4 6y agoKeybase handles that, zoom purchase aside.
- nguyenkien 6y agoI like channel, I even use it as RSS reader. Sticker, Gif feel so much better in telegram. Saved messages, 1 member private channel for quick notes. And telegram has true native app for all major OS, not electron like signal.
- breakfastduck 6y agoThe UX for Telegram is spot on for me.
- depingus 6y agoDon't forget about their API. My systems at work send me Telegram messages when things are down.
- gadders 6y agoYou can also get one-to-many groups, which effectively act like you were following someone on Twitter.
- vezycash 6y agoYou mean channels?
- m-app 6y agoAlthough the article does not add anything new, I do have to agree that the way Telegram is positioning itself is rather frustrating: they are really pushing the "secure" nature of the service and try their best to make it seem even _more_ secure than WhatsApp or Signal (eg. speculating other encryption standards are US-funded and therefor not trustworthy), while it is clear that they have made some design decisions that make it less secure. And that's fine! The user experience is great, and I like the service in general. The fact that it's not tied to an advertising company that is profiling users and making money of it is of course the biggest plus, but please stop with the whole "totally secure" BS. It's confusing and is probably even hurting their image: I have had to explain multiple times to friends and family I finally moved off of WhatsApp that we did not do it for the security, but rather to be free of being mined for personal data... Same thing goes for these non-tech 'news' sources that make a big deal out of it as well, while it's totally obvious if you investigate a bit more. (Apologies for the rant, I guess had to get this off my chest.)
- FreakyT 6y agoAbsolutely! Telegram provides nice to have features like cloud message history, but those inherently mean it's less secure. I actually wish Signal had a "trade some security for convenience" option like that.
- briffle 6y agoMy signal is set to backup my message db daily. it works, but its a hell of a key to type if I lose my current phone, and need to restore. https://support.signal.org/hc/en-us/articles/360007059752-Backup-and-Restore-Messages https://support.signal.org/hc/en-us/articles/360007059752-Ba...
- FreakyT 6y agoSadly it's not supported at all on iOS, since apparently the Signal devs don't believe that people ever lose phones.
- 0xy 6y ago
- jlelse 6y agoSecret Chats are three instead of two steps (not four steps like the article says), why make such a drama about it?
- fsflover 6y agoYes, turn to federated Matrix instead, if you don't want to end up in another walled garden (Telegram or Signal).
- mosselman 6y agoWhat is a good place to start with Matrix? Which app is like Telegram or Signal that uses Matrix? I can never figure out how me and my family would use something based on Matrix together.
- Cu3PO42 6y agoElement (formerly called Riot) is the de facto standard client for Matrix. Set-up is very easy and the user experience is solid on the Android and mobile versions. You can even easily cross-sign keys.
- faitswulff 6y agoIn retrospect, renaming the app was probably a good idea.
- trenchgun 6y agoThat is actually pretty Hilarius and spot on.
- rglullis 6y agoMay I point you to https://communick.com https://communick.com? I provide a Matrix server and manage everything. My idea is exactly to help small groups to migrate. Documentation is still lacking, but if you want you can reach me directly to help you set things up.
- kevincox 6y agohttps://element.io/get-started https://element.io/get-started I wouldn't even mention Matrix to get someone started. But this page will lead them to the Web App and mobile apps. By default they will sign you up to the matrix.org homeserver with E2E encryption. It is a great way to get people started. You can then send them a link to your profile or they can find you be email or phone number if you have verified those.
- breakfastduck 6y agoWhat an absolute nonsense article. It does everything it can to miss the huge main reason people are migrating from WhatsApp. I don't want my data mined and sold so Facebook can profit from pushing ads at me, I'm not worried about someone hacking into my messages. So yes, even the article TITLE is wrong. No, it may not be more 'secure', but you'd have to be a fool to argue it isn't more 'private'. This article is absolutely paid for by Facebook, no doubt it my mind.
- elliekelly 6y agoI read your comment and thought it was a little over the top. Then as I was reading the article I saw the embedded tweet without any context and it was just so bizarre I had to see why on earth it was even featured. A search for “toothpaste” and, sure enough: > Telegram's MTProto protocol isn't obviously broken in a practical way, concedes Matt Green, a cryptographer at Johns Hopkins University who has consulted for Facebook on encrypted messaging systems. But it's uniquely "weird," he says, in a way that suggests its inventors don't understand tried-and-true cryptography practices and raises his suspicions that it may yet have undiscovered vulnerabilities. "It's like if everyone else in the world has agreed that we're going to use drywall to do the walls in a house, and then you've got somebody who's using toothpaste," says Green. "Even if the toothpaste works and makes a nice wall, that's weird. How do you know they're not doing other weird, nonstandard things when they put the electrical wiring into the house? And that's what scares me." I prefer to give the benefit of the doubt (maybe this guy is just terrible at analogies?) so I’m not sure I’d say facebook definitely seeded the article but this is just such a wacky, nonsensical thing for someone to say I don’t really know what on earth to make of it.
- bitL 6y agoBunch of researchers from another country with a different cryptographic tradition creates different cryptographic primitives and a competing school of cryptography calls them weird and "toothpaste". What did I just read?
- at-fates-hands 6y ago
- olah_1 6y agoLet's pretend that Telegram servers and all your data is stored in Russia, regularly data-mined by the KGB, whatever. The fact is that many Americans would prefer to have their data mined by the KGB than by the FBI.
- AlgorithmicTime 6y agoIt honestly seems less risky at this point. What is the KGB gonna do with my data? They've got no jurisdiction in the US, the best they might hope is to blackmail me. The FBI, on the other hand, does have jursidiction.
- Arech 6y agoI can imagine at least the following: - impersonate you - mine some data they think important for them
- 0xy 6y agoTelegram was banned in Russia. The founder was forced out of his own billion dollar company in Russia because he wasn't "in" with the Kremlin.
- olah_1 6y agoI know, I’m just saying that this is the common meme statement about Russia.
- thrwway34 6y agoTelegram wasn't banned in Russia, it was just a PR show.
- ruslan 6y agoIn essence it was not a show, but it turned out to be. Roscomnadzor (same as FCC in US) was desperately trying to block Telegram by KGB (FSB) resolution, because Telegram did not obey to their orders to provide keys and it turned out into complete farce. During this endeavor as a side effect they blocked almost any service that was using AWS and/or other cloud services, a lot many companies in Russia had been suffering from IT ifrastructure disruption including government institutions, yet Telegrams was up and running. And the most fannies thing was that almost all middle rank officials continued to use Telegram for their daily work and leasure. In the end Roscomnadzor "silently" quit their attempts. It was so humorous to follow the event. That was the first time in the modern history of Russia when govt completely failed while acting against their citizens. After that, Durov turned into real "rock star" here. :)
- h_anna_h 6y agoSame "security professionals" suggested WhatsApp as a replacement. It really does not look good for them.
- viro 6y agoYou clearly don't know anything about security if you think E2E is a bad thing.
- depingus 6y agoNot the person you responded to. But they may be talking about FaceBooks's recent change to WhatsApp's privacy policy.
- h_anna_h 6y agoI do not think that. Do not put words in my mouth. Anyway, the sibling comment at https://news.ycombinator.com/item?id=25946537 https://news.ycombinator.com/item?id=25946537 is right.
- dc2k08 6y agoI didn't move to telegram because I want to secretly plan an insurgency. I moved there because of the threat of censorship from big tech. It's way more than a messaging app and incredibly feature rich.
- selykg 6y agoYea, Telegram is a great middle ground.. sort of. It has secure options at least. But importantly doesn't require my phone number to create an account and contact people. But also has a lot of features that are missing in something like Signal. Signal is my preferred option, but I'm not keen on sharing my phone number with everyone.
- darkfirefly 6y agoTelegram doesn't require your phone number? It did for me to sign up.
- selykg 6y agoSorry, you don't need to use your phone number to contact someone. You can just give them your Telegram username. Which is sufficient for me in my use case for Telegram.
- stretchcat 6y agoSo Facebook is afraid of Telegram? Got it.
- upofadown 6y agoOK, Telegram uses boring and reliable encryption in a reasonably straightforward way. They get heck for "rolling their own encryption". Signal on the other hand uses new and exciting encryption they made up themselves but no one seems to be criticizing them for it.
- Jkvngt 6y agoIt says a lot about trust in US big tech when people happily switch to a Russian platform.