6 ms·

Can anyone explain the move to Telegram to me? I understand the UX argument, Telegram is amazing. But privacy? Aren't you moving from "Facebook can read your me

Can anyone explain the move to Telegram to me? I understand the UX argument, Telegram is amazing. But privacy? Aren't you moving from "Facebook can read your metadata" to "Pavel Durov can read your every message"? How is that an improvement? I mean, I too trust Durov more than Zuckerberg but that's an extremely low bar to clear, and you're giving them a lot more data.

rklaehn 6y ago
No idea. Just saying what I am observing. I got signal, telegram and element.io . I encourage non technically savvy people to go to signal and technically savvy people to go to element. But I see a lot of normal people switching to telegram. Possibly just network effect due to the whatsapp exodus. If somebody you want to communicate with only has telegram, you also download it.
- aero-glide2 6y ago
  Is it just me or is Element much slower than whatsapp?
  - schoolornot 6y ago
    Orders of magnitude slower. Scrolling through past messages in Telegram is insanely fast. Not sure if it's Matrix or Element but there is a lot left to be desired there. And the longer it exists, the more it seems architectural. Not talking E2E groups. This isn't to take anything away from the Matrix folks who are doing an outstanding job.
    - Arathorn 6y ago
      On what platform are you seeing this? Element is three different apps on iOS/Android/Web and they implement scrolling differently. There is no architectural reason in Matrix why it should be slower than TG.
      - johnchristopher 6y ago
        > There is no architectural reason in Matrix why it should be slower than TG. Then why is it ?
        smoldesu 6y ago
        Probably because the people developing these clients aren't being bankrolled by multi-million dollar companies with private interests. The previous poster was correct; Matrix is a protocol, and so your performance really comes down to whatever client you're using it with. Element is a web app, so it will inevitably be pretty slow. If you want a client that won't slow down, look into Fractal, a GTK Matrix frontend written in Rust. If that doesn't iron out your performance issues, you just have a slow machine/connection.
        johnchristopher 6y ago
        Fractal is actually responsive, I am actually impressed. It's not bankrolled by multi-million dollar companies though and Telegram web app is way faster so something doesn't add.
      - meibo 6y ago
        They are probably talking about the Matrix.org instance being slow at fetching messages for you, additionally to the delay needed to get keys for them in encrypted rooms. This is far nicer on smaller home servers, but matrix.org is the "default experience" of element and that's what people are judging it by.
    - anilakar 6y ago
      > Scrolling through past messages Funny how you mention this - scrolling back manually is literally the only way to go to past conversations on mobile, as the search does not work with inflected languages. The only way to search for past content is to dump your whole message history on the desktop client and run grep on it.
aero-glide2 6y ago
In fact, WhatsApp is better than Telegram because whatsapp has e2e by default. Personally I use Telegram because of public searchable groups. Nice way to meet new people with same interests.
- Dma54rhs 6y ago
  There's no way for you to check the claims though, you have to trust Zuck/FB.
  - fshbbdssbbgdd 6y ago
    WhatsApp’s E2E encryption occurs on your device, in binaries that you can decompile.
    - 0xy 6y ago
      Except the key is backed up to the cloud by default, subject to court orders. You may have declined to do this, but have your contacts?
      - pgalvin 6y ago
        You’re definitely, definitely wrong. This is not true. WhatsApp messages have E2E encryption by default, you can not opt out, and the keys (each message has a different one) are never sent to WhatsApp or anybody else. Users may OPTIONALLY enable a cloud backup, which puts an encrypted backup on iCloud or Google Drive. WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. But that is all completely opt-in. By default, messages are not backed up, contrary to what you said. Full disclosure: I use WhatsApp but am eager to switch away from it a soon as Signal implements a local backup on iOS.
        ffpip 6y ago
        > WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. It is a plaintext backup to Google Drive, whatsapp does not encrypt it before uploading it to Drive or iCloud. https://news.ycombinator.com/item?id=26458102 https://news.ycombinator.com/item?id=26458102 > But that is all completely opt-in You cannot control your contacts backup settings. Every contact I have (100+) has enabled the backup option, meaning all my 'e2ee' chats are uploaded in plaintext to Google servers. With Telegram, I can be sure e2ee/secret chats with my contacts are not going anywhere other than the device they were delivered to.
ollyhayes 6y ago
Since WhatsApp is closed source, you can't know that there isn't some sort of encryption backdoor in there anyway, so in both cases it comes down to trust that the company is doing what they say they're doing. When you read how the cloud encryption works in Telegram, with the encryption keys stored in different data centres and even different countries to protect against any one person or group being able to read them, I personally feel pretty happy with that. (See https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats) Having the messages stored in the cloud and not having to rely on my phone (except for registration) is a huge win for me personally. Especially during the lockdown I almost exclusively use desktop versions of these and the Telegram one is great.
- fshbbdssbbgdd 6y ago
  WhatsApp’s encryption occurs on my phone and can I can verify it by examining the client binaries, regardless of whether it’s open source. Telegram’s story about the nine keys divided between the realms of the human, elves, orcs etc is just a story on a website. You should only trust it if you believe that organizations who want your data can’t invent a good story.
  - ollyhayes 6y ago
    > by examining the client binaries And you do this every time there is a new WhatsApp version? How confident are you that you can find any backdoor in the binary? And it doesn't have to be in the encryption/decryption part, all it would need to do is hide the encryption key in a message back to the server, so you'd have to inspect the entire binary every time. Even if you do have the time and skill to do this it's not exactly feasible for most people. I'm not trying to argue that there is a backdoor, just that in both cases you have to rely on trust. > You should only trust it if you believe that organizations who want your data can’t invent a good story. It's not just inventing a story though, their backend is also open source so they've also implemented this story. Of course that doesn't mean there isn't a backdoor in the production version, but you see how the trust you need in both cases is the same. Edit: Actually the backend isn't open source, I was thinking of signal
0xy 6y ago
Firstly, by default WhatsApp backs up your encryption keys to the cloud making your messages totally accessible and not E2E encrypted at all. Secondly, Telegram secret messages have been repeatedly proven to be E2E encrypted, including by independent researchers, so "Pavel can read all your messages!" is just misinformation. As for the alternatives, well Signal is very likely compromised given their server repo is abandoned and they refuse to address why (they maintain a closed source version). Why else would an "open source project" act that way, if not gagged?
- pgalvin 6y ago
  This is NOT true. Message keys are never sent to the cloud in WhatsApp, no matter what. You’re referring to the optional backup that requires users to opt-in. This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key (but not the data) to that. Both companies would need to cooperate to read your messages, and this is OPT-IN by default. This isn’t E2EE, but it’s opt-in by default. It also has nothing to do with the key exchange for E2EE messages. You’re comparing WhatsApp, with all messages end-to-end encrypted and where the only way to compromise that is an opt-in cloud backup, to Telegram, where the vast majority of people (anyone using cloud chats) do not use Telegram’s encryption. Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
  - ffpip 6y ago
    > This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key It is a plain text backup to Google Drive. There is no key Whatsapp holds. Google can read it all, and has revealed the chats to help the Govt in multiple high profile cases here in India. You can extract it yourself, with the credentials of your Google account- https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithread https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre... > You’re referring to the optional backup that requires users to opt-in. With telegram, if you enable secret chats, it is never backed up to the cloud. It is a guarantee, unlike Whatsapp where you do not know whether your contact has enabled cloud backups Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
johnchristopher 6y ago
Durov is in self-imposed exile from the Russian government. His public image carries more weight than Zuckerberg ever could (I don't think Zuckerberg could become a public figure in the next decades like Gates is). From https://en.wikipedia.org/wiki/Pavel_Durov https://en.wikipedia.org/wiki/Pavel_Durov: > On 16 April 2014 Durov publicly refused to hand over data of Ukrainian protesters to Russia's security agencies and block Alexei Navalny's page on VK.[4] Instead he posted the relevant orders on his own VK page [23][24] claiming that the requests were unlawful. > On 21 April 2014 Durov was dismissed as CEO of VK. The company claimed it was acting on his letter of resignation a month earlier that he failed to recall.[4][25] Durov then claimed the company had been effectively taken over by Vladimir Putin's allies,[25][26] suggesting his ouster was the result of both his refusal to hand over personal details of users to federal law enforcement and his refusal to hand over the personal details of people who were members of a VK group dedicated to the Euromaidan protest movement.[25][26] Durov then left Russia and stated that he had "no plans to go back"[26] and that "the country is incompatible with Internet business at the moment".[4]
- hayst4ck 6y ago
  I am not really a conspiracy person. I am saying that because this will sound conspiratorial and I am aware of that. I certainly think I am looking at things from a probabilistic and alignment perspective. Is he a russian agent? Probably not. But, he's not dead or in prison, I'd say that counts against him. He's complied with fighting "extremeism" in Russia. If Russia did want a view into international communications they would have to publicly distance themself from him. I'm not saying it is the case, but I think the chance is pretty far from 0. Certainly everyone benefits from the appearance that he and Russia do not get along. The chance his co workers are russian is higher, and therefore the chance that Russia has leverage (money/property/family/blackmail etc) directly over at least one employee seems pretty non trivial. I don't see any good reason to believe Russia or himself are distant on purely the grounds that both of them say so. Is freedom/what's morally right a guiding light? Well, it's run out of Dubai, the middle east isn't exactly a shining star of liberal ideals. Not everything is encrypted automatically. Are they consistent? Company is supposed to be a non profit entity but isn't structured that way. Are they aligned with privacy? Their revenue model is ads, a revenue model with deep precedence for violations of privacy. I see no reason that he wouldn't take a zuckerbergian approach. I don't find telegram to be any more trustable than Facebook. If I were using a platform for political speech, something I could be blackmailed for, or anything else that would get a state actor interested in me both seem like equally bad choices.

rklaehn 6y ago

No idea. Just saying what I am observing. I got signal, telegram and element.io . I encourage non technically savvy people to go to signal and technically savvy people to go to element. But I see a lot of normal people switching to telegram. Possibly just network effect due to the whatsapp exodus. If somebody you want to communicate with only has telegram, you also download it.

aero-glide2 6y ago
Is it just me or is Element much slower than whatsapp?
- schoolornot 6y ago
  Orders of magnitude slower. Scrolling through past messages in Telegram is insanely fast. Not sure if it's Matrix or Element but there is a lot left to be desired there. And the longer it exists, the more it seems architectural. Not talking E2E groups. This isn't to take anything away from the Matrix folks who are doing an outstanding job.
  - Arathorn 6y ago
    On what platform are you seeing this? Element is three different apps on iOS/Android/Web and they implement scrolling differently. There is no architectural reason in Matrix why it should be slower than TG.
    - johnchristopher 6y ago
      > There is no architectural reason in Matrix why it should be slower than TG. Then why is it ?
      - smoldesu 6y ago
        Probably because the people developing these clients aren't being bankrolled by multi-million dollar companies with private interests. The previous poster was correct; Matrix is a protocol, and so your performance really comes down to whatever client you're using it with. Element is a web app, so it will inevitably be pretty slow. If you want a client that won't slow down, look into Fractal, a GTK Matrix frontend written in Rust. If that doesn't iron out your performance issues, you just have a slow machine/connection.
        johnchristopher 6y ago
        Fractal is actually responsive, I am actually impressed. It's not bankrolled by multi-million dollar companies though and Telegram web app is way faster so something doesn't add.
    - meibo 6y ago
      They are probably talking about the Matrix.org instance being slow at fetching messages for you, additionally to the delay needed to get keys for them in encrypted rooms. This is far nicer on smaller home servers, but matrix.org is the "default experience" of element and that's what people are judging it by.
  - anilakar 6y ago
    > Scrolling through past messages Funny how you mention this - scrolling back manually is literally the only way to go to past conversations on mobile, as the search does not work with inflected languages. The only way to search for past content is to dump your whole message history on the desktop client and run grep on it.

aero-glide2 6y ago

In fact, WhatsApp is better than Telegram because whatsapp has e2e by default. Personally I use Telegram because of public searchable groups. Nice way to meet new people with same interests.

Dma54rhs 6y ago
There's no way for you to check the claims though, you have to trust Zuck/FB.
- fshbbdssbbgdd 6y ago
  WhatsApp’s E2E encryption occurs on your device, in binaries that you can decompile.
  - 0xy 6y ago
    Except the key is backed up to the cloud by default, subject to court orders. You may have declined to do this, but have your contacts?
    - pgalvin 6y ago
      You’re definitely, definitely wrong. This is not true. WhatsApp messages have E2E encryption by default, you can not opt out, and the keys (each message has a different one) are never sent to WhatsApp or anybody else. Users may OPTIONALLY enable a cloud backup, which puts an encrypted backup on iCloud or Google Drive. WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. But that is all completely opt-in. By default, messages are not backed up, contrary to what you said. Full disclosure: I use WhatsApp but am eager to switch away from it a soon as Signal implements a local backup on iOS.
      - ffpip 6y ago
        > WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. It is a plaintext backup to Google Drive, whatsapp does not encrypt it before uploading it to Drive or iCloud. https://news.ycombinator.com/item?id=26458102 https://news.ycombinator.com/item?id=26458102 > But that is all completely opt-in You cannot control your contacts backup settings. Every contact I have (100+) has enabled the backup option, meaning all my 'e2ee' chats are uploaded in plaintext to Google servers. With Telegram, I can be sure e2ee/secret chats with my contacts are not going anywhere other than the device they were delivered to.

ollyhayes 6y ago

Since WhatsApp is closed source, you can't know that there isn't some sort of encryption backdoor in there anyway, so in both cases it comes down to trust that the company is doing what they say they're doing. When you read how the cloud encryption works in Telegram, with the encryption keys stored in different data centres and even different countries to protect against any one person or group being able to read them, I personally feel pretty happy with that. (See https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats) Having the messages stored in the cloud and not having to rely on my phone (except for registration) is a huge win for me personally. Especially during the lockdown I almost exclusively use desktop versions of these and the Telegram one is great.

fshbbdssbbgdd 6y ago
WhatsApp’s encryption occurs on my phone and can I can verify it by examining the client binaries, regardless of whether it’s open source. Telegram’s story about the nine keys divided between the realms of the human, elves, orcs etc is just a story on a website. You should only trust it if you believe that organizations who want your data can’t invent a good story.
- ollyhayes 6y ago
  > by examining the client binaries And you do this every time there is a new WhatsApp version? How confident are you that you can find any backdoor in the binary? And it doesn't have to be in the encryption/decryption part, all it would need to do is hide the encryption key in a message back to the server, so you'd have to inspect the entire binary every time. Even if you do have the time and skill to do this it's not exactly feasible for most people. I'm not trying to argue that there is a backdoor, just that in both cases you have to rely on trust. > You should only trust it if you believe that organizations who want your data can’t invent a good story. It's not just inventing a story though, their backend is also open source so they've also implemented this story. Of course that doesn't mean there isn't a backdoor in the production version, but you see how the trust you need in both cases is the same. Edit: Actually the backend isn't open source, I was thinking of signal

0xy 6y ago

Firstly, by default WhatsApp backs up your encryption keys to the cloud making your messages totally accessible and not E2E encrypted at all. Secondly, Telegram secret messages have been repeatedly proven to be E2E encrypted, including by independent researchers, so "Pavel can read all your messages!" is just misinformation. As for the alternatives, well Signal is very likely compromised given their server repo is abandoned and they refuse to address why (they maintain a closed source version). Why else would an "open source project" act that way, if not gagged?

pgalvin 6y ago
This is NOT true. Message keys are never sent to the cloud in WhatsApp, no matter what. You’re referring to the optional backup that requires users to opt-in. This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key (but not the data) to that. Both companies would need to cooperate to read your messages, and this is OPT-IN by default. This isn’t E2EE, but it’s opt-in by default. It also has nothing to do with the key exchange for E2EE messages. You’re comparing WhatsApp, with all messages end-to-end encrypted and where the only way to compromise that is an opt-in cloud backup, to Telegram, where the vast majority of people (anyone using cloud chats) do not use Telegram’s encryption. Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
- ffpip 6y ago
  > This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key It is a plain text backup to Google Drive. There is no key Whatsapp holds. Google can read it all, and has revealed the chats to help the Govt in multiple high profile cases here in India. You can extract it yourself, with the credentials of your Google account- https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithread https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre... > You’re referring to the optional backup that requires users to opt-in. With telegram, if you enable secret chats, it is never backed up to the cloud. It is a guarantee, unlike Whatsapp where you do not know whether your contact has enabled cloud backups Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.

johnchristopher 6y ago

Durov is in self-imposed exile from the Russian government. His public image carries more weight than Zuckerberg ever could (I don't think Zuckerberg could become a public figure in the next decades like Gates is). From https://en.wikipedia.org/wiki/Pavel_Durov https://en.wikipedia.org/wiki/Pavel_Durov: > On 16 April 2014 Durov publicly refused to hand over data of Ukrainian protesters to Russia's security agencies and block Alexei Navalny's page on VK.[4] Instead he posted the relevant orders on his own VK page [23][24] claiming that the requests were unlawful. > On 21 April 2014 Durov was dismissed as CEO of VK. The company claimed it was acting on his letter of resignation a month earlier that he failed to recall.[4][25] Durov then claimed the company had been effectively taken over by Vladimir Putin's allies,[25][26] suggesting his ouster was the result of both his refusal to hand over personal details of users to federal law enforcement and his refusal to hand over the personal details of people who were members of a VK group dedicated to the Euromaidan protest movement.[25][26] Durov then left Russia and stated that he had "no plans to go back"[26] and that "the country is incompatible with Internet business at the moment".[4]

hayst4ck 6y ago
I am not really a conspiracy person. I am saying that because this will sound conspiratorial and I am aware of that. I certainly think I am looking at things from a probabilistic and alignment perspective. Is he a russian agent? Probably not. But, he's not dead or in prison, I'd say that counts against him. He's complied with fighting "extremeism" in Russia. If Russia did want a view into international communications they would have to publicly distance themself from him. I'm not saying it is the case, but I think the chance is pretty far from 0. Certainly everyone benefits from the appearance that he and Russia do not get along. The chance his co workers are russian is higher, and therefore the chance that Russia has leverage (money/property/family/blackmail etc) directly over at least one employee seems pretty non trivial. I don't see any good reason to believe Russia or himself are distant on purely the grounds that both of them say so. Is freedom/what's morally right a guiding light? Well, it's run out of Dubai, the middle east isn't exactly a shining star of liberal ideals. Not everything is encrypted automatically. Are they consistent? Company is supposed to be a non profit entity but isn't structured that way. Are they aligned with privacy? Their revenue model is ads, a revenue model with deep precedence for violations of privacy. I see no reason that he wouldn't take a zuckerbergian approach. I don't find telegram to be any more trustable than Facebook. If I were using a platform for political speech, something I could be blackmailed for, or anything else that would get a state actor interested in me both seem like equally bad choices.