4 ms·

Since WhatsApp is closed source, you can't know that there isn't some sort of encryption backdoor in there anyway, so in both cases it comes down to trust that

Since WhatsApp is closed source, you can't know that there isn't some sort of encryption backdoor in there anyway, so in both cases it comes down to trust that the company is doing what they say they're doing. When you read how the cloud encryption works in Telegram, with the encryption keys stored in different data centres and even different countries to protect against any one person or group being able to read them, I personally feel pretty happy with that. (See https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats) Having the messages stored in the cloud and not having to rely on my phone (except for registration) is a huge win for me personally. Especially during the lockdown I almost exclusively use desktop versions of these and the Telegram one is great.

fshbbdssbbgdd 6y ago
WhatsApp’s encryption occurs on my phone and can I can verify it by examining the client binaries, regardless of whether it’s open source. Telegram’s story about the nine keys divided between the realms of the human, elves, orcs etc is just a story on a website. You should only trust it if you believe that organizations who want your data can’t invent a good story.
- ollyhayes 6y ago
  > by examining the client binaries And you do this every time there is a new WhatsApp version? How confident are you that you can find any backdoor in the binary? And it doesn't have to be in the encryption/decryption part, all it would need to do is hide the encryption key in a message back to the server, so you'd have to inspect the entire binary every time. Even if you do have the time and skill to do this it's not exactly feasible for most people. I'm not trying to argue that there is a backdoor, just that in both cases you have to rely on trust. > You should only trust it if you believe that organizations who want your data can’t invent a good story. It's not just inventing a story though, their backend is also open source so they've also implemented this story. Of course that doesn't mean there isn't a backdoor in the production version, but you see how the trust you need in both cases is the same. Edit: Actually the backend isn't open source, I was thinking of signal
  - deleted 6y ago
    [deleted]

fshbbdssbbgdd 6y ago

WhatsApp’s encryption occurs on my phone and can I can verify it by examining the client binaries, regardless of whether it’s open source. Telegram’s story about the nine keys divided between the realms of the human, elves, orcs etc is just a story on a website. You should only trust it if you believe that organizations who want your data can’t invent a good story.

ollyhayes 6y ago
> by examining the client binaries And you do this every time there is a new WhatsApp version? How confident are you that you can find any backdoor in the binary? And it doesn't have to be in the encryption/decryption part, all it would need to do is hide the encryption key in a message back to the server, so you'd have to inspect the entire binary every time. Even if you do have the time and skill to do this it's not exactly feasible for most people. I'm not trying to argue that there is a backdoor, just that in both cases you have to rely on trust. > You should only trust it if you believe that organizations who want your data can’t invent a good story. It's not just inventing a story though, their backend is also open source so they've also implemented this story. Of course that doesn't mean there isn't a backdoor in the production version, but you see how the trust you need in both cases is the same. Edit: Actually the backend isn't open source, I was thinking of signal
- deleted 6y ago
  [deleted]