4 ms·

It's funny to see this towards the top of the comments here. Feels like not that long ago that Telegram updates would be downvotes on HackerNews because "you sh

It's funny to see this towards the top of the comments here. Feels like not that long ago that Telegram updates would be downvotes on HackerNews because "you should never trust an app that designed their own encryption protocol."

nine_k 6y ago
This is not about encryption; I personally do not rely much on Telegram encryption being bulletproof. It's about the right UX choices. Speed is a first-tier feature.
tjohns 6y ago
Telegram's UX is outstanding. Their E2E encryption (for "secret chats") is also questionable. Both are simultaneously true. It depends on your needs. I use Telegram like an IRC client, primarily participating in medium/large (20-200 user) group chats. In that sense, I don't really care about encryption because the channels are semi-public anyway. I just want whatever client gives me the best experience. (On the other hand, if I were discussing sensitive topics, I'd probably pick something else.)
perardi 6y ago
As the author of the parent comment… …yes, I am aware Telegram does not use the absolute best practices, and at the very least, I imagine it can be cracked wide open by a nation-state intelligence agency. Which is why, for my occasional super-secret must-be-hush-hush chats, I use other clients. For my day-to-day chats? Telegram. Because, to be privileged, to be flippant: the NSA is welcome to read my texts about what I’m buying at Target this afternoon.
- EGreg 6y ago
  So weird I personally would trust Telegram way more than even Signal for encryption. Armchair sneering doesnt count for me
  - 7v3x3n3sem9vv 6y ago
    Why do you trust Telegram more than Signal?
    - EGreg 6y ago
      It is built by an anarchist person who always refused to give out personal info of people to the point where his company was taken from him, and he ran away to France. He and his brother hired a ton of PhDs and made lots of paid challenges that no one could break their encryption. Their software is open sourced. The encryption Moxie Marlinspike uses was conveniently funded by the very US government agencies interested in breaking encryption. https://surveillancevalley.com/blog/government-backed-privacy-tools-are-not-going-to-protect-us-from-president-trump https://surveillancevalley.com/blog/government-backed-privac... https://twitter.com/durov/status/872891017418113024?s=21 https://twitter.com/durov/status/872891017418113024?s=21 Or if you want just a track record of the most RECENT bugs and backdoors that were exploited, look two months ago: https://www.helpnetsecurity.com/2021/01/21/bugs-video-chat-apps/ https://www.helpnetsecurity.com/2021/01/21/bugs-video-chat-a... Find me the same for Telegram!
      - andyjih_ 6y ago
        That tweet you linked is from the CEO of Telegram. Seems likely he wants to sow doubt about his competitors.
        EGreg 6y ago
        He is simply pointing out what others have as well - that using the crypto whose development was financed by the very people interested in breaking it, may not be that smart. And is the story about from Jan about vulnerabilities in Signal that are absent in Telegram also planted by him? Want to see more incidents like that?
    - orbifold 6y ago
      Signal is a US company and „do not roll your own crypto“ is an NSA meme. It translates to „only use crypto we probably know how to compromise“. That doesn’t mean the algorithm itself must be wrong, it could just be that the implementation has subtle bugs.
- beckingz 6y ago
  Only if they work hard for it.

nine_k 6y ago

This is not about encryption; I personally do not rely much on Telegram encryption being bulletproof. It's about the right UX choices. Speed is a first-tier feature.

tjohns 6y ago

Telegram's UX is outstanding. Their E2E encryption (for "secret chats") is also questionable. Both are simultaneously true. It depends on your needs. I use Telegram like an IRC client, primarily participating in medium/large (20-200 user) group chats. In that sense, I don't really care about encryption because the channels are semi-public anyway. I just want whatever client gives me the best experience. (On the other hand, if I were discussing sensitive topics, I'd probably pick something else.)

perardi 6y ago

As the author of the parent comment… …yes, I am aware Telegram does not use the absolute best practices, and at the very least, I imagine it can be cracked wide open by a nation-state intelligence agency. Which is why, for my occasional super-secret must-be-hush-hush chats, I use other clients. For my day-to-day chats? Telegram. Because, to be privileged, to be flippant: the NSA is welcome to read my texts about what I’m buying at Target this afternoon.

EGreg 6y ago
So weird I personally would trust Telegram way more than even Signal for encryption. Armchair sneering doesnt count for me
- 7v3x3n3sem9vv 6y ago
  Why do you trust Telegram more than Signal?
  - EGreg 6y ago
    It is built by an anarchist person who always refused to give out personal info of people to the point where his company was taken from him, and he ran away to France. He and his brother hired a ton of PhDs and made lots of paid challenges that no one could break their encryption. Their software is open sourced. The encryption Moxie Marlinspike uses was conveniently funded by the very US government agencies interested in breaking encryption. https://surveillancevalley.com/blog/government-backed-privacy-tools-are-not-going-to-protect-us-from-president-trump https://surveillancevalley.com/blog/government-backed-privac... https://twitter.com/durov/status/872891017418113024?s=21 https://twitter.com/durov/status/872891017418113024?s=21 Or if you want just a track record of the most RECENT bugs and backdoors that were exploited, look two months ago: https://www.helpnetsecurity.com/2021/01/21/bugs-video-chat-apps/ https://www.helpnetsecurity.com/2021/01/21/bugs-video-chat-a... Find me the same for Telegram!
    - andyjih_ 6y ago
      That tweet you linked is from the CEO of Telegram. Seems likely he wants to sow doubt about his competitors.
      - EGreg 6y ago
        He is simply pointing out what others have as well - that using the crypto whose development was financed by the very people interested in breaking it, may not be that smart. And is the story about from Jan about vulnerabilities in Signal that are absent in Telegram also planted by him? Want to see more incidents like that?
  - orbifold 6y ago
    Signal is a US company and „do not roll your own crypto“ is an NSA meme. It translates to „only use crypto we probably know how to compromise“. That doesn’t mean the algorithm itself must be wrong, it could just be that the implementation has subtle bugs.
beckingz 6y ago
Only if they work hard for it.