4 ms·

I don't like the way they communicate regarding security, but for context: So far there has been an extreme amount of FUD thrown their way from people who pushe

I don't like the way they communicate regarding security, but for context: So far there has been an extreme amount of FUD thrown their way from people who pushed WhatsApp and Signal.

teawrecks 5y ago
> from people who pushed WhatsApp So Facebook?
- eitland 5y ago
  No, I'm thinking about well meaning security people who focused a bit too much on E2E-encryption and forgot that WhatsApp sent metadata in bulk to Facebook and uploaded backups unencrypted to Google and/or iCloud.
  - Ar-Curunir 5y ago
    As opposed to Telegram, where chats are unencrypted by default, and synced to the cloud?
    - eitland 5y ago
      are we a community of technical people or sleazy sales people? What you say about being synced to the cloud in a way that can be decrypted is correct and can be problematic for some people but calling it unencrypted is wrong and detracts from your message.
      - maqp 5y ago
        Saying the database is encrypted when the database key has to sit in the RAM of the server is as disingenuous as saying this is proper way to lock up gems: https://i.imgur.com/0gBOPoQ.png https://i.imgur.com/0gBOPoQ.png You're basically arguing that "you can't say it's not locked when the lock is right there"
        Dah00n 5y ago
        Your comment says nothing about what GP actually stated.
        maqp 5y ago
        Calling Telegram unencrypted isn't practically wrong when the key is stored right next to the data.
        eitland 5y ago
        > Saying the database is encrypted when the database key has to sit in the RAM of the server First you are replying to something I didn't say. Secondly, going down that path and applying it as strictly to everything you'll find that nothing is encrypted: not your communication with the bank, certainly not WhatsApp as it stores temporary databases unencrypted (not only with a password stored in ram) and probably not much else either. In fact I guess if we apply your criteria to Signal clients they are not encrypted either.
  - maqp 5y ago
    >forgot that WhatsApp uploaded backups unencrypted to Google and/or iCloud. This might finally get fixed: https://www.theverge.com/2021/7/16/22580800/icloud-google-drive-encrypted-whatsapp-cloud-backup https://www.theverge.com/2021/7/16/22580800/icloud-google-dr... Great news because it disproves Durov's BS that claims you can't have backups without giving the vendor the access.
    - eitland 5y ago
      Did he claim that? I'm fairly sure his claim was that it was easier to do it this way.
      - maqp 5y ago
        "Secret chats are e2e-encrypted chats that never under any circumstances get backed up. Cloud chats are encrypted in the same way, but also have a built-in cloud backup. " https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Of course he's not dumb enough to walk into the mine of saying it directly. But he justifies the need to split chats in the context of backups, which gives any reader an impression you can't do client-side encrypted cloud backups on secret chats. He never even tries to explain why he doesn't try to bridge the feature gap.
joecool1029 5y ago
> I don't like the way they communicate regarding security In general they are cocky but in an expressive way. It is heartening that when papers like this are published they fix the issues despite the PR spin. I've had one email thread interaction with Telegram and it was to unban my account that got banned for messing around with old clients, I can't say they were pleasant but they did answer many of my questions. >So far there has been an extreme amount of FUD thrown their way from people who pushed WhatsApp and Signal. Signal's people did not inform their Android users of the potential for backdoored IME's in places like China for over a year (thankfully their site does mention it now). It was telling that the app was available and usable there until word got out that this was a very obvious/easy surveillance target for such regimes. Personally I think it's possible the Signal Foundation was under a gag order and could not report on this. But I would not rule out cockiness in their own way, to date I've never received a single response to the most basic of questions (back when I was an active user/promoter of their apps) from any of their team dating all the way back to Textsecure days. HN discussed the IME issue around 6 months ago: https://news.ycombinator.com/item?id=25758995 https://news.ycombinator.com/item?id=25758995

I don't like the way they communicate regarding security, but for context: So far there has been an extreme amount of FUD thrown their way from people who pushed WhatsApp and Signal.

teawrecks 5y ago

> from people who pushed WhatsApp So Facebook?

eitland 5y ago
No, I'm thinking about well meaning security people who focused a bit too much on E2E-encryption and forgot that WhatsApp sent metadata in bulk to Facebook and uploaded backups unencrypted to Google and/or iCloud.
- Ar-Curunir 5y ago
  As opposed to Telegram, where chats are unencrypted by default, and synced to the cloud?
  - eitland 5y ago
    are we a community of technical people or sleazy sales people? What you say about being synced to the cloud in a way that can be decrypted is correct and can be problematic for some people but calling it unencrypted is wrong and detracts from your message.
    - maqp 5y ago
      Saying the database is encrypted when the database key has to sit in the RAM of the server is as disingenuous as saying this is proper way to lock up gems: https://i.imgur.com/0gBOPoQ.png https://i.imgur.com/0gBOPoQ.png You're basically arguing that "you can't say it's not locked when the lock is right there"
      - Dah00n 5y ago
        Your comment says nothing about what GP actually stated.
        maqp 5y ago
        Calling Telegram unencrypted isn't practically wrong when the key is stored right next to the data.
      - eitland 5y ago
        > Saying the database is encrypted when the database key has to sit in the RAM of the server First you are replying to something I didn't say. Secondly, going down that path and applying it as strictly to everything you'll find that nothing is encrypted: not your communication with the bank, certainly not WhatsApp as it stores temporary databases unencrypted (not only with a password stored in ram) and probably not much else either. In fact I guess if we apply your criteria to Signal clients they are not encrypted either.
- maqp 5y ago
  >forgot that WhatsApp uploaded backups unencrypted to Google and/or iCloud. This might finally get fixed: https://www.theverge.com/2021/7/16/22580800/icloud-google-drive-encrypted-whatsapp-cloud-backup https://www.theverge.com/2021/7/16/22580800/icloud-google-dr... Great news because it disproves Durov's BS that claims you can't have backups without giving the vendor the access.
  - eitland 5y ago
    Did he claim that? I'm fairly sure his claim was that it was easier to do it this way.
    - maqp 5y ago
      "Secret chats are e2e-encrypted chats that never under any circumstances get backed up. Cloud chats are encrypted in the same way, but also have a built-in cloud backup. " https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Of course he's not dumb enough to walk into the mine of saying it directly. But he justifies the need to split chats in the context of backups, which gives any reader an impression you can't do client-side encrypted cloud backups on secret chats. He never even tries to explain why he doesn't try to bridge the feature gap.

joecool1029 5y ago

> I don't like the way they communicate regarding security In general they are cocky but in an expressive way. It is heartening that when papers like this are published they fix the issues despite the PR spin. I've had one email thread interaction with Telegram and it was to unban my account that got banned for messing around with old clients, I can't say they were pleasant but they did answer many of my questions. >So far there has been an extreme amount of FUD thrown their way from people who pushed WhatsApp and Signal. Signal's people did not inform their Android users of the potential for backdoored IME's in places like China for over a year (thankfully their site does mention it now). It was telling that the app was available and usable there until word got out that this was a very obvious/easy surveillance target for such regimes. Personally I think it's possible the Signal Foundation was under a gag order and could not report on this. But I would not rule out cockiness in their own way, to date I've never received a single response to the most basic of questions (back when I was an active user/promoter of their apps) from any of their team dating all the way back to Textsecure days. HN discussed the IME issue around 6 months ago: https://news.ycombinator.com/item?id=25758995 https://news.ycombinator.com/item?id=25758995