5 ms·

> Obligatory notice in Telegram comment threads: Sadly, obligatory notice in Telegram threads: Telegram is encrypted by default and has always been unlike a c

> Obligatory notice in Telegram comment threads: Sadly, obligatory notice in Telegram threads: Telegram is encrypted by default and has always been unlike a certain big competitor that has been pushed here. The issue isn't if it is encrypted but if it is end to end encrypted and also the quality of the encryption. Saying it is not encrypted is directly misleading. Your point that they can read your messages if they want still stands. This however is also true for mail, banking and about everything else except the most secure instant messaging networks.

axaxs 5y ago
Encrypted, as it's used with messengers, means E2E encrypted. Anyone who is calling Telegram 'encrypted by default' while technically correct, is being very, very misleading.
- eitland 5y ago
  Well, calling it "unencrypted" is equally misleading ... and technically wrong as well. In a somewhat technical community we should strive to communicate correctly and not invent new meanings for well-defined terms. By all means come up with a new nasty sounding term, but don't lie and excuse it with "it means something else now", that is borderline childish/sleazy salesman-ish.
  - maqp 5y ago
    > Well, calling it "unencrypted" is equally misleading Encryption implies it protects message content from third parties. Show me someone who agrees its bad if the third party is some random guy from ISP, but it's good if its some random guy from Telegram LLC. Telegram is effectively unencrypted, because the messages are by default readable by someone else, like is the case if there was no encryption at all. Third parties are not just your average script kiddie capturing packets at your internet cafe, third parties are also everyone who hacks Telegram server, every intelligence agency that hacks Telegram servers, and a possible parent company that buys Telegram.
    - lucb1e 5y ago
      > Show me someone who agrees its bad if the third party is some random [girl] from ISP, but it's good if its some random [girl] from [service operator]. DoH
      - maqp 5y ago
        Oh apologies, I didn't want to be gender exclusive here.
        lucb1e 5y ago
        To be clear, DoH refers to DNS over HTTPS (also thanks to u/wizzwizz4 for clarifying that in a sibling comment) and wasn't at all meant to be a sound. Not sure if that came across wrong, now that I read it again I see that it might have.
      - wizzwizz4 5y ago
        This is DNS over HTTPS, and good point.
    - ufmace 5y ago
      I think there's a pretty big difference between "your messages can be intercepted and arbitrarily modified by anybody who has any access to any router or server between one of your devices and the Telegram server" and "your message security is the security of the Telegram servers only".
lucb1e 5y ago
> Saying it is not encrypted is directly misleading. Sorry, that's my bad. I edited the message to clarify that I meant end-to-end encryption, since Telegram's implementation (mtproto) of e2ee is the topic of this submission. > also true for mail, banking and about everything else except the most secure instant messaging networks That is indeed the state of things. People like the convenience though: imagine you could only retrieve your data from Protonmail by knowing the encryption password. People would irrecoverably lose all their emails on a regular basis. Banking makes less sense though, since the bank needs to know how much money you have to be able to give some of that money (per your instruction) to e.g. merchants. Websites can be end to end encrypted, if the endpoint is owned by the person you're trying to reach. Cloudflare's "TLS MITM as a service" (and similar offerings) undermine that, but if you go to https://lucb1e.com https://lucb1e.com then your traffic is end-to-end encrypted to me. If you want, we can also verify fingerprints out of band, just like you should with encrypted chats to make sure you're not trusting the server (or in this case the signing authorities)!

axaxs 5y ago

Encrypted, as it's used with messengers, means E2E encrypted. Anyone who is calling Telegram 'encrypted by default' while technically correct, is being very, very misleading.

eitland 5y ago
Well, calling it "unencrypted" is equally misleading ... and technically wrong as well. In a somewhat technical community we should strive to communicate correctly and not invent new meanings for well-defined terms. By all means come up with a new nasty sounding term, but don't lie and excuse it with "it means something else now", that is borderline childish/sleazy salesman-ish.
- maqp 5y ago
  > Well, calling it "unencrypted" is equally misleading Encryption implies it protects message content from third parties. Show me someone who agrees its bad if the third party is some random guy from ISP, but it's good if its some random guy from Telegram LLC. Telegram is effectively unencrypted, because the messages are by default readable by someone else, like is the case if there was no encryption at all. Third parties are not just your average script kiddie capturing packets at your internet cafe, third parties are also everyone who hacks Telegram server, every intelligence agency that hacks Telegram servers, and a possible parent company that buys Telegram.
  - lucb1e 5y ago
    > Show me someone who agrees its bad if the third party is some random [girl] from ISP, but it's good if its some random [girl] from [service operator]. DoH
    - maqp 5y ago
      Oh apologies, I didn't want to be gender exclusive here.
      - lucb1e 5y ago
        To be clear, DoH refers to DNS over HTTPS (also thanks to u/wizzwizz4 for clarifying that in a sibling comment) and wasn't at all meant to be a sound. Not sure if that came across wrong, now that I read it again I see that it might have.
    - wizzwizz4 5y ago
      This is DNS over HTTPS, and good point.
  - ufmace 5y ago
    I think there's a pretty big difference between "your messages can be intercepted and arbitrarily modified by anybody who has any access to any router or server between one of your devices and the Telegram server" and "your message security is the security of the Telegram servers only".

lucb1e 5y ago

> Saying it is not encrypted is directly misleading. Sorry, that's my bad. I edited the message to clarify that I meant end-to-end encryption, since Telegram's implementation (mtproto) of e2ee is the topic of this submission. > also true for mail, banking and about everything else except the most secure instant messaging networks That is indeed the state of things. People like the convenience though: imagine you could only retrieve your data from Protonmail by knowing the encryption password. People would irrecoverably lose all their emails on a regular basis. Banking makes less sense though, since the bank needs to know how much money you have to be able to give some of that money (per your instruction) to e.g. merchants. Websites can be end to end encrypted, if the endpoint is owned by the person you're trying to reach. Cloudflare's "TLS MITM as a service" (and similar offerings) undermine that, but if you go to https://lucb1e.com https://lucb1e.com then your traffic is end-to-end encrypted to me. If you want, we can also verify fingerprints out of band, just like you should with encrypted chats to make sure you're not trusting the server (or in this case the signing authorities)!