3 ms·

>Telegram is fast It's fast because it's insecure. Would they deploy end-to-end encryption for their groups, it would be as slow as the competition. >has nati

by maqp 5y ago

>Telegram is fast It's fast because it's insecure. Would they deploy end-to-end encryption for their groups, it would be as slow as the competition. >has native clients instead of a garbage web ui The "native clients" are used to manage data stored on remote server over an encrypted tunnel. The data that sits on Telegram servers is plaintext. The security benefits of the native clients (e.g. handling E2EE in a secure way) don't really play out when the desktop application doesn't feature end-to-end encryption at all, not even for 1:1 chats. >has better stickers than the alternatives, My Signal client has 1:1 match of my Telegram sticker packs. This is a non-issue. Porting them is trivial. >has a larger user base Sure, which means, larger amount of your data is hoarded by the Mark Zuckerberg of Russia who will take zero responsibility if his servers are hacked. Just a thought: You should probably refrain from advertising features of an app the glaring security issues of which you can ignore out of your privilege. There's a LOT of oppressive regimes in the world, and people living there shouldn't take your advice.

isatty 5y ago
I don't understand your first two rebuttals. I didn't want to keep talking about the fact that Telegram is not secure by default (there are plenty of other comments that go into this); I understand this, thank you. It doesn't have anything to do with the competition being unable to provide a fast _native client_ that I can use. I dislike web based apps, and I refuse to use them whenever a native alternative is available. > It's fast because it's insecure. Would they deploy end-to-end encryption for their groups, it would be as slow as the competition. Doubtful - it would increase the amount of compute required on their side, sure, but if done properly it will have close to 0 impact on the end users in terms of latency. > Mark Zuckerberg of Russia who will take zero responsibility if his servers are hacked. As opposed to _x_ from country _y_ that WILL take responsibility if their servers are hacked? Please. I will continue to talk about what I like about the user interface and what it does better than the competition because I want to.
- maqp 5y ago
  >I dislike web based apps, and I refuse to use them whenever a native alternative is available. I agree with you, I'd use native Signal desktop client written on Rust if there was an option. But there isn't, thus I'm using the Electron app. It's not lightweight, but it's secure by default. I wouldn't use Telegram native client written in C over Signal Electron client, because Telegram doesn't offer E2EE on that fast client. >Doubtful - it would increase the amount of compute required on their side, sure, but if done properly it will have close to 0 impact on the end users in terms of latency. AFAIK, there is no efficient group DH key exchange mechanism, especially not one that's forward secret. Signal will always do effectively a for-loop over group member list and send message to each contact encrypted with the key used to send 1:1 messages. Sure, it has some cool optimizations like encrypting attachments with symmetric key that is multicasted to each party. But still, this can't beat Telegram in speed. The nice thing is, AES doesnt' have to get slower, neither does X25519, smartphones and computers are getting faster, as are networks, especially with the advent of 5G. In a few short generations, they will be indistinguishable in speed, even with groups so large expectation of privacy can hardly be assumed. >As opposed to _x_ from country _y_ that WILL take responsibility if their servers are hacked? Please. This is a really stupid time and place to play the game of whataboutism. The point clearly is, vendors that use ubiquitous E2EE, don't have to worry about messages leaking from server. >I will continue to talk about what I like about the user interface and what it does better than the competition because I want to. Yeah sure, you do that. But perhaps also check your privilege before you make recommendations to others wrt the nice UX being worth the massive security trade offs. You can't say you haven't been warned.
  - isatty 5y ago
    HN is not the place where you get to tell people to check their privilege or to warn people. Write a blogpost, or write to dang@ if you feel strongly about it.
  - dijit 5y ago
    > I'd use native Signal desktop client written on Rust if there was an option. But there isn't, thus I'm using the Electron app. I’m not going to say anything else other than that this is exactly what Signal wants. They are actively hostile towards efforts to make third-party clients. You can argue that this is for security reasons, and maybe I’d buy that. But I would also bring up the fact that they implicitly control both ends in a binary distributed or web(thus- backdoorable) fashion most of the time. I’m not saying they do that, but since they have control of the clients, the servers and the protocol it is not impossible.

by maqp 5y ago

isatty 5y ago

I don't understand your first two rebuttals. I didn't want to keep talking about the fact that Telegram is not secure by default (there are plenty of other comments that go into this); I understand this, thank you. It doesn't have anything to do with the competition being unable to provide a fast _native client_ that I can use. I dislike web based apps, and I refuse to use them whenever a native alternative is available. > It's fast because it's insecure. Would they deploy end-to-end encryption for their groups, it would be as slow as the competition. Doubtful - it would increase the amount of compute required on their side, sure, but if done properly it will have close to 0 impact on the end users in terms of latency. > Mark Zuckerberg of Russia who will take zero responsibility if his servers are hacked. As opposed to _x_ from country _y_ that WILL take responsibility if their servers are hacked? Please. I will continue to talk about what I like about the user interface and what it does better than the competition because I want to.

maqp 5y ago
>I dislike web based apps, and I refuse to use them whenever a native alternative is available. I agree with you, I'd use native Signal desktop client written on Rust if there was an option. But there isn't, thus I'm using the Electron app. It's not lightweight, but it's secure by default. I wouldn't use Telegram native client written in C over Signal Electron client, because Telegram doesn't offer E2EE on that fast client. >Doubtful - it would increase the amount of compute required on their side, sure, but if done properly it will have close to 0 impact on the end users in terms of latency. AFAIK, there is no efficient group DH key exchange mechanism, especially not one that's forward secret. Signal will always do effectively a for-loop over group member list and send message to each contact encrypted with the key used to send 1:1 messages. Sure, it has some cool optimizations like encrypting attachments with symmetric key that is multicasted to each party. But still, this can't beat Telegram in speed. The nice thing is, AES doesnt' have to get slower, neither does X25519, smartphones and computers are getting faster, as are networks, especially with the advent of 5G. In a few short generations, they will be indistinguishable in speed, even with groups so large expectation of privacy can hardly be assumed. >As opposed to _x_ from country _y_ that WILL take responsibility if their servers are hacked? Please. This is a really stupid time and place to play the game of whataboutism. The point clearly is, vendors that use ubiquitous E2EE, don't have to worry about messages leaking from server. >I will continue to talk about what I like about the user interface and what it does better than the competition because I want to. Yeah sure, you do that. But perhaps also check your privilege before you make recommendations to others wrt the nice UX being worth the massive security trade offs. You can't say you haven't been warned.
- isatty 5y ago
  HN is not the place where you get to tell people to check their privilege or to warn people. Write a blogpost, or write to dang@ if you feel strongly about it.
- dijit 5y ago
  > I'd use native Signal desktop client written on Rust if there was an option. But there isn't, thus I'm using the Electron app. I’m not going to say anything else other than that this is exactly what Signal wants. They are actively hostile towards efforts to make third-party clients. You can argue that this is for security reasons, and maybe I’d buy that. But I would also bring up the fact that they implicitly control both ends in a binary distributed or web(thus- backdoorable) fashion most of the time. I’m not saying they do that, but since they have control of the clients, the servers and the protocol it is not impossible.