4 ms·

> In all seriousness though, my messages are part of my memory. They're shared experience with my partner and a record of decisions. Thanks for saying this, I

by afiori 5y ago

> In all seriousness though, my messages are part of my memory. They're shared experience with my partner and a record of decisions. Thanks for saying this, I moved to Telegram[1] before I had a chance to learn about/suffer from Whatsapp take on backups, but it would have been devastating to lose years of messages with people over a bricked phone. [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me.

lmm 5y ago
> [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me. Is that because you assume the NSA aren't reading all your messages or you don't mind if they are? Because the whole problem with dodgy crypto is that it still seems to "work fine for me" even when it isn't.
- theshrike79 5y ago
  My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. I keep that in mind when discussing things. If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones.
  - lmm 5y ago
    > My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. Telegram's initial marketing heavily emphasised privacy. If I search for Telegram then the very first search result blurb starts "Telegram messages are heavily encrypted". Maybe they don't explicitly claim to be E2E, but they absolutely are selling themselves as an encrypted, privacy-friendly messenger. > If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones. Completely agreed, I dislike the Signal hype as much as anyone. But I trust Telegram even less.
    - afiori 5y ago
      The heavily encrypted refers to server side storage. https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats > All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.
      - lmm 5y ago
        Wow, that's not at all clear from their marketing. That kind of misleading statement is definitely not what I'd want to see from a privacy/security-focused product - and yet Telegram's whole marketing is about privacy/security.
        afiori 5y ago
        The attack telegram is worried about is the russian army invading their datacenters, threatening employees, or forced buyout (what happend to the founder previous company vk.com).
- skinkestek 5y ago
  In my case it is to a large degree because I don't care. Disappearing messages are to prevent my kids reading the messages between me and their mother ;-) If NSA actually read my messages that would be kind of funny. If they have such a hack I'm sure they won't spend it on me or any other Joe Sixpack. Maybe ФСБ reads it but I have a hard time believing that too. My threat model consists of (not in any particular order): - my kids, - random internet strangers, - Facebook (who'll sell you to whoever pays), - Google or a Google-like entity with runaway "AI" and arrogant customer support[1] (who can lock out from my accounts for no reason) Besides, despite all the talk about E2E-encryption being so important, Signal (which I cheer for) IIRC has had a nasty XSS-exploit in their desktop allowing remote control of the pc, their phone client has been sending pictures to others than the recipient and probably a couple more. Ad I and others have pointed out repeatedly: There is more to security than encryption. It doesn't matter if it is E2E-encrypted if it is delivered to the wrong contact. And it doesn't matter if it is E2E-encrypted if whoever knows the secret can send you a specially crafted message and take control over your machine. [1]: I originally wrote employees but I don't think the average Google employee is more arrogant than others, they just come across that way because of policies created far above them.
  - lmm 5y ago
    Secure systems are all alike; every insecure system is insecure in its own way. A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was about privacy and encryption when their encryption didn't actually work.
    - afiori 5y ago
      > when their encryption didn't actually work. what are referring to here? I vaguely know about delivery bugs and protocol patches
      - 5y ago
- afiori 5y ago
  For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app; in other places it is essential, just not there. Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure.
  - lmm 5y ago
    > For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. But Telegram's whole selling point is privacy and security. If security is not your priority (which is totally reasonable!) there are plenty of other messaging apps that are much more established than Telegram, and much more honest about not being particularly privacy-oriented. > An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app Doesn't seem to have been a problem for e.g. WhatsApp. > Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. > If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure. Both these points seem like complete non sequiturs. If you want to avoid the app developer selling your data or providing it to governments, you need E2EE, there is no other way. Passive monitoring hasn't been a thing for about a decade, any non-joke messenger is at least using TLS, and it's not like people were using SMS/phone calls until Telegram came along with the revolutionary new idea of an internet messaging app.

by afiori 5y ago

lmm 5y ago

> [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me. Is that because you assume the NSA aren't reading all your messages or you don't mind if they are? Because the whole problem with dodgy crypto is that it still seems to "work fine for me" even when it isn't.

theshrike79 5y ago
My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. I keep that in mind when discussing things. If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones.
- lmm 5y ago
  > My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. Telegram's initial marketing heavily emphasised privacy. If I search for Telegram then the very first search result blurb starts "Telegram messages are heavily encrypted". Maybe they don't explicitly claim to be E2E, but they absolutely are selling themselves as an encrypted, privacy-friendly messenger. > If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones. Completely agreed, I dislike the Signal hype as much as anyone. But I trust Telegram even less.
  - afiori 5y ago
    The heavily encrypted refers to server side storage. https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats > All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.
    - lmm 5y ago
      Wow, that's not at all clear from their marketing. That kind of misleading statement is definitely not what I'd want to see from a privacy/security-focused product - and yet Telegram's whole marketing is about privacy/security.
      - afiori 5y ago
        The attack telegram is worried about is the russian army invading their datacenters, threatening employees, or forced buyout (what happend to the founder previous company vk.com).
skinkestek 5y ago
In my case it is to a large degree because I don't care. Disappearing messages are to prevent my kids reading the messages between me and their mother ;-) If NSA actually read my messages that would be kind of funny. If they have such a hack I'm sure they won't spend it on me or any other Joe Sixpack. Maybe ФСБ reads it but I have a hard time believing that too. My threat model consists of (not in any particular order): - my kids, - random internet strangers, - Facebook (who'll sell you to whoever pays), - Google or a Google-like entity with runaway "AI" and arrogant customer support[1] (who can lock out from my accounts for no reason) Besides, despite all the talk about E2E-encryption being so important, Signal (which I cheer for) IIRC has had a nasty XSS-exploit in their desktop allowing remote control of the pc, their phone client has been sending pictures to others than the recipient and probably a couple more. Ad I and others have pointed out repeatedly: There is more to security than encryption. It doesn't matter if it is E2E-encrypted if it is delivered to the wrong contact. And it doesn't matter if it is E2E-encrypted if whoever knows the secret can send you a specially crafted message and take control over your machine. [1]: I originally wrote employees but I don't think the average Google employee is more arrogant than others, they just come across that way because of policies created far above them.
- lmm 5y ago
  Secure systems are all alike; every insecure system is insecure in its own way. A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was about privacy and encryption when their encryption didn't actually work.
  - afiori 5y ago
    > when their encryption didn't actually work. what are referring to here? I vaguely know about delivery bugs and protocol patches
    - 5y ago
afiori 5y ago
For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app; in other places it is essential, just not there. Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure.
- lmm 5y ago
  > For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. But Telegram's whole selling point is privacy and security. If security is not your priority (which is totally reasonable!) there are plenty of other messaging apps that are much more established than Telegram, and much more honest about not being particularly privacy-oriented. > An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app Doesn't seem to have been a problem for e.g. WhatsApp. > Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. > If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure. Both these points seem like complete non sequiturs. If you want to avoid the app developer selling your data or providing it to governments, you need E2EE, there is no other way. Passive monitoring hasn't been a thing for about a decade, any non-joke messenger is at least using TLS, and it's not like people were using SMS/phone calls until Telegram came along with the revolutionary new idea of an internet messaging app.