4 ms·

> A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. It is secure for my purpose

> A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. It is secure for my purposes. Throwing away threat models and the meaning of secure and encrypted just to be able to define something that competes for attention as "not secure" and "not encrypted" (from other threads) isn't very high level, it is basic framing. edit: > Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was about privacy and encryption when their encryption didn't actually work. Remember, when Telegram came around WhatsApp was un-encrypted. Not point-to-point encrypted, just encoded. You didn't need to know or crack a key, you just needed toknow the protocol. Also, the main selling point of Telegram as I remember it wasn't security, it was dumb IMO, it was "we will be free (no cost) forever while WhatsApp is going to charge you money". Finally it isn't that I don't care if my messages are read, K just cannot care if my messages are read by NSA or FSB. If they go after me nothing will stop them.

lmm 5y ago
> Throwing away threat models and the meaning of secure and encrypted just to be able to define something that competes for attention as "not secure" and "not encrypted" (from other threads) isn't very high level, it is basic framing. It's basic, but it's valid. I was responding to all your "It doesn't matter if it is E2E-encrypted if xyz" points, which are faulty logic; if whether it's E2E-encrypted matters in your threat model, then whether it's E2E-encrypted still matters in your threat model even if other aspects of the system are secure. > Remember, when Telegram came around WhatsApp was un-encrypted. Not point-to-point encrypted, just encoded. You didn't need to know or crack a key, you just needed toknow the protocol. Citation? I don't remember it happening that way at all; Telegram marketed themselves by attacking WhatsApp on a couple of minor vulnerabilities in side features like video handling (which was legitimate in some ways, but extremely hypocritical given the bigger weaknesses in Telegram's own implementation). If message text was readable that would have been a much bigger deal.
- skinkestek 5y ago
  > It's basic, but it's valid. I wrote basic framing. It is a valid and effective marketing technique but not something you should rely on in a technical discussion. > if whether it's E2E-encrypted matters in your threat model, then whether it's E2E-encrypted still matters in your threat model even if other aspects of the system are secure. Then we agree :-) I've been communicating over email, irc and lots of other channels that were not E2E-encrypted for years and I still have to. I'll have to live with the fact that my bank, my government and a number of others have unencrypted, realtime access to far more sensitive data than Telegram. The fact that someone can read my Telegram messages consisting of perfectly innocent photos is way down on my list as long as they who do it has a lot to lose by doing it ;-) (I.e. if you had access it would be a problem. If any serious agency has access they will never use it against me because then they give away that they have the capability. In the same way Telegram has everything to lose by letting employees snoop. Same as Google: I do not fear them snooping my mail, I fear their AI will kill my account and no one will tell me why.) > Citation? I don't remember it happening that way at all; Telegram marketed themselves by attacking WhatsApp on a couple of minor vulnerabilities in side features like video handling (which was legitimate in some ways, but extremely hypocritical given the bigger weaknesses in Telegram's own implementation). If message text was readable that would have been a much bigger deal. I've followed Telegram quite closely so I am fairly certain about their marketing message early on. As you can see it also put them in a bad light so thats something too. I've been unable to find references for the point about just being encoded, not encrypted so take that with a grain of salt for now. Some evidence can probably be found in an old unofficial client repo or someone who wrote one of those can confirm. I might be wrong but remember this was back in 2009. It was a whole different world back then. I used and liked WhatsApp despite all this because just like with Telegram perfect security didn't matter for the kind of communication I have on messengers back then either.
  - skinkestek 5y ago
    Ok, so I had try one more time to look this up, and here is what Wikipedia says. (They also point to where it was written originally and an archive of the source.): > WhatsApp was initially criticized for its lack of encryption, sending information as plaintext.[198] Encryption was first added in May 2012.[199][200][201] End-to-end encryption was only fully implemented in April 2016 after a two-year process. from the "Security and Privacy" section of :https://en.m.wikipedia.org/wiki/WhatsApp https://en.m.wikipedia.org/wiki/WhatsApp Happy now? Again: this wasn't thought to be a big deal back in 2009 and I don't want to beat them up over it. The person I wrote to wrote: > If message text was readable that would have been a much bigger deal. For anyone who has read so far, keep in mind such rules only apply to Telegram ;-)

lmm 5y ago

> Throwing away threat models and the meaning of secure and encrypted just to be able to define something that competes for attention as "not secure" and "not encrypted" (from other threads) isn't very high level, it is basic framing. It's basic, but it's valid. I was responding to all your "It doesn't matter if it is E2E-encrypted if xyz" points, which are faulty logic; if whether it's E2E-encrypted matters in your threat model, then whether it's E2E-encrypted still matters in your threat model even if other aspects of the system are secure. > Remember, when Telegram came around WhatsApp was un-encrypted. Not point-to-point encrypted, just encoded. You didn't need to know or crack a key, you just needed toknow the protocol. Citation? I don't remember it happening that way at all; Telegram marketed themselves by attacking WhatsApp on a couple of minor vulnerabilities in side features like video handling (which was legitimate in some ways, but extremely hypocritical given the bigger weaknesses in Telegram's own implementation). If message text was readable that would have been a much bigger deal.

skinkestek 5y ago
> It's basic, but it's valid. I wrote basic framing. It is a valid and effective marketing technique but not something you should rely on in a technical discussion. > if whether it's E2E-encrypted matters in your threat model, then whether it's E2E-encrypted still matters in your threat model even if other aspects of the system are secure. Then we agree :-) I've been communicating over email, irc and lots of other channels that were not E2E-encrypted for years and I still have to. I'll have to live with the fact that my bank, my government and a number of others have unencrypted, realtime access to far more sensitive data than Telegram. The fact that someone can read my Telegram messages consisting of perfectly innocent photos is way down on my list as long as they who do it has a lot to lose by doing it ;-) (I.e. if you had access it would be a problem. If any serious agency has access they will never use it against me because then they give away that they have the capability. In the same way Telegram has everything to lose by letting employees snoop. Same as Google: I do not fear them snooping my mail, I fear their AI will kill my account and no one will tell me why.) > Citation? I don't remember it happening that way at all; Telegram marketed themselves by attacking WhatsApp on a couple of minor vulnerabilities in side features like video handling (which was legitimate in some ways, but extremely hypocritical given the bigger weaknesses in Telegram's own implementation). If message text was readable that would have been a much bigger deal. I've followed Telegram quite closely so I am fairly certain about their marketing message early on. As you can see it also put them in a bad light so thats something too. I've been unable to find references for the point about just being encoded, not encrypted so take that with a grain of salt for now. Some evidence can probably be found in an old unofficial client repo or someone who wrote one of those can confirm. I might be wrong but remember this was back in 2009. It was a whole different world back then. I used and liked WhatsApp despite all this because just like with Telegram perfect security didn't matter for the kind of communication I have on messengers back then either.
- skinkestek 5y ago
  Ok, so I had try one more time to look this up, and here is what Wikipedia says. (They also point to where it was written originally and an archive of the source.): > WhatsApp was initially criticized for its lack of encryption, sending information as plaintext.[198] Encryption was first added in May 2012.[199][200][201] End-to-end encryption was only fully implemented in April 2016 after a two-year process. from the "Security and Privacy" section of :https://en.m.wikipedia.org/wiki/WhatsApp https://en.m.wikipedia.org/wiki/WhatsApp Happy now? Again: this wasn't thought to be a big deal back in 2009 and I don't want to beat them up over it. The person I wrote to wrote: > If message text was readable that would have been a much bigger deal. For anyone who has read so far, keep in mind such rules only apply to Telegram ;-)