4 ms·

There was recently comments about this with questionable reasoning. There is an official statement now so everyone can make their own educated opinion. Please

by noxer 5y ago

There was recently comments about this with questionable reasoning. There is an official statement now so everyone can make their own educated opinion. Please don't start a "telegram is not encrypted by default" shitstorm like in every other comment section about anything related to Telegram.

peakaboo 5y ago
100% this. People sitting in their WhatsApps and Facebook messangers, not understanding why someone would like to use a better chat client because it's actually better, and also because your data doesn't end up at Google or Facebook. Probably ends up at the nsa though. But I care more about not being a product of Google.
- GekkePrutser 5y ago
  WhatsApp does have pretty good E2E encryption though. Its weak point were the backups. They were encrypted but the key was with WhatsApp and the data with Google or Apple. All a friendly secret government request away. Of course you can turn off backups but you don't know whether everyone in your group does. However they have recently started to shore this up too. You can now choose to keep the key yourself. Of course you still don't know whether everyone in your chat group does this.. But even the alternative password method is much safer than before. According to FB it's stored in a HSM. Yes, we have to take their word for it. But if you use the numeric key only you will have it (and thus no way to recover the data which is a normal consequence of good encryption) WhatsApp still leaks data for sure. Like all your contacts (even non WhatsApp users), and all your metadata, like when you're talking to whom. But the content is pretty safe there IMO. Surprisingly so for Facebook. I don't like using it very much either but I'm Europe we simply don't have a choice. I limit its access to my contacts and photos by running it inside a 'work profile' on Android. Messenger is a different story of course.
GekkePrutser 5y ago
I think for open group chats it doesn't really matter. Because anyone can join anyway. Nobody complains that IRC isn't E2E encrypted and still many people use it every day :) That usecase doesn't benefit from it at all. For closed (invite only) group chats and 1:1 chats I think it should be encrypted by default though. Like WA and Signal. There's the secret chats of course but they only work on one device and not on group chats. Of course key management is hard in those cases but the others have worked around this very well. I agree that encryption issue doesn't really have any bearing on this bot ban though. This thing wasn't really about surveillance. But the best way to make this appear in the comments is Telegram fixing it :) Edit: FWIW I really like Telegram because they're open to integration with other networks (eg Matrix) and that they actually allow and embrace bots. But it would be so much better if they did have E2E.
- vbezhenar 5y ago
  I trust Telegram E2E implementation more, than Whatsapp. I'm sure that there are no cloud backups (for me and for other person), I'm sure that there's no sync happening (any sync is potential threat to security). All data stays on device and that's about it. It's true end-to-end. Whatsapp and Signal implementations are not End to End. They're something like User to User or Account to Account, with some encrypted copies floating around. They have many ends. That blurs responsibilities. I hope that their implementation will stay as it is. I'm all for implementing better security for ordinary chats, but they should keep secret chats feature as a restricted high-security channel.
  - GekkePrutser 5y ago
    The 'many ends' are really needed to make E2E viable IMO. It's the #1 reason I rarely use the secret chats in Telegram. And if a security feature has so many drawbacks that nobody uses it, you end up with less security. I'd rather have a flawed E2E implementation than one that is not used at all. For example I recently sent passwords to our Makerspace users in secret chats but half of them didn't see them because they were either on another device or they weren't online (also seems to be a requirement for secret chats). So many of them asked to 'stop being difficult' and send them in a normal chat. This is what I mean. And those people are mostly geeks. If they give up on it, what will normal people do? If it's not seamless enough, only us crypto geeks will use it and the rest will roll their eyes. It has to work for grandma just as easy as it does for us. And Signal and WhatsApp do really pull that off. I agree that backups were WhatsApp's weak spot but they are making some good modifications that allow users to store the key themselves. It would help if the key management could be checked though.. I totally agree with you there. Right now it's not transparent enough, even for those of us who know what they're doing it's not really possible to check with WhatsApp. Signal is another story as it's open source.
- thevinter 5y ago
  I would like to point out that key management is hard when, like telegram, you can seamlessly access your account on multiple devices. See Signal or WhatsApp asking you to be on the same network with your phone etc. This is the only reason I didn't move to Signal yet and I don't think there's (yet) a clear solution.
deleted 5y ago
[deleted]

by noxer 5y ago

peakaboo 5y ago

100% this. People sitting in their WhatsApps and Facebook messangers, not understanding why someone would like to use a better chat client because it's actually better, and also because your data doesn't end up at Google or Facebook. Probably ends up at the nsa though. But I care more about not being a product of Google.

GekkePrutser 5y ago
WhatsApp does have pretty good E2E encryption though. Its weak point were the backups. They were encrypted but the key was with WhatsApp and the data with Google or Apple. All a friendly secret government request away. Of course you can turn off backups but you don't know whether everyone in your group does. However they have recently started to shore this up too. You can now choose to keep the key yourself. Of course you still don't know whether everyone in your chat group does this.. But even the alternative password method is much safer than before. According to FB it's stored in a HSM. Yes, we have to take their word for it. But if you use the numeric key only you will have it (and thus no way to recover the data which is a normal consequence of good encryption) WhatsApp still leaks data for sure. Like all your contacts (even non WhatsApp users), and all your metadata, like when you're talking to whom. But the content is pretty safe there IMO. Surprisingly so for Facebook. I don't like using it very much either but I'm Europe we simply don't have a choice. I limit its access to my contacts and photos by running it inside a 'work profile' on Android. Messenger is a different story of course.

GekkePrutser 5y ago

I think for open group chats it doesn't really matter. Because anyone can join anyway. Nobody complains that IRC isn't E2E encrypted and still many people use it every day :) That usecase doesn't benefit from it at all. For closed (invite only) group chats and 1:1 chats I think it should be encrypted by default though. Like WA and Signal. There's the secret chats of course but they only work on one device and not on group chats. Of course key management is hard in those cases but the others have worked around this very well. I agree that encryption issue doesn't really have any bearing on this bot ban though. This thing wasn't really about surveillance. But the best way to make this appear in the comments is Telegram fixing it :) Edit: FWIW I really like Telegram because they're open to integration with other networks (eg Matrix) and that they actually allow and embrace bots. But it would be so much better if they did have E2E.

vbezhenar 5y ago
I trust Telegram E2E implementation more, than Whatsapp. I'm sure that there are no cloud backups (for me and for other person), I'm sure that there's no sync happening (any sync is potential threat to security). All data stays on device and that's about it. It's true end-to-end. Whatsapp and Signal implementations are not End to End. They're something like User to User or Account to Account, with some encrypted copies floating around. They have many ends. That blurs responsibilities. I hope that their implementation will stay as it is. I'm all for implementing better security for ordinary chats, but they should keep secret chats feature as a restricted high-security channel.
- GekkePrutser 5y ago
  The 'many ends' are really needed to make E2E viable IMO. It's the #1 reason I rarely use the secret chats in Telegram. And if a security feature has so many drawbacks that nobody uses it, you end up with less security. I'd rather have a flawed E2E implementation than one that is not used at all. For example I recently sent passwords to our Makerspace users in secret chats but half of them didn't see them because they were either on another device or they weren't online (also seems to be a requirement for secret chats). So many of them asked to 'stop being difficult' and send them in a normal chat. This is what I mean. And those people are mostly geeks. If they give up on it, what will normal people do? If it's not seamless enough, only us crypto geeks will use it and the rest will roll their eyes. It has to work for grandma just as easy as it does for us. And Signal and WhatsApp do really pull that off. I agree that backups were WhatsApp's weak spot but they are making some good modifications that allow users to store the key themselves. It would help if the key management could be checked though.. I totally agree with you there. Right now it's not transparent enough, even for those of us who know what they're doing it's not really possible to check with WhatsApp. Signal is another story as it's open source.
thevinter 5y ago
I would like to point out that key management is hard when, like telegram, you can seamlessly access your account on multiple devices. See Signal or WhatsApp asking you to be on the same network with your phone etc. This is the only reason I didn't move to Signal yet and I don't think there's (yet) a clear solution.

deleted 5y ago

[deleted]