2 ms·

I trust Telegram E2E implementation more, than Whatsapp. I'm sure that there are no cloud backups (for me and for other person), I'm sure that there's no sync h

I trust Telegram E2E implementation more, than Whatsapp. I'm sure that there are no cloud backups (for me and for other person), I'm sure that there's no sync happening (any sync is potential threat to security). All data stays on device and that's about it. It's true end-to-end. Whatsapp and Signal implementations are not End to End. They're something like User to User or Account to Account, with some encrypted copies floating around. They have many ends. That blurs responsibilities. I hope that their implementation will stay as it is. I'm all for implementing better security for ordinary chats, but they should keep secret chats feature as a restricted high-security channel.

GekkePrutser 5y ago
The 'many ends' are really needed to make E2E viable IMO. It's the #1 reason I rarely use the secret chats in Telegram. And if a security feature has so many drawbacks that nobody uses it, you end up with less security. I'd rather have a flawed E2E implementation than one that is not used at all. For example I recently sent passwords to our Makerspace users in secret chats but half of them didn't see them because they were either on another device or they weren't online (also seems to be a requirement for secret chats). So many of them asked to 'stop being difficult' and send them in a normal chat. This is what I mean. And those people are mostly geeks. If they give up on it, what will normal people do? If it's not seamless enough, only us crypto geeks will use it and the rest will roll their eyes. It has to work for grandma just as easy as it does for us. And Signal and WhatsApp do really pull that off. I agree that backups were WhatsApp's weak spot but they are making some good modifications that allow users to store the key themselves. It would help if the key management could be checked though.. I totally agree with you there. Right now it's not transparent enough, even for those of us who know what they're doing it's not really possible to check with WhatsApp. Signal is another story as it's open source.

GekkePrutser 5y ago

The 'many ends' are really needed to make E2E viable IMO. It's the #1 reason I rarely use the secret chats in Telegram. And if a security feature has so many drawbacks that nobody uses it, you end up with less security. I'd rather have a flawed E2E implementation than one that is not used at all. For example I recently sent passwords to our Makerspace users in secret chats but half of them didn't see them because they were either on another device or they weren't online (also seems to be a requirement for secret chats). So many of them asked to 'stop being difficult' and send them in a normal chat. This is what I mean. And those people are mostly geeks. If they give up on it, what will normal people do? If it's not seamless enough, only us crypto geeks will use it and the rest will roll their eyes. It has to work for grandma just as easy as it does for us. And Signal and WhatsApp do really pull that off. I agree that backups were WhatsApp's weak spot but they are making some good modifications that allow users to store the key themselves. It would help if the key management could be checked though.. I totally agree with you there. Right now it's not transparent enough, even for those of us who know what they're doing it's not really possible to check with WhatsApp. Signal is another story as it's open source.