9 ms·

While Telegram is seen as a "wild west" of free speech by many, its centralization and worrying lack of encryption for most "non-secret" chats is something to k

While Telegram is seen as a "wild west" of free speech by many, its centralization and worrying lack of encryption for most "non-secret" chats is something to keep in mind when reading Durov's passionate claims. - https://www.wired.com/story/telegram-encryption-whatsapp-settings/ https://www.wired.com/story/telegram-encryption-whatsapp-set... - https://portswigger.net/daily-swig/amp/multiple-encryption-flaws-uncovered-in-telegram-messaging-protocol https://portswigger.net/daily-swig/amp/multiple-encryption-f... Also, the optional E2EE encryption is way more limited (e.g., single-device, rather than having a key sharing mechanism) than most other, possibly more genuine, alternatives (Matrix, Signal). - https://telegram.org/faq#:~:text=Remember%20that%20Telegram%20secret%20chats,same%20contact%20as%20you%20like https://telegram.org/faq#:~:text=Remember%20that%20Telegram%....

EGreg 5y ago
I would pick encrypted Telegram over Signal anyday, but I believe that decentralized solutions with open source backends, like MaidSAFE, Freenet, and to some extent Matrix.org are the future.
- vfclists 5y ago
  Matrix share metadata by default. Count them out. And they have no desire to switch from their Python based server.
  - bilal4hmed 5y ago
    arent they building servers in Go and Rust ? https://matrix.org/docs/projects/server/conduit https://matrix.org/docs/projects/server/conduit https://github.com/matrix-org/dendrite https://github.com/matrix-org/dendrite
    - vfclists 5y ago
      Dendrite is their own project. Conduit is the project of another guy they don't get on with it. The Python server is a memory hog, and instead of rewriting it in a more performant language they have decided to scale horizontally instead. How is that feasible for the average guy who wants to run it on the their own server? https://matrix.org/blog/2020/11/03/how-we-fixed-synapses-scalability https://matrix.org/blog/2020/11/03/how-we-fixed-synapses-sca... https://news.ycombinator.com/item?id=16747174 https://news.ycombinator.com/item?id=16747174 After a $30 million funding round we should be seeing a lot better from them in the next few years. That python server ought to go.
      - kitkat_new 5y ago
        > and instead of rewriting it in a more performant language they have decided to scale horizontally instead. Dendrite is literally rewriting it in a more performant language > How is that feasible for the average guy who wants to run it on the their own server? The average guy likely doesn't host for thousands of people
        krageon 5y ago
        > The average guy likely doesn't host for thousands of people The python server already has trouble if you subscribe to large rooms. I'm all for promoting Matrix (it's a great project), but the default server has warts and nobody is served by trying to hide them.
        gefhfff 5y ago
        Trouble in the sense that the most resource intensive room makes Synapse use about 700 mb of RAM
        feanaro 5y ago
        Can confirm. I'm joined into Matrix HQ from a not-very-powerful VPS and a recent Synapse uses about 700M RAM and otherwise has no trouble handling it at all.
      - feanaro 5y ago
        > Dendrite is their own project. Conduit is the project of another guy they don't get on with it. Seems you've mixed something up. Dendrite is a matrix.org project, just like Synapse. Conduit is written by Timo Kösters who is currently employed by Famedly and is on good terms with both matrix.org and Element staff. They frequently cooperate.
  - EGreg 5y ago
    Yeah, I agree. I am simply counting them due to their future plams to do E2E peer to peer networks. What I would really LOVE to see is just decentralized backends that can be accessed via a growing number of https gateways by a widget on any website, and used to sideload code that will run apps and update apps. That will be an uncensorable app store (unless you censor all websites, or sniff all https packets and block ones that seem like they follow this protocol). If only Apple/Google would allow us the ability to run our own notification servers…
  - feanaro 5y ago
    You say "share metadata" like this is meaningful without specifying what is meant by that exactly.
    - vfclists 5y ago
      https://lukesmith.xyz/articles/matrix-vs-xmpp https://lukesmith.xyz/articles/matrix-vs-xmpp They also have a nasty habit of flagging posts which don't show them in a good light.
Aachen 5y ago
I doubt many here are still under the illusion that Telegram has anything to do with security or encrypted messaging. (It's just too damn convenient for UX reasons.) That's not the same as a "wild west of free speech", though. I have no idea how well they do on the front of censorship, they're way too intransparent an organisation for that, but the USA also sees itself as such and it is not encrypted. Secure protocols and censorship are two separate things, even if one (in this day and age) helps the other.
- joshxyz 5y ago
  Same here. Great user experience and developer experience too (compaire their bot api to other platforms).
  - deleted 5y ago
    [deleted]
swiley 5y ago
There are no good smartphone messaging apps. XMPP with OMEMO is the best you can do currently.
- gefhfff 5y ago
  It's not. It doesn't work with iOS in practice and requires you to verify each single session instead of just a the people to prevent MITM attacks. Afaik it does not have any audit either
  - zaik 5y ago
    > requires you to verify each single session instead of just a the people What do you mean by that? When no new devices are introduced you only have to verify the fingerprint of each contact once (via QR code). > Afaik it does not have any audit either https://conversations.im/omemo/audit.pdf https://conversations.im/omemo/audit.pdf
    - gefhfff 5y ago
      Pardon regarding the audit. But you don't have to verify each contact once, but each session the contact uses
      - zaik 5y ago
        What do you mean by 'session'? Here's my experience. I have three devices I use to connect to my XMPP server: phone (Conversations), PC and laptop (both gajim). Each one generates a keypair. I verified the public keys of PC and laptop by scanning a QR code using Conversations (phone). Conversations remembers all fingerprints as my own. Next time I meet a friend, they scan the QR code on my phone. They now have verified all three of my devices.
0xy 5y ago
Signal made their server code closed source for over a year while they added a scam cryptocurrency coin that has a financial conflict of interest with the creator of the project. They claimed to be "open source" while this was happening. More recently, they've had egregious bugs such as images being sent to random contacts in your list, an absolutely inexcusable error.
- afroboy 5y ago
  But the server code doesn't mean anything the most important thing is E2EE happen on device and the server is just a messenger. Signal is the most trusted app in authoritarian countries.
  - NullPrefix 5y ago
    >Signal is the most trusted app in authoritarian countries. Element and the Matrix protocol would disagree.
    - ryanlol 5y ago
      Are Element and the Matrix protocol situated in authoritarian countries, how can they disagree Anyway, no, this doesn’t reflect real usage.
      - kitkat_new 5y ago
        Matrix servers can be hosted by anyone and conversations are decentralized, i.e. can't be taken down easily. the Matrix protocol is accessible to anyone understanding English and having access to the web. It is even being worked on enabling P2P with Matrix, i.e. each client can spin up a local server that communicates with others (servers) via Bluetooth and other means of transports even if there is not a direct connection possible see https://matrix.org/blog/2021/05/06/introducing-the-pinecone-overlay-network https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...
        5y ago
stiltzkin 5y ago
I find Telegram in this gray area as a messaging app like WhatsApp or Signal and public channels and groups app as Discord. Durov is passionate about Telegram encryptions when many Telegram users do not actually care of privacy and more about convenience and a way to keep update with may communities as Discord.

EGreg 5y ago

I would pick encrypted Telegram over Signal anyday, but I believe that decentralized solutions with open source backends, like MaidSAFE, Freenet, and to some extent Matrix.org are the future.

vfclists 5y ago
Matrix share metadata by default. Count them out. And they have no desire to switch from their Python based server.
- bilal4hmed 5y ago
  arent they building servers in Go and Rust ? https://matrix.org/docs/projects/server/conduit https://matrix.org/docs/projects/server/conduit https://github.com/matrix-org/dendrite https://github.com/matrix-org/dendrite
  - vfclists 5y ago
    Dendrite is their own project. Conduit is the project of another guy they don't get on with it. The Python server is a memory hog, and instead of rewriting it in a more performant language they have decided to scale horizontally instead. How is that feasible for the average guy who wants to run it on the their own server? https://matrix.org/blog/2020/11/03/how-we-fixed-synapses-scalability https://matrix.org/blog/2020/11/03/how-we-fixed-synapses-sca... https://news.ycombinator.com/item?id=16747174 https://news.ycombinator.com/item?id=16747174 After a $30 million funding round we should be seeing a lot better from them in the next few years. That python server ought to go.
    - kitkat_new 5y ago
      > and instead of rewriting it in a more performant language they have decided to scale horizontally instead. Dendrite is literally rewriting it in a more performant language > How is that feasible for the average guy who wants to run it on the their own server? The average guy likely doesn't host for thousands of people
      - krageon 5y ago
        > The average guy likely doesn't host for thousands of people The python server already has trouble if you subscribe to large rooms. I'm all for promoting Matrix (it's a great project), but the default server has warts and nobody is served by trying to hide them.
        gefhfff 5y ago
        Trouble in the sense that the most resource intensive room makes Synapse use about 700 mb of RAM
        feanaro 5y ago
        Can confirm. I'm joined into Matrix HQ from a not-very-powerful VPS and a recent Synapse uses about 700M RAM and otherwise has no trouble handling it at all.
    - feanaro 5y ago
      > Dendrite is their own project. Conduit is the project of another guy they don't get on with it. Seems you've mixed something up. Dendrite is a matrix.org project, just like Synapse. Conduit is written by Timo Kösters who is currently employed by Famedly and is on good terms with both matrix.org and Element staff. They frequently cooperate.
- EGreg 5y ago
  Yeah, I agree. I am simply counting them due to their future plams to do E2E peer to peer networks. What I would really LOVE to see is just decentralized backends that can be accessed via a growing number of https gateways by a widget on any website, and used to sideload code that will run apps and update apps. That will be an uncensorable app store (unless you censor all websites, or sniff all https packets and block ones that seem like they follow this protocol). If only Apple/Google would allow us the ability to run our own notification servers…
- feanaro 5y ago
  You say "share metadata" like this is meaningful without specifying what is meant by that exactly.
  - vfclists 5y ago
    https://lukesmith.xyz/articles/matrix-vs-xmpp https://lukesmith.xyz/articles/matrix-vs-xmpp They also have a nasty habit of flagging posts which don't show them in a good light.

Aachen 5y ago

I doubt many here are still under the illusion that Telegram has anything to do with security or encrypted messaging. (It's just too damn convenient for UX reasons.) That's not the same as a "wild west of free speech", though. I have no idea how well they do on the front of censorship, they're way too intransparent an organisation for that, but the USA also sees itself as such and it is not encrypted. Secure protocols and censorship are two separate things, even if one (in this day and age) helps the other.

joshxyz 5y ago
Same here. Great user experience and developer experience too (compaire their bot api to other platforms).
- deleted 5y ago
  [deleted]

swiley 5y ago

There are no good smartphone messaging apps. XMPP with OMEMO is the best you can do currently.

gefhfff 5y ago
It's not. It doesn't work with iOS in practice and requires you to verify each single session instead of just a the people to prevent MITM attacks. Afaik it does not have any audit either
- zaik 5y ago
  > requires you to verify each single session instead of just a the people What do you mean by that? When no new devices are introduced you only have to verify the fingerprint of each contact once (via QR code). > Afaik it does not have any audit either https://conversations.im/omemo/audit.pdf https://conversations.im/omemo/audit.pdf
  - gefhfff 5y ago
    Pardon regarding the audit. But you don't have to verify each contact once, but each session the contact uses
    - zaik 5y ago
      What do you mean by 'session'? Here's my experience. I have three devices I use to connect to my XMPP server: phone (Conversations), PC and laptop (both gajim). Each one generates a keypair. I verified the public keys of PC and laptop by scanning a QR code using Conversations (phone). Conversations remembers all fingerprints as my own. Next time I meet a friend, they scan the QR code on my phone. They now have verified all three of my devices.

0xy 5y ago

Signal made their server code closed source for over a year while they added a scam cryptocurrency coin that has a financial conflict of interest with the creator of the project. They claimed to be "open source" while this was happening. More recently, they've had egregious bugs such as images being sent to random contacts in your list, an absolutely inexcusable error.

afroboy 5y ago
But the server code doesn't mean anything the most important thing is E2EE happen on device and the server is just a messenger. Signal is the most trusted app in authoritarian countries.
- NullPrefix 5y ago
  >Signal is the most trusted app in authoritarian countries. Element and the Matrix protocol would disagree.
  - ryanlol 5y ago
    Are Element and the Matrix protocol situated in authoritarian countries, how can they disagree Anyway, no, this doesn’t reflect real usage.
    - kitkat_new 5y ago
      Matrix servers can be hosted by anyone and conversations are decentralized, i.e. can't be taken down easily. the Matrix protocol is accessible to anyone understanding English and having access to the web. It is even being worked on enabling P2P with Matrix, i.e. each client can spin up a local server that communicates with others (servers) via Bluetooth and other means of transports even if there is not a direct connection possible see https://matrix.org/blog/2021/05/06/introducing-the-pinecone-overlay-network https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...
      - 5y ago

stiltzkin 5y ago

I find Telegram in this gray area as a messaging app like WhatsApp or Signal and public channels and groups app as Discord. Durov is passionate about Telegram encryptions when many Telegram users do not actually care of privacy and more about convenience and a way to keep update with may communities as Discord.